<![CDATA[Team IT Security - 📰 Alle Kategorien]]> de-DE Thu, 30 Jul 2026 06:09:12 +0200 Thu, 30 Jul 2026 06:09:12 +0200 15 2026 Team IT Security lakandor@tsecurity.de (Horus Sirius) lakandor@tsecurity.de (Horus Sirius) IT Security Cybersecurity Nachrichten Team IT Security RSS Generator v2.0 https://tsecurity.de/favicon.ico <![CDATA[Team IT Security - 📰 Alle Kategorien]]> <![CDATA[Phishing, privileges and passwords: Why identity is critical to improving cybersecurity posture]]> https://tsecurity.de/de/3694664/malware-trojaner-viren/phishing-privileges-and-passwords-why-identity-is-critical-to-improving-cybersecurity-posture/ https://tsecurity.de/de/3694664/malware-trojaner-viren/phishing-privileges-and-passwords-why-identity-is-critical-to-improving-cybersecurity-posture/ Sat, 25 Jul 2026 19:04:55 +0200 ⚠ Malware / Trojaner / Viren tsecurity.de <![CDATA[AI success requires a full-stack CIO]]> https://tsecurity.de/de/3694399/it-security-nachrichten/ai-success-requires-a-full-stack-cio/ https://tsecurity.de/de/3694399/it-security-nachrichten/ai-success-requires-a-full-stack-cio/ Sat, 25 Jul 2026 18:57:42 +0200 📰 IT Security Nachrichten tsecurity.de

Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?

It’s an understandable concern. Boards and CEOs are asking about AI. Business leaders are experimenting with use cases. Employees are discovering tools daily, while technology vendors promise unprecedented gains in productivity, innovation, and competitive advantage.

After hundreds of conversations with technology executives over the past year, I’ve become convinced that speed isn’t the real issue. The organizations pulling away from the pack aren’t necessarily adopting AI faster than everyone else. They’re executing more effectively — a subtle distinction that represents one of the defining leadership challenges of the AI era.

Technology has never been the hardest part of transformation. People, priorities, culture, and operating models are the biggest challenges. The ability to translate bold boardroom aspirations into thousands of thoughtful decisions made every day by architects, engineers, product managers, analysts, and business leaders is where competitive advantage is created. AI may be accelerating the pace of change, but it hasn’t changed that fundamental truth.

I’ve met plenty of executives who are exceptional in the boardroom. They know how to frame a vision, influence a board, and build confidence among investors and business leaders. I’ve also met remarkable technologists who instinctively understand the architectural decisions, engineering tradeoffs, and implementation details that determine how great ideas become reality. Modern CIOs, however, must move comfortably between both worlds. Afshean Talasaz is one who stands out among this rare breed.

Long before becoming CIO of Colonial Pipeline, Talasaz built his career from the ground up as a business professional, data scientist, and technologist. He has designed enterprise platforms, built AI capabilities, led technology organizations, and partnered closely with executive leadership teams on business transformation. Today, as an executive in residence with our Practitioners for Practitioners (P4P) community, he helps CIOs and business leaders navigate one of the most significant technology shifts of our generation.

While Talasaz brings deep knowledge of data and AI to the table, his greatest strength is his ability to create strategy and connect it with execution. He can spend the morning discussing enterprise reinvention with the board and the afternoon debating architectural principles with the teams responsible for bringing that vision to life.

That versatility gives Talasaz a unique lens on how CIOs can deliver value with AI.

Software companies have a term for engineers who understand every layer of the technology stack: full-stack developers. Listen to Talasaz and it becomes evident that the AI era requires something similar from technology leaders: a full-stack CIO.

The full-stack CIO: Leading with clarity

A full-stack CIO understands how every layer of the enterprise influences the next. They recognize that every strategic priority becomes a portfolio investment, every investment shapes an operating model, every operating model influences architecture, every architecture choice informs product decisions, every product decision shapes engineering priorities.

The best CIOs understand both ends of that journey. The extraordinary ones understand everything in between.

And those who execute best lead with clarity, Talasaz says.

“Everyone, from executives to middle managers to the people writing code, should be able to explain what we’re trying to achieve,” he emphasizes. “Clarity isn’t that we’ve handed out the PowerPoint. It’s that people genuinely understand where we’re going and can articulate it in their own language.”

One of the unintended consequences of the AI boom is that organizations are beginning to confuse activity with alignment. They have AI councils, AI governance committees, AI innovation labs, AI centers of excellence, AI pilots, and AI roadmaps. Yet if you stop ten people in the hallway and ask a deceptively simple question, What business problem are we actually trying to solve? you’ll often hear ten different answers.

As a result, architects optimize for one objective while product teams optimize for another. Business units pursue opportunities that seem perfectly reasonable from their perspective. Engineers make thoughtful technical decisions based on the information available to them. Individually, none of those decisions are necessarily wrong. Collectively, however, they create organizational drift. AI doesn’t create that problem. It simply accelerates the consequences.

And while AI can be a force multiplier for the positive when every decision is guided by a shared understanding of where the organization is headed, it can also be a force multiplier for the negative, resulting in an organization simply moving faster in different directions.

“When we have the fundamentals right, the tech infrastructure, the operating models, the nuances of how our business actually runs, we get the impacts of AI in a positive way,” Talasaz says. “When we don’t have those in place, AI can amplify the gaps or mute the benefits.”

At a time when so much of the conversation surrounding AI is focused on algorithms, agents, and automation, it’s an important reminder that organizations don’t execute strategy; people do.

Reducing organizational friction

Most executives are familiar with the concept of VUCA that characterizes today’s business environment. But Talasaz stresses the importance of turning this concern inward: “If the world outside our organizations is becoming more volatile, uncertain, complex, and ambiguous, what are we, as leaders, doing to the inside of our organizations?”

Leaders spend enormous amounts of time helping their organizations respond to external disruption but comparatively little time asking whether they are inadvertently re-creating those same conditions internally in response to those external needs. Are we reducing uncertainty or introducing more of it? Are we simplifying work or adding unnecessary complexity? Are we helping people focus on what matters most, or asking them to navigate competing priorities and shifting expectations?

Talasaz refers to this phenomenon as double VUCA — something I’ve witnessed repeatedly while working with CIOs over the past decade. Organizations often assume they’re struggling because of technology limitations when the real constraint is organizational friction. Teams wait for decisions. Priorities shift faster than roadmaps. Governance grows heavier. New committees are formed to solve problems created by existing committees. Everyone is working harder, yet the organization somehow feels slower.

AI amplifies both outcomes. Organizations with clarity become dramatically more effective because AI accelerates good decisions. Organizations without clarity simply accelerate confusion.

Operating model as strategy enabler

AI governance is one way to achieve greater clarity, but as Talasaz says, governance shouldn’t primarily exist inside policy manuals that few people read.

Instead, AI governance should be embedded in the daily rhythms of the organization, shaping how teams collaborate, how decisions are made, how products move from ideas into production, and how innovation happens safely without requiring constant escalation. In other words, it’s all about your operating model.

“If you had to pick one thing that isn’t technology, your operating model is the most important element for executing data and AI at scale,” he says.

The best operating models create enough clarity that capable people can make thousands of decisions independently and confidently, without having to wait for permission. By embedding good governance into the way it works, the organization becomes faster.

This advice echoes something I’ve heard repeatedly from some of the world’s most respected CIOs: High-performing organizations aren’t built on tighter control; they’re built on greater trust, supported by clear principles, shared expectations, and operating models that enable responsible decision-making at every level of the enterprise.

Talasaz points out that technology leaders tend to speak in terms of transformation. He suggests CIOs consider a different word: reinvention.

As he explains, transformation implies replacing what exists today with something new. Reinvention starts with a more clear-eyed and practical premise: Some things absolutely must change; others represent years, sometimes decades, of accumulated expertise, customer trust, operational discipline, and competitive advantage.

Reinvention is about building on those strengths while also creating new ways to deliver value. The leaders making the greatest progress in their AI journeys seem to recognize that it’s less about abandoning the past than thoughtfully preparing the organization for the future.

Closing the gap between strategy and execution

Full-stack CIOs must be able to map out the various layers of execution and planning that need to be done at every level of the organization to be successful. To help with this, Talasaz has developed a data and AI framework that draws on his own experiences “from the keyboard to the boardroom.”

As Talasaz sees it, too many organizations have been doing good work in isolation. “They’re doing a lot of the right things,” he says. “They’re just not connected.”

Boards may be discussing growth while business leaders redesign customer experiences. Product teams may be prioritizing new capabilities while architects modernize platforms. Data teams may be improving quality while engineers focus on delivery. Every group makes meaningful progress within its own domain, yet somewhere between strategy and execution, the connective tissue begins to disappear. Talasaz’s framework brings those connecting points to the forefront.

Crucially, the framework doesn’t begin with technology or AI or even with data. It begins with the experiences the organization hopes to create for its customers, employees, or partners. Many AI initiatives start with the question, “What can this technology do?” And indeed, we need to be inspired by the possibilities and challenged to think differently by what the technology can do. But, Talasaz emphasizes, we also need to ask what experiences we need to deliver for our business and how the technology can make that a reality.

The framework challenges CIOs to answer that question first. Only after the experiences are clearly defined does the conversation move to the capabilities required to deliver it, the business activities that support those capabilities, the AI and data products that enable them, and finally the data foundation that makes everything possible.

This shift in perspective ensures that, rather than allowing technology investments to search for business value, the business experience defines the technology required to deliver it. For CIOs, that’s more than a planning exercise. It’s a fundamentally different way of leading.

Over the coming months, the P4P community will be convening a series of small CxO roundtables to explore these issues and work more deeply with Afshean Talasaz’s 6×6 Data and AI Framework. CIOs and other enterprise leaders interested in participating are welcome to reach out to me directly.

]]> <![CDATA[The new value architecture of the AI-native SaaS era]]> https://tsecurity.de/de/3694395/it-security-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/ https://tsecurity.de/de/3694395/it-security-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/ Sat, 25 Jul 2026 18:55:51 +0200 📰 IT Security Nachrichten tsecurity.de

The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.

In brief:

  • AI is transforming software as a service (SaaS), and the old ways of keeping score no longer apply.
  • Smart companies are evolving new metrics that provide deeper insight into how AI-native software is performing in a new marketplace.
  • These changes impact everything from pricing to valuations.

The transformation of the software-as-a-service (SaaS) industry toward AI-native operating companies is rapidly changing the unit of value across the industry.

The traditional metric of seats — which measured access — is rapidly giving way to credits designed to measure work performed. This evolution is upending the industry in multiple ways, impacting everything from pricing to enterprise valuations.

While many companies still cling to seat-based metrics to measure growth, efficiency and durability, the future is likely to be one in which companies utilize a credit-centric metrics framework, with seats and outcomes as the bookends of a spectrum.

Why do software companies need new metrics?

Why the rethink, and why now? There are five major forces that are driving this shift:

  1. The unit of value is changing. Seats measured who could access software, and credits measure what the software actually does. But in an AI-native world, agents don’t have seats; they have workloads. Over the past 18 months, every major SaaS platform has moved to some forms of credit or consumption unit.
  2. The cost of goods sold (COGS) is exploding. AI inference adds real per-unit costs that scale with usage. In an AI-native world, software companies can’t scale to infinite users at near‑zero marginal cost as before.
  3. Buying is moving up the org chart. AI-native applications shift purchasing to higher-level operators — such as line-of-business leaders or chief operating officers — which expands the market from software budgets to labor budgets. And because AI agents replace services as well as software, the total market opportunity is 3x to 10x larger than traditional SaaS.
  4. Time to value (TTV) is collapsing. With AI-native tools, customers start seeing meaningful results in weeks rather than quarters. Onboarding and setup are fast, workflows are pre-built, and there’s no need for extensive customer success or professional services — dramatically reducing implementation time and costs.
  5. Retention is bifurcating. AI forces clarity in a way that traditional SaaS couldn’t. Products that can provide value become even “stickier” and retain customers. Those that don’t churn faster. In an AI-native marketplace, the middle disappears.

How this shift is impacting pricing

Given how AI-native software is transforming the market, the shift to more variable pricing options is inevitable.

Seats won’t go away completely. Subscription pricing based on the number of users is stable and predictable and will continue to work for some customers. Tokens — the use of pass-through pricing for underlying compute — will fit those customers where the AI feature is commoditized or the buyer wants transparency into costs.

Credits will likely become the dominant architecture because they provide a simple metric for both customers and providers. The vendor sets the conversation ratio between credits and underlying compute, shielding the customer from inference cost details. Credits are easy to understand and can be packaged into annual contracts for multiple features and products.

Finally, the industry will likely see some move toward outcome-based pricing for results such as resolved tickets, recovered revenue or qualified leads. This strategy will mostly be limited to verticals where it is easy to prove AI impacted the result.

Where a software vendor sits on this spectrum is a signal of differentiation and pricing power. Credits are where most defensible AI-native businesses are landing because they balance customer predictability with vendor margin control.

How AI upends classic SaaS metrics

When SaaS was in its infancy, companies settled on key metrics designed to answer a small set of core questions. Are we growing? Are customers using the product? Are we retaining and expanding accounts?

But as AI upends software itself, it is also requiring companies to adopt new metrics to track success. These new metrics fall into three primary buckets, rebuilt around the pricing spectrum described earlier and the trend toward credits as the primary frame:

Revenue composition

  • Committed credit annual recurring revenue (ARR) vs. burndown ARR: Measuring the credits sold on annual commitment vs. those consumed and replenished. This is the single most important split for valuation. Committed credits behave like subscription and burndown behaves like usage.
  • Credit utilization rate: The percentage of purchased credits consumed per period. This is a leading indicator of renewal sizing.
  • Credit burn velocity: How fast is a customer consuming their credits, and is that consumption increasing or decreasing quarter over quarter? This metric predicts expansion or contraction before it shows up in ARR.
  • Effective price per credit: The real revenue per credit after discounts, overage and rollover, which can detect revenue leakage and help companies set smarter guide rails.

Margin reality

  • Credit margin: The gross profit the company earns per credit after subtracting inference costs. This is the core economic unit for AI-native, usage-based businesses — the replacement for gross margin per seat used in SaaS.
  • Inference-adjusted gross margin: By carving out AI inference costs separately in the P&L statement, you can see true AI margins, avoid hiding deterioration inside blended SaaS margins, and clearly distinguish AI economics from legacy SaaS economics.
  • Compute leverage ratio: This metric measures how efficiently the business converts compute spend into revenue. It shows whether your AI margins are improving as you scale.
  • AI-adjusted “Rule of 40”: This updated metric recalibrates the traditional growth and profitability benchmark to account for AI’s lower gross margins and variable inference costs, giving a more accurate picture of business health for AI-native companies.

Behavioral and value signals

  • Time-to-first outcome: Replaces traditional onboarding metrics. Tracks how fast a customer reaches their first measurable result.
  • Adoption: AI-native adoption is measured by workflow penetration and active agent density, not seat count. As AI replaces human-driven usage, the unit of adoption shifts from people to automated workflows and agents.
  • Net credit retention (NCR): Credit-volume retention across the customer base, tracked separately from net recurring revenue to avoid price-change impact.

Along with these new metrics, the industry’s transformation is prompting companies to retire or recalibrate old SaaS measures, including per-seat ARR as a primary key performance indicator (KPI), traditional magic number calibrated to subscription dynamics, unadjusted Rule of 40, customer success metrics tied to human touchpoints, and blended gross margin without AI COGS carve-outs.

What does this mean for enterprise value calculations?

As the internal metrics of success change, so do the ways the investment community measures growth and long-term viability.

Increasingly, a company’s valuation multiple depends on whether its revenue behaves like committed subscription ARR or volatile usage ARR, and the commit‑to‑burndown ratio is the metric investors use to decide where the company fits.

For example, a business with 80% committed credit ARR could trade closer to subscription comps and one with 80% burndown could trade closer to usage comps even though both have the same types of customers. Being able to proactively explain the commit‑to‑burndown mix can help companies avoid undervaluation.

In addition, utilization is expected to replace net promoter scores and seat usage as the primary predictor of churn or expansion. Low utilization guarantees downsizing at renewal, so companies must track utilization cohorts the same way SaaS tracks logo retention cohorts today.

We’re also seeing an inversion of the operating model, with R&D and COGS moving up the P&L and sales and marketing (S&M) and customer success (CS) moving down or sideways. The net operating leverage profile is structurally different from classical SaaS, and the cost-to-scale curve looks different too.

Finally, credit margin engineering is a hidden value-creation lever. The gap between price per credit and cost per credit is set by the software vendor and can be optimized. Most operators have barely started managing this rigorously, and the ones who do will pull away on margin.

What this means for leaders, boards and investors

The shift from classic SaaS metrics to new AI‑native measures isn’t cosmetic. It represents the seismic change the industry is experiencing as AI matures and transforms products and organizations.

While these metrics — and perhaps others yet to be determined — may evolve over time, there is no doubt they are already changing how AI companies allocate capital, price products, incent sales teams, evaluate performance and communicate with investors.

It’s important to remember that SaaS metrics were practical tools for a specific era of software. As that era draws to a close, winning companies will choose new metrics that shape behavior and drive smart decision-making.

The views reflected in this article are the views of the author and do not necessarily reflect the views of Ernst & Young LLP or other members of the global EY organization.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Valve begin improving account switching in the latest Steam Beta]]> https://tsecurity.de/de/3693712/linux-tipps/valve-begin-improving-account-switching-in-the-latest-steam-beta/ https://tsecurity.de/de/3693712/linux-tipps/valve-begin-improving-account-switching-in-the-latest-steam-beta/ Sat, 25 Jul 2026 11:14:35 +0200 🐧 Linux Tipps tsecurity.de

Read the full article on GamingOnLinux.

]]> <![CDATA[Building Premium Android Experiences at Google I/O ‘26]]> https://tsecurity.de/de/3693509/android-tipps/building-premium-android-experiences-at-google-io-26/ https://tsecurity.de/de/3693509/android-tipps/building-premium-android-experiences-at-google-io-26/ Sat, 25 Jul 2026 10:15:42 +0200 đŸ€– Android Tipps tsecurity.de
Posted by Ataul Munim, Android Developer Relations Engineer
A truly differentiated Android experience is about delivering premium delight wherever your users are. At Google I/O ‘26, we showcased how the latest advancements in the Android ecosystem can help you elevate your app's quality while maximizing development efficiency.

To help you build apps that stand out, we're diving into the key tools and libraries designed to optimize your core performance, extend the surfaces of your app to other devices, and streamline how your app handles high-quality media. 

Here is a recap of the essential updates and sessions you need to know to deliver a next-level experience across form factors!

Maximize app performance and ROI with the R8 Configuration Analyzer

A premium experience is only as good as its foundation, and a performant foundation is what allows your app to scale across the Android ecosystem. This is especially true with the release of Android 17, which introduces conservative, device RAM-based app memory limits to target extreme memory leaks and outliers before they cause system-wide instability. To stay below these new system thresholds and prevent your app from being terminated, having a lean footprint is no longer optional: it’s a critical requirement.

This year, we’re making it easier to build highly optimized, fast apps by introducing the R8 Configuration Analyzer in Android Studio. R8 is your most powerful tool for improving app performance, but its effectiveness is often limited by overly broad "keep rules" that prevent the compiler from stripping away unused code. The new Configuration Analyzer provides optimization, obfuscation, and shrinking scores, allowing you to identify specific rules that are preventing the benefits of R8 optimization.

By optimizing their R8 configurations, developers at Monzo achieved a 30% improvement in cold starts and a 35% reduction in ANRs. Smaller, faster code isn't just about efficiency; it's about ensuring your app has the memory headroom to deliver delight on every form factor, from the phone to the car.

Extend your reach with a unified approach to Widgets on Phones, Watches and Cars

User interaction is shifting toward quick, glanceable moments—short bursts of information that keep users connected without needing to open the full app. To help you increase the reach of your app content, we are unifying the development experience across the Android ecosystem with Jetpack Glance. By using a consistent, Compose-based model, you can elevate the content most important to your users straight to the phone’s home screen, Wear Widgets (previously Tiles!), and cars with a familiar workflow.

In order to help users engage with your content and features, even outside your app, we are making widgets more expressive and adaptive with RemoteCompose. On Wear OS, RemoteCompose allows you to use the Compose tools you’re already comfortable with to define UI logic that renders natively on remote surfaces, ensuring that your glanceable experiences remain highly performant and responsive even on resource-constrained hardware. On mobile and cars, RemoteCompose is used as a new framework giving Widgets new expressive capabilities.

You can use Jetpack Glance (together with RemoteCompose on Wear) to deliver a cohesive user journey. Whether it’s viewing flight status on the car dashboard, checking a gate change on a watch, or managing a boarding pass from a phone widget, this shared approach maximizes your app’s presence while keeping your development effort focused and efficient.

Supercharge your media pipeline with a complete, production-ready toolkit

Android has become a world-class home for the entire media lifecycle, and we are simplifying the journey from the first capture to the final playback. By leveraging Jetpack CameraX and Media3, you can build professional-grade experiences that feel native across the entire ecosystem. 

It starts with high-fidelity capture using the CameraXViewfinder Composable, which ensures your preview remains perfectly scaled and responsive on any form factor, including foldables and tablets. Use this to build adaptive capture experiences like a picture-in-picture view for multi-tasking, or that take advantage of modern features like high-frame-rate or slow-motion capture with CameraX v1.5.

The new Media3 AI Effects library will provide a unified interface for premium features like Image & Video Enhance, Magic Eraser, and Studio Sound. This allows you to focus on the creative intent while Media3 handles the heavy lifting of choosing the most efficient and reliable path for the device. Then, use the latest improvements in multi-asset editing with Media3 Transformer to composite your edited videos together!

Complete the pipeline with tools designed for professional-grade export and viewing, including:

  • CodecDB, which offers data-driven encoding recommendations tailored to specific chipsets, ensuring your exported videos maintain high visual quality with minimal noise or blurriness
  • Scrubbing Mode in ExoPlayer to provide the buttery-smooth seeking experience users expect from premium media apps
  • Enhanced Cast support with the new CastPlayer API in Media3

By unifying these technical pillars, you can build a cohesive, high-performance media journey that delivers both delight for your users and high ROI for your development team.

For more details, check out the premium Android experience YouTube playlist.

]]> <![CDATA[Android 17 is here]]> https://tsecurity.de/de/3693505/android-tipps/android-17-is-here/ https://tsecurity.de/de/3693505/android-tipps/android-17-is-here/ Sat, 25 Jul 2026 10:15:36 +0200 đŸ€– Android Tipps tsecurity.de
Posted by Matthew McCullough, VP of Product Management, Android Developer


Today we're releasing Android 17 and making it available on most supported Pixel devices. Look for new devices running Android 17 in the coming months.

Android 17 marks the start of our transition to an intelligence system, putting your apps at the center. It's shifting to an adaptive-first development standard by introducing mandatory large-screen resizability, all while delivering next-generation privacy, security, media, camera, and performance. We'll cover all that in this post, as well as how we're bringing together next generation tools, libraries, and agent skills to help your apps embrace the opportunity.

Throughout the past year, from our Canary channel to our Beta releases, we’ve collaborated with you in the developer community to build a platform you and your users can trust. To that end, this moment marks the availability of the source code at the Android Open Source Project (AOSP). This allows you to examine the source code for a deeper understanding of how Android works.

Let's dive deeper into Android 17.

An intelligence system

With deep integration between hardware, software and AI, we’re transforming Android from an operating system to an intelligence system. It's about delivering new helpful experiences that anticipate user needs, and it brings more opportunities for engagement with your apps. To that end, Android 17 expands the capabilities of AppFunctions, a platform API with a corresponding Jetpack library. It allows you to contribute your app's unique capabilities as orchestratable "tools" for Android MCP, the on-device equivalent of the Model Context Protocol. AI agents and assistants (like Google Gemini) can discover and execute AppFunctions to perform workflows on behalf of the user with direct access to the app's local state.

The Jetpack library, currently in alpha, makes adding AppFunctions as easy as annotating a class and adding KDoc comments.

/**
 * A note app's [AppFunction]s.
 */
class NoteFunctions(
    private val noteRepository: NoteRepository
) {
    /**
     * Adds a new note to the app.
     *
     * @param appFunctionContext The execution context.
     * @param title The title of the note.
     * @param content The note's content.
     */
    @AppFunction(isDescribedByKDoc = true)
    suspend fun createNote(
        appFunctionContext: AppFunctionContext,
        title: String,
        content: String
    ): Note {
        return noteRepository.createNote(title, content)
    }
}

We’ve also launched an AppFunctions agent skill that analyzes your app’s key workflows, automatically generates the required Kotlin code, optimizes your KDocs for LLM tool-calling, and provides ADB commands for testing and debugging.

The Gemini integration is currently in a private preview with trusted testers, but you can begin preparing your apps now. In addition to ADB commands to execute your AppFunctions, we've provided a test agent app that includes an interface to discover and execute your app functions and simulate an AI agent integration. Join our integration early access program at goo.gle/eap-af for a chance to be among the first apps to deploy AppFunctions to production.

Adaptive-first

Your users no longer rely on a single form factor; they transition between phones, foldables, tablets, laptops, automotive displays, and immersive XR environments. Now, with over 580 million large screen devices in the hands of users and the forthcoming launch of Googlebooks, the next generation of ChromeOS built on the Android stack, adaptive is no longer just a technical goal. It’s a massive opportunity to reach highly engaged users, which is one of the reasons we're shifting to an adaptive-first development standard.

No resizability/orientation restrictions on large screens

To ensure apps deliver a premium experience across all form factors, including mobile devices running in desktop mode on connected displays, Android 17 (API level 37) removes the developer opt-out for orientation and resizability restrictions on large screen devices (sw > 600 dp) for apps targeting API level 37. The system will ignore legacy manifest attributes and runtime APIs, including screenOrientation, setRequestedOrientation(), resizeableActivity=false, and aspect ratio constraints (minAspectRatio/maxAspectRatio). Games (based on app category in Google Play) remain exempt. Your app must be ready to adapt to any window size, respect the user's preferred device posture, and support free-form windowing natively.

Next-gen multitasking: App Bubbles, Bubble Bar, and desktop interactive PiP

Android 17 introduces powerful new windowing capabilities that redefine how users multitask, demanding even greater layout flexibility from your apps:

  • App Bubbles: Moving beyond the messaging bubbles API, users can now transform any app into a floating bubble by long-pressing its icon on the launcher. This feature is available across phones, foldables, and tablets, enabling lightweight multitasking for any workflow.
  • The Bubble Bar: On large screens (tablets and foldables), the system taskbar now includes a dedicated Bubble Bar to organize, transition between, and dock these floating app bubbles.
  • Desktop interactive PiP: In desktop environments, Android 17 introduces interactive Picture-in-Picture (PiP). Unlike traditional PiP windows which are read-only, these pinned windows remain fully interactive while staying always-on-top of other application windows.

App Bubbles and Bubble Bar in action

Activity recreation updates

To prevent disruptive state loss and stutter, Android 17 updates the default behavior for Activity recreation. The system will no longer restart activities by default for typical configuration changes that do not require a full UI redraw (including CONFIG_KEYBOARD, CONFIG_KEYBOARD_HIDDEN, CONFIG_NAVIGATION, CONFIG_TOUCHSCREEN, and CONFIG_COLOR_MODE).
Instead, running activities will receive these updates via onConfigurationChanged(), enabling smooth transitions. If your application explicitly relies on a full restart to reload resources for these changes, you must now explicitly opt-in using the new android:recreateOnConfigChanges manifest attribute.

Continue On

Android 17 adds Continue On to help users seamlessly transition a task between Android devices. The user sees a suggestion for the most recently opened app from their mobile device in their tablet taskbar, providing a one-tap affordance to launch the app and deep-link where they left off. Continue on can support app-to-web transitions, including falling back to using the web if the app isn't installed.

Handoff Suggestion on a Tablet


class MyHandoffActivity : Activity() {

    ...

  override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)
    // Do stuff
    ...
    // Enable handoff
    setHandoffEnabled(true, null)
  }

  // Override and implement onHandoffActivityDataRequested
  override fun onHandoffActivityDataRequested(handoffRequestInfo: HandoffActivityDataRequestInfo) : HandoffActivityData {
    // Create and return handoff data
  }
}

Go adaptive-first with Jetpack Compose

To help you adapt your apps to meet the new Android 17 requirements, we've launched the Jetpack Compose adaptive skill. This AI-powered developer workflow helps you implement the best adaptive practices:

  • Adaptive navigation: Automatically transition between bottom navigation bars on mobile and edge-anchored navigation rails on large screens using NavigationSuiteScaffold from the Material 3 Adaptive library.
  • Multi-pane layouts: Implement list-detail and supporting pane layouts natively using Navigation 3 Scenes (ListDetailSceneStrategy and SupportingPaneSceneStrategy) instead of fragile fragment transactions.
  • FlexBox & Grid APIs: Utilize Compose 1.11's dynamic layout components to easily adjust row and column spans on the fly, ensuring your content always fills the space beautifully.
  • Advanced non-touch input: Leverage Compose 1.11's enhanced trackpad and mouse support, including native focus rings and new APIs (like TrackpadInjectionScope and performTrackpadInput) to easily test and deliver a true "laptop-class" experience on Googlebooks and Desktop Mode.
  • Dynamic window states: Leverage Compose's reactive state model to seamlessly adapt your UI when the app transitions from full screen to a floating App Bubble or an interactive Desktop PiP window, ensuring a premium experience even at minimal dimensions.

Android is Compose-first

Compose offers the easiest way to build adaptive apps, and that's just one of the many reasons we believe that all Android UI should be built with Compose. To that end, Android development is now Compose-first. All new Android APIs, libraries, tools, and developer guidance will be built exclusively for Jetpack Compose. Legacy View components (in the android.widget package) and View-based Jetpack libraries (like Fragments, RecyclerView, and ViewPager) are now in maintenance mode. They will receive only critical bug fixes, and no new features.

TIP
Ready to migrate? Use our AI-driven XML to Compose Migration Skill to automatically analyze your legacy View layouts and convert them into highly-adaptive Compose code.

Performance & efficiency

App performance means a smooth user interface, fast app start times, and efficient multitasking; Android 17 has impactful improvements in all of these areas.

App memory limits

Memory usage is one of the silent foundations of overall performance. When a foreground app or service grows unchecked, memory management spikes CPU and battery utilization and eventually leads to the termination of other well-behaved cached apps and background jobs, ultimately forcing slower cold starts and impaired multitasking. 

Starting in Android 17, the system will enforce strict app memory limits based on a device's total RAM, abruptly terminating offending processes. New things to help you navigate these tighter requirements:

  • R8 Optimizer: The R8 optimizer significantly reduces your app's bytecode memory footprint by shrinking classes, methods, and fields into shorter names, and stripping out unused code and resources. Use R8 in full mode along with the new R8 configuration analyzer to make sure your app is getting the most from R8.




The R8 Configuration Analyzer
  • LeakCanary in Android Studio Panda: The profiler now features native LeakCanary integration as a dedicated task, fully integrated with your IDE and source code.
  • ApplicationExitInfo: If your app is terminated by these limits, getDescription() from ApplicationExitInfo will return "MemoryLimiter:AnonSwap".
  • On-Device Anomaly Detection: Part of ProfilingManager, you can leverage trigger-based profiling using TRIGGER_TYPE_ANOMALY to automatically capture heap dumps when the memory limit is reached.
val profilingManager = applicationContext
   .getSystemService(ProfilingManager::class.java)

val triggers = ArrayList<ProfilingTrigger>().apply {
  add(ProfilingTrigger.Builder(
    ProfilingTrigger.TRIGGER_TYPE_ANOMALY).build())
}
profilingManager.addProfilingTriggers(triggers)

And, we're working to surface more in-field memory metrics to you within Google Play Console.

Generational garbage collection

Android 17 introduces more frequent, less resource-intensive young-generation collections to ART's Concurrent Mark-Compact garbage collector (GC). By separating short-lived objects from stable, long-lived ones, the system runs frequent, lightweight "young-generation" sweeps rather than expensive full-heap scans, drastically reducing CPU usage, power drain, and UI stutter. Our testing has shown significant improvements in GC interference with application threads and a reduction in the maximum memory resident set size (RSS). ART improvements are also available to over a billion devices running Android 12 (API level 31) and higher through Google Play System updates.

Lock-Free MessageQueue

For apps targeting SDK 37 or higher, the core android.os.MessageQueue now implements a lock-free architecture, significantly reducing missed frames, improving app startup time, and radically improving the performance of busy queues in multithreaded scenarios. Note: This can break apps that use reflection on private MessageQueue fields and methods.  The peekWhen and poll APIs have been added to TestLooperManager for instrumentation testing without relying on MessageQueue internals.

Static final fields now truly final

Starting from Android 17, apps targeting SDK 37 or higher won’t be able to modify “static final” fields, allowing the runtime to apply performance optimizations more aggressively. An attempt to do so via reflection (or deep reflection) will lead to an IllegalAccessException being thrown. Modifying them via JNI’s SetStatic<Type>Field methods family will immediately crash the application.

Custom notification view restrictions

To reduce memory usage we are further restricting the size of custom notification views. This update closes a loophole that allows apps to bypass existing limits using URIs. This behavior is gated by the target SDK version and takes effect for apps targeting API 37 and higher.

Privacy & Security

Maintaining user trust is at the heart of the Android ecosystem. Android 17 introduces robust features that protect sensitive data while simplifying user experiences.

Privacy-preserving choices

Historically, apps required broad, permanent permissions to access information like contacts, precise location and media files. Android 17 continues the shift toward privacy-preserving choices that grant temporary, session-based access only to the data the user explicitly selects:

  • System-Level Contact Picker: Utilizing ACTION_PICK_CONTACTS, apps can request temporary access only to specific fields (e.g., email or phone number) chosen by the user, eliminating the need for the broad READ_CONTACTS permission. It also fully supports work/personal profile separation.
  • Customizable Photo Picker aspect ratio: UsingPhotoPickerUiCustomizationParams, you can customize the system photo picker to show thumbnails in portrait mode. This is perfect for apps that always display photos and videos in portrait such as video based social media apps.
  • System-rendered Location Button: A new system-rendered location button that you can embed in your app grants precise location access for the current session only.
  • EyeDropper API: A new system-level API, ACTION_OPEN_EYE_DROPPER, allows your app to create a system-powered eyedropper enabling the user to select color from any pixel on the display. This provides a secure, privacy-preserving color-picking experience that eliminates the need for broad, sensitive screen capture or media projection permissions.
val eyeDropperLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
   if (result.resultCode == Activity.RESULT_OK) {
       val color = result.data?.getIntExtra(Intent.EXTRA_COLOR, Color.BLACK)
       // Use the picked color in your app
   }
}
fun launchColorPicker() {
   val intent = Intent(Intent.ACTION_OPEN_EYE_DROPPER)
   eyeDropperLauncher.launch(intent)
}










Picking a color from anywhere on the screen with the system EyeDropper

Local network access

Apps targeting Android 17 now either require the ACCESS_LOCAL_NETWORK runtime permission or the use of system-mediated, privacy-preserving device pickers for local network communication, such as talking to smart home devices or casting receivers. Because ACCESS_LOCAL_NETWORK falls under the existing NEARBY_DEVICES permission group, users who have already granted other NEARBY_DEVICES permissions will not be prompted again.

SMS OTP protection

Android 17 expands SMS one-time-password (OTP) protection by delaying access to SMS messages for three hours:

Post-Quantum Cryptography (PQC)

Android 17 is ready for the next generation of cryptographic security:

  • Keystore Integration: Supported devices can generate ML-DSA (Module-Lattice-Based Digital Signature Algorithm) keys in secure hardware to produce quantum-safe signatures, exposed via standard JCA APIs.
  • Hybrid APK Signing: Introducing the v3.2 APK Signature Scheme, which combines classical signatures with ML-DSA signatures to secure app delivery.

Safer native dynamic code loading 

If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection introduced in Android 14 for DEX and JAR files now extends to native libraries. All native files loaded using System.load must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError

Smarter password protection for physical inputs

With Android 17, we're making it safer to enter passwords, PINs, and other secrets when using a physical keyboard by no longer showing the last typed character by default.

Users can still easily customize these display settings to match their preferences (availability may vary by device manufacturer).

These enhanced privacy protections are automatically supported byAndroid's built-in SDK components and will be supported in Compose 1.12 for SecureTextFields.


















Smarter password protection for physical inputs

Media and camera features that empower creators and delight users

Android 17 introduces new creator features that give access to pro-quality cameras and media, all while improving the experience for consumers.

  • Eclipsa Video: HDR video standard built upon the SMPTE ST 2094-50 specification that introduces new metadata to help devices adapt content for their display headroom and ambient light conditions, as well as improve the simultaneous display of standard and HDR content.
  • RAW14 image format: New support for the RAW14 image format provides a way for your professional camera app to capture the highest level of detail and color depth from compatible camera sensors.
  • Vendor-defined camera extensions: Vendor-defined extensions enable hardware partners to define and implement custom camera extension modes, providing access to the best and latest camera features.
  • Extended HE-AAC software encoder: A new system-provided Extended HE-AAC software encoder, supports both low and high bitrates using unified speech and audio coding, providing significantly better audio quality for voice messages in low-bandwidth conditions, including support for loudness metadata.
  • Versatile Video Coding (H.266): Enables OEMs to add codec support by defining the video/vvc MIME type in MediaFormat, adding new VVC profiles in MediaCodecInfo, and integrating support into MediaExtractor.
  • Camera device type: New APIs that query the underlying device type to identify if a camera is built-in hardware, an external USB webcam, or a virtual camera.
  • Constant Quality for Video Recording: SetVideoEncodingQuality in MediaRecorder configures a constant quality (CQ) mode for video encoders to ensure uniform visual fidelity across the entire video.

Better support for hearing aids

  • Bluetooth LE Audio hearing aid support: Android now includes a specific device category for Bluetooth Low Energy (BLE) Audio hearing aids with the new AudioDeviceInfo.TYPE_BLE_HEARING_AID constant, so your app can distinguish hearing aids from regular headsets to provide a tailored experience for users with assistive listening devices.
  • Granular audio routing for hearing aids: Android 17 allows users to independently manage where specific system sounds are played. They can choose to route notifications, ringtones, and alarms to connected hearing aids or the device's built-in speaker, helping to avoid unwanted in-ear interruptions while maintaining a Bluetooth connection for hearing aid management apps.

CameraX and Media3

CameraX and Media3 have been updated for Android 17. They are there to do the heavy lifting, smoothing the rough edges of media development and simplifying building reliable camera capture, smooth media playback, and creative and complex editing experiences.

We've released an agent skill that can migrate legacy Android camera implementations (Camera1 or raw Camera2 APIs) to CameraX.

Note: You'll need to update your CameraX version to either 1.5.2 or 1.6.0+ to avoid a crash related to an added dynamic range mode on Android 17 devices.

Get your apps, libraries, tools, and game engines ready!

If you develop an Android SDK, library, tool, or game engine, it's critical to prepare any necessary updates now to prevent your downstream app and game developers from being blocked by compatibility issues and allow them to target the latest SDK features. Please let your downstream developers know if updates are needed to fully support Android 17.

Testing involves installing your production app or a test app making use of your library or engine using Google Play or other means onto a device or emulator running Android 17 Beta 4. Work through all your app's flows and look for functional or UI issues. Each release of Android contains platform changes that improve privacy, security, and overall user experience; review the app impacting behavior changes for apps running on and targeting Android 17 to focus your testing, including the following:

Get started with Android 17

Your Pixel device should get Android 17 shortly if you haven't already been on the Android Beta. If you don’t have a Pixel device, you can use the 64-bit system images with the Android Emulator in Android Studio. If you are currently on Android 17 Beta 4.1 and have not yet taken an Android 17 QPR1 beta, you can opt out of the program and you will then be offered the release version of Android 17 over the air.

Getting the Android 17 beta on partner devices

Android 17 is available in beta on handset, tablet, and foldable form factors from partners including Honor, iQOO, Lenovo, OnePlus, OPPO, Realme, Sharp, vivo, and Xiaomi.



For the best development experience with Android 17, we recommend that you use the latest Canary build of Android Studio Quail. Once you’re set up, here are some of the things you should do:

Test your current app for compatibility, learn whether your app is affected by changes in Android 17, and install your app onto a device or Android Emulator running Android 17 and extensively test it.

Thank you again to everyone who participated in our Android developer preview and beta program. We're looking forward to seeing how your apps take advantage of the updates in Android 17, and have plans to bring you updates in a fast-paced release cadence going forward.

For complete information on Android 17 please visit the Android 17 developer site.



]]> <![CDATA[Firefox Nightly: Backup for a Rainy Day – These Weeks in Firefox: Issue 202]]> https://tsecurity.de/de/3693295/tools/firefox-nightly-backup-for-a-rainy-day-these-weeks-in-firefox-issue-202/ https://tsecurity.de/de/3693295/tools/firefox-nightly-backup-for-a-rainy-day-these-weeks-in-firefox-issue-202/ Sat, 25 Jul 2026 08:37:35 +0200 đŸ’Ÿ Tools tsecurity.de Highlights
  • The profile backup mechanism has been enabled by default for all desktop platforms in Nightly, as well as Beta! The current plan is to have this ride out to Firefox 151 for Windows, macOS and Linux on May 18th!
    • This feature, when enabled, will create a copy of your profile data in the background and store it in a single file on your file system that you can restore from.
    • You will be able to manage this feature in Settings under Sync (for now)
      • Firefox settings page showing the Backup feature in dark mode. Backup is enabled, with details of the most recent backup and a “Backup now” button. The page displays the backup file name and a backup location folder path, along with “Choose
” and “Show in folder” buttons. A “Sensitive data” section includes an option to back up passwords and payment methods with encryption, and a disabled “Change password” button.
    • You can read more about the feature here
  • As followups to the recent addition to the WebExtension tabs API to support the new SplitView tabs feature, tabs.group() and tabs.ungroup() have been fixed to work correctly with split view tabs, and fixed split views being prepended instead of appended to tab groups when adopted into a new window – Bug 2029099 / Bug 2029534
  • Adaptive autofill has been enabled on Nightly.
    • Previously, autofill only completed domains (e.g. typing red autofilled reddit.com). Now it can also complete full URLs for pages you visit often (e.g. red → reddit.com/r/firefox), learning from what you actually click in the address bar. If a suggestion isn’t helpful, you can now dismiss it so autofill learns what not to show you too.
  • Markus Stange [:mstange] implemented dynamic toolbar on top in RDM (#1978145), but also implemented some static skeleton UI so it’s closer to what we actually have in Firefox for Android
    • dynamic toolbar is behind a pref: devtools.responsive.dynamicToolbar.enabled
    • it can be put on top by setting devtools.responsive.dynamicToolbar.onTop, otherwise it’s at the bottom
    • Firefox Responsive Design Mode on Desktop displaying the Mozilla homepage in a mobile viewport. The toolbar at the top shows a simulated Android device (including the dynamic toolbar) with a viewport size of 376 × 464 pixels and a device pixel ratio of 3. The page content is shown in French, featuring the Mozilla logo, a “Menu” link, a “Pause animation” button, and the headline “Bienvenue chez Mozilla” with accompanying text about trusted technology and digital rights.

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

  • Amin Amir
  • aoia7rz7l
  • Chukwuka Rosemary
  • DrSeed
  • FrĂ©dĂ©ric Wang NĂ©lar
  • japandi
  • John Iweh
  • jonathancabera
  • Josh Aas
  • Keji Bakare
  • kofoworola shonuyi
  • konyhĂ©a
  • liz
  • Mathew Hodson
  • Okhuomon Ajayi
  • Oluwatobi
  • ROSHAAN
  • Sam Johnson

New contributors (🌟 = first patch)

 

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons
  • In preparation for the Project Nova restyling of the about:addons page, we have refactored about:addons into separate per-component ES modules, splitting the monolithic aboutaddons.js and aboutaddons.html into 16 dedicated component files under components/ (with no behavior or UI changes) – Bug 2032014
    • NOTE: if you have working on patches with changes to about:addons internals it is very likely you’ll need to rebase and solve merge conflicts hit on top of this refactoring, the internals are still largely the same as before but don’t hesitate to reach out to the Addons team if you have doubts / questions or need help to figure out how to adapt your patch of top of these changes
WebExtensions Framework
  • Fixed exportFunction to preserve the constructibility of the wrapped function instead of unconditionally making all exported functions implicitly as constructors – Bug 2033173
    • Thanks to Gregory Pappas for contributing this improvement to the Content Scripts’ Xray Wrappers helpers!
  • Fixed a Firefox 151 regression where extension content scripts accessing location.ancestorOrigins caused subsequent page script reads of the same property to fail with “Permission denied”, breaking sites like Gmail – Bug 2034329
    • Thanks to Simon Farre for promptly investigating and fixing this recent regression!
WebExtension APIs
  • Updated sessions.getRecentlyClosed() to remove the hardcoded cap when maxResults is omitted – Bug 1392125
    • Shoutout to Amine Zroual for contributing this enhancement to the sessions WebExtensions API!

DevTools

Fluent

  • We’re now at over 72% of our strings being Fluent! Got a component still using .properties? Convert when you can!
  • Stacked area chart titled “Are We Fluent Yet?” showing the number and type of localization strings available in Firefox from 2018 to 2026. The chart tracks Fluent strings (green), Properties strings (blue), DTD strings (pink), and a small number of INI strings. Over time, Fluent strings steadily increase while DTD and Properties strings decline. A tooltip at April 26, 2026 shows 10,372 Fluent strings, 3,997 Properties strings, and no remaining DTD or INC strings, illustrating Firefox’s ongoing migration to the Fluent localization system.

Migration Improvements

New Tab Page

Search and Urlbar

  • Marco has fixed a couple of issues with the places databases to try and improve stability. This should help with avoiding users losing bookmarks or favicons.
  • Work continues on the new separate search bar to improve the functionality, e.g. allowing middle click to perform a search in a new tab, avoiding performing a search when adding a search engine.
  • Work also continues on the new Nova layouts.

Smart Window

  • uplifted 10 bugs to 150.0.1 dot release addressing initial user feedback from diary study and Connect
    • jump to bottom of conversation 2028692
    • stop streaming button 2029204
    • back/forward navigation from assistant 2029229
    • dark mode for various chips 2024499
  • search engine switching from smart bar 2021973
  • Nova styling within smart window 2026794

Storybook/Reusable Components/Acorn Design System

UX Fundamentals

  • The error pages shown when a server sends back an invalid response header or an unsupported content encoding now display accurate, context-specific messages. The invalid response header page also gained a helpful list of next steps. – 2027209
  • In progress: The error page illustrations are being replaced with new artwork, and the system now supports per-illustration size configuration, giving each image the ability to define its own appropriate dimensions. – 2031837

Settings Redesign

]]> <![CDATA[Firefox Nightly: Giving You More Control – These Weeks in Firefox: Issue 204]]> https://tsecurity.de/de/3693293/tools/firefox-nightly-giving-you-more-control-these-weeks-in-firefox-issue-204/ https://tsecurity.de/de/3693293/tools/firefox-nightly-giving-you-more-control-these-weeks-in-firefox-issue-204/ Sat, 25 Jul 2026 08:37:31 +0200 đŸ’Ÿ Tools tsecurity.de Highlights

Firefox context menu video controls like Pause, Unmute, Speed and Loop.

Tooltip in Firefox DevTools for mismatched syntax with attr()

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

  • Sam Johnson
  • Sebastian Zartner [:sebo]

New contributors (🌟 = first patch)

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons
  • As part of the work for the Project Nova about:addons page restyling, the about:addons sidebar has been migrated to the moz-page-nav and moz-page-nav-button reusable components, improving accessibility and visual consistency with the Firefox Desktop about:settings page – Bug 1881767
WebExtensions Framework
  • Implemented WebExtensions negative permissions infrastructure, providing the foundations for enterprise policy “blocked host permissions” features – Bug 1745823
  • Restricted host permission changes for MV3 extensions force-installed via enterprise policy (matching similar behaviors provided by Chrome enterprise policy behaviors) – Bug 1904054
    • Thanks to Mike Kaply for the implementation of this enterprise policy enforcement feature.
WebExtension APIs
  • Fixed handling of <all_urls> as an API permission in Manifest V3, ensuring the permission is correctly initialized on extension install – Bug 1758306

DevTools

WebDriver

Lint, Docs and Workflow

New Tab Page

Picture-in-Picture

Performance Tools (aka Firefox Profiler)

  • Firefox Profiler now has a CLI! We also added a profiler-analysis skill to the Firefox codebase. Once you capture a performance profile, you can ask Claude or an AI to analyze it by providing a link or local path. You can use it to analyze a performance regression or debug an issue if you have a profile at hand.

Search and Urlbar

Nova UI refresh
Suggest
  • Drew landed several Suggest improvements: realtime suggestions colors, sports suggestions received World Cup tweaks, and online Suggest via OHTTP was enabled for eligible users in Firefox 153.
  • 2040561, 2039753, 2035614, 2038843
Adaptive autofill
  • James fixed soft-block counting to track autofill dismisses, rather than consecutive backspaces on the same autofill, and added telemetry to measure URLs reintegration after blocking.
  • 2040819, 2037177
Quick actions
  • Dharma created a new Firefox Labs quick action, fixed the Update action button, and re-enabled ScotchBonnet in some tests that were not updated yet.
  • Caleb added Calculator support for certain unicode operators.
  • 2023169, 1928635, 1923383, 2033861
Multi Context Address Bar
  • Moritz continued refactoring the urlbar code: converted some of the js modules to not be system modules, fixed dynamic results templates, incorrect reuse of result rows, and keyboard shortcuts on the unified search button panel.
  • 2039297, 2036095, 2039844, 2037933, 2030050
Other
Search
  • Mark removed old WebExtension-based search engines from the source tree, removed loading of search add-ons from resource://search-extensions/.
  • Caleb fixed multiple documentation issues and added a test covering searches from a private window.
  • 1904613, 2035878, 2037942, 2033545, 2005724
Places
  • Marco removed some unnecessary database transactions, fixed the bookmarks panel folder dropdown on Windows, and resolved several intermittent test failures.
  • Thanks to Sam Johnson who fixed the bookmark edit panel showing “mobile” instead of “Mobile Bookmarks”.
  • 2039534, 1505800, 2008829, 2029541, 2035084
]]> <![CDATA[Mozilla Security Blog: Improving Transparency and Assurance in the Web PKI: Mozilla Root Store Policy v3.1]]> https://tsecurity.de/de/3693288/tools/mozilla-security-blog-improving-transparency-and-assurance-in-the-web-pki-mozilla-root-store-policy-v31/ https://tsecurity.de/de/3693288/tools/mozilla-security-blog-improving-transparency-and-assurance-in-the-web-pki-mozilla-root-store-policy-v31/ Sat, 25 Jul 2026 08:37:23 +0200 đŸ’Ÿ Tools tsecurity.de Mozilla remains committed to maintaining a secure, trustworthy, and transparent Web PKI. Today we are announcing the publication of Mozilla Root Store Policy (MRSP) version 3.1, effective July 1, 2026.

While previous policy updates focused heavily on certificate revocation, automation, and operational resilience, MRSP v3.1 focuses on a different challenge: ensuring that Certification Authority (CA) operations are sufficiently transparent, understandable, and auditable.

Trust in the Web PKI depends not only on technical requirements, but also on the ability of Mozilla, auditors, and the broader community to understand how CA systems are designed, operated, and assessed. MRSP v3.1 introduces new requirements intended to improve the quality of CA documentation and strengthen independent assurance of the design and effectiveness of controls that protect CA systems.

Improving CP/CPS Documentation

Certification Practice Statements (CPSes) and combined Certificate Policy / Certification Practice Statement documents (CP/CPSes) are among the most important public documents published by a CA. They describe how a CA conducts its operations and meets industry requirements.

Over the years, we have seen significant variation in the quality, structure, and level of detail provided in CP/CPS documentation. Some documents provide extensive implementation detail, while others rely heavily on incorporation by reference or provide only high-level descriptions of CA practices.

The revised policy will continue to require conformance with RFC 3647, as modified by applicable CA/Browser Forum requirements. Improvements to section 3.3 in the MRSP will establish clearer expectations regarding the content and quality of CP/CPS documentation. The new requirements emphasize that documentation must be explicit, bounded, auditable, and sufficiently detailed to describe the CA operator’s certificate issuance and management activities, while also establishing requirements for version control, accessibility, and ongoing maintenance. The objective is to ensure that a technically competent reviewer will be better-able to determine what commitments the CA has made, how those commitments are implemented, and whether the documented practices support technical, operational, and performance oversight.

Mozilla believes that these new CP/CPS requirements will improve transparency, reduce misunderstandings, support more effective audits, and help reduce the risk of certificate misissuance by ensuring that operational practices are documented accurately, consistently, and in sufficient detail to permit meaningful review.

Introducing Detailed Controls Reports

A second major enhancement in MRSP v3.1 is the introduction of Detailed Controls Reports (DCRs). Traditional WebTrust and ETSI audit reports provide valuable independent assurance regarding compliance with established criteria. However, they generally provide only limited visibility into the specific controls, testing procedures, and operational environments that support those conclusions.

Beginning with audit periods starting on or after July 1, 2027, CA operators with root certificates enabled for TLS website authentication will be required to obtain a DCR. The purpose of the DCR is to provide CA management, auditors, and Mozilla with greater visibility into the controls, testing, and operating effectiveness of CA systems that support compliance with the CA/Browser Forum’s TLS Baseline Requirements and Network and Certificate System Security Requirements. Mozilla generally expects to review DCRs only on an as-needed basis, such as during compliance reviews, incident investigations, root inclusion evaluations, or other oversight activities.

A DCR must include:

  • The scope and boundaries of the audited CA systems;
  • Applicable audit criteria;
  • Controls implemented by the CA;
  • The auditor’s testing procedures;
  • Results of control testing; and
  • Information regarding control exceptions or deficiencies.

Mozilla expects that DCRs will complement existing audit reports and strengthen transparency and assurance by providing additional detail regarding system boundaries, control implementation, testing procedures, and control effectiveness that is not typically available in traditional audit reports. Effective compliance requires more than documented policies and successful audits; it also requires management understanding, oversight, and engagement. By providing greater visibility into CA systems, controls, testing activities, and operational risks, DCRs can help reinforce a strong tone at the top regarding compliance expectations, support informed decision-making and resource allocation, enable earlier identification of weaknesses, and promote a culture of continuous improvement. The intent is not to replace existing audit reports, but to provide additional information that supports effective governance, oversight, and informed trust decisions.

Additional Clarifications and Improvements

MRSP v3.1 also includes several targeted clarifications and refinements:

  • aligns Mozilla’s mass revocation planning requirements with the corresponding CA/Browser Forum Baseline Requirements, helping ensure consistency across compliance frameworks;
  • clarifies audit expectations for root inclusion requests, including requirements relating to audit continuity and root key generation ceremonies;
  • requires root CA key pairs submitted for inclusion to have been generated within the previous five years, helping ensure that newly included roots are based on contemporary cryptographic practices and controls; and
  • clarifies expectations when ownership or operational control of a CA changes, helping ensure that Mozilla receives timely notice and can evaluate the impact of acquisitions or organizational changes on continued compliance.

Looking Forward

Mozilla recognizes that these changes will require preparation by CA operators, auditors, and other ecosystem participants. To support implementation, Mozilla is publishing accompanying wiki guidance regarding both CP/CPS Documentation and Detailed Controls Reports.

As with previous policy updates, these changes were informed by discussions with CA operators, auditors, and members of the Web PKI community. We appreciate the feedback received during the review process and look forward to continued collaboration as the ecosystem evolves.

Mozilla has a longstanding focus on building confidence in the Web PKI through transparency, accountability, and continuous improvement. By requiring higher-quality CP/CPS documentation and strengthening independent assurance, MRSP v3.1 advances Mozilla’s commitment to protecting its users and maintaining their trust in the systems that help secure the web.

The post Improving Transparency and Assurance in the Web PKI: Mozilla Root Store Policy v3.1 appeared first on Mozilla Security Blog.

]]> <![CDATA[The Rust Programming Language Blog: crates.io: development update]]> https://tsecurity.de/de/3693285/tools/the-rust-programming-language-blog-cratesio-development-update/ https://tsecurity.de/de/3693285/tools/the-rust-programming-language-blog-cratesio-development-update/ Sat, 25 Jul 2026 08:37:18 +0200 đŸ’Ÿ Tools tsecurity.de Another six months have passed since our last development update, and the crates.io team has been busy. Here's a summary of the most notable changes and improvements made to crates.io since then.

Source Code Viewer

Crate pages now have a "Code" tab that lets you browse the contents of published crate versions directly on crates.io. This shows you the exact files that cargo downloads when you add a crate as a dependency, which might differ from the linked repository. This makes it much easier to audit your dependencies, including files that never appear in the repository, like the normalized Cargo.toml files that cargo generates.

Source code viewer showing the "Code" tab of the serde crate

The viewer comes with a file tree sidebar with search functionality, syntax highlighting, and GitHub-style line selection, where clicking or dragging line numbers produces shareable #L10-L20 URLs.

Under the hood, the server now builds a zip file for every published version. Since the .crate files that cargo consumes are gzipped tarballs without random access support, a background job re-packs each of them into a seekable zip archive plus a JSON manifest describing the contained files. Both are served from our static CDN. The frontend then fetches only the manifest and loads each file on demand with an HTTP range request. Because of this architecture, browsing crate sources essentially adds no load on the crates.io API servers. Existing crate versions have been backfilled, so this works for old releases too.

The rendering library behind the code viewer is a diff renderer at heart, and that's no accident: a version-to-version diff viewer built on the same infrastructure is currently in the works. This will allow you to review exactly what changed between two published versions, right on crates.io. Stay tuned!

Untangling crates.io Accounts from GitHub

At the end of May, the crates.io team accepted RFC #3946. Crates.io accounts always have been tightly coupled to GitHub: signing in means "Log in with GitHub", and your crates.io identity is your GitHub username. The RFC changes that. It introduces usernames that are native to crates.io and independent of linked GitHub accounts, as a prerequisite for eventually supporting login via other identity providers.

The implementation of crates.io usernames has started, but there is still a lot left to do, most visibly the ability to change your crates.io username. After that is complete, there will be future RFCs and implementation for signing in with identity providers other than GitHub. Since all of this touches authentication and account security, we are deliberately taking it slow and rolling these changes out in small, carefully reviewed steps.

Advisories and Suggestions

In our January update we introduced the "Security" tab, which shows security advisories from the RustSec database. We have since taken this integration one step further: crates that RustSec has flagged as unmaintained now show a warning banner directly on their crate pages, linking to the corresponding advisory for details and possible alternatives. Thanks to Dirkjan Ochtman for implementing this feature!

Unmaintained warning banner on the ansi_term crate page

Related to this, some popular crates have been largely absorbed into the Rust standard library over the years, like lazy_static, which has been superseded by std::sync::LazyLock since Rust 1.80. Crate pages of such crates now show a friendly "You might not need this dependency" banner describing the standard library replacement, and superseded crates in dependency lists get a small light bulb icon with a similar hint.

"You might not need this dependency" banner on the lazy_static crate page

The dataset behind this feature lives in the new rust-lang/std-replacement-data repository, together with a documented inclusion policy: standard library replacements only, every entry must cite the stable std, core, or alloc API and Rust version, and crate maintainers get a notice-and-comment window before an entry is added. New entries can be proposed upstream and can benefit other tools too.

Ferris

The most delightful change of this cycle: the Ferris on our error pages now follows your mouse cursor with its eyes:

Ferris' eyes following the mouse cursor on the error page

Getting a 404 error on crates.io is now slightly less sad.

Svelte Frontend Migration Completed

In our January update, we announced that we were experimenting with porting the crates.io frontend from Ember.js to Svelte. This experiment has concluded successfully: the new frontend reached feature parity, went through a public testing phase in April, became the default at the beginning of May, and the Ember.js app has been removed from our repository.

We designed this change to be invisible for our users, since the new frontend is a 1:1 port of the previous design and functionality. For the team and our contributors, however, it is a big deal: the frontend is now built on a more modern framework, which should make it easier for new contributors to get started. It also allows us to iterate faster, as the source code viewer above demonstrates.

We want to thank the Ember.js team for a framework that served crates.io well for many years, and the Svelte team for making the transition so enjoyable.

Miscellaneous

These were some of the more visible changes to crates.io over the past six months, but a lot has happened "under the hood" as well:

  • Search performance: Relevance-sorted search queries previously ranked every crate matching the query, which could take 1-2 seconds for short or common search terms. Ranking is now bounded to the 1,000 matching crates with the highest recent download counts.

  • Reverse dependencies performance: The reverse dependencies endpoint no longer recomputes the full dependent set on every request. It is now served from a precomputed table kept in sync by database triggers, turning an expensive join into a bounded index scan and greatly reducing the chance of getting a timeout error.

  • New ARCHITECTURE.md: If you've ever wondered how crates.io actually works, our ARCHITECTURE.md document got a complete rewrite. It is now organized around the high-level systems that make up crates.io and how they fit together, and includes walkthroughs of what happens when you run cargo publish, why a typical crate download never touches our API servers, and how download counts are derived from CDN access logs.

  • Definition lists: READMEs now render Markdown definition lists, a widely used Markdown extension. Our markdown renderer comrak already supported them, the extension just wasn't enabled yet. Thanks to @mistaste for this contribution!

  • CDN cache tags: Files uploaded to our static CDN now carry cache-tag metadata, allowing us to invalidate all cached files of a crate or a specific release in a single operation, instead of issuing one invalidation per file URL.

  • Caching improvements: We removed a global Vary: Cookie response header that was preventing our CDNs from caching public API responses and frontend assets effectively. Per-user responses now use Cache-Control: no-store instead, resulting in better cache hit rates at the CDN edge.

  • Accessibility: We have made crates.io friendlier to screen readers: decorative icons are now hidden from the accessibility tree, heading hierarchies have been fixed, and lists are marked up as proper lists. ARIA snapshot tests now ensure that regressions can't slip in unnoticed. We plan to continue to improve crates.io accessibility over the coming months.

  • Git index performance: The background worker's local clone of the git index is now a bare and shallow repository, eliminating roughly 250,000 checked-out files and the full commit history from its disk, improving its performance as we see increased rates of crate publication. The periodic index squashing now goes through the GitHub API instead of generating large git packs locally, which had previously caused out-of-memory failures on the production worker.

Feedback

We hope you enjoyed this update on the development of crates.io. If you have any feedback or questions, please let us know on Zulip or GitHub. We are always happy to hear from you and are looking forward to your feedback!

]]> <![CDATA[3 cybersecurity issues that should keep every CEO awake at night]]> https://tsecurity.de/de/3693088/it-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/ https://tsecurity.de/de/3693088/it-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/ Sat, 25 Jul 2026 06:16:50 +0200 📰 IT Nachrichten tsecurity.de

For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.

Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organizations continue to suffer major cyber incidents with alarming regularity. Every week seems to bring news of another ransomware attack, supply chain compromise or data breach affecting organizations that many would have assumed were well protected.

The obvious conclusion is that we are asking the wrong questions.

Too many executive teams remain preoccupied with the latest threat actor, the newest security product the CISO wants to buy or the latest vulnerability making headlines. Those issues matter, but they are not what should be keeping CEOs awake at night.

In my view, there are three far more fundamental issues that deserve the attention of every chief executive.

1. Corporate complexity, and the widening gap between business leadership and cybersecurity reality

Perhaps the biggest cybersecurity risk facing large organizations today is not technical at all.

It is the growing disconnect between executive perception and operational reality.

Many boards genuinely believe their organizations are reasonably well protected. They receive regular dashboards showing improving maturity scores, increasing compliance levels, falling vulnerability counts and reassuring traffic-light reports.

Unfortunately, cyber attackers do not read dashboards.

Behind those executive reports often lies an increasingly complex technology landscape, thousands of unmanaged digital assets, ageing infrastructure, rampant shadow IT, fragmented ownership, inconsistent governance and security teams struggling to keep pace with relentless business change.

The problem is rarely a lack of effort.

It is that corporate complexity has reached a level where traditional governance mechanisms are no longer capable of providing an accurate picture of organizational resilience.

Executives believe they understand the level of cyber risk they face because they receive regular reports. Those reports often measure activity rather than resilience.

Governance committees end up debating around another percentage point of phishing awareness or vulnerability remediation, while fundamental issues remain unaddressed in the background.

2. Organizational inertia, and the need for executive structure to evolve faster

Cyber criminals continue to evolve rapidly. Large organizations generally do not.

This is the second issue that should concern every CEO.

Throughout my career, I have observed organizations repeatedly responding to new cyber threats by adding another technology platform, another monitoring capability, another compliance framework or another governance committee.

Very rarely do they stop to redesign how cybersecurity operates.

The result is what I described several years ago as the “Cybersecurity Spiral of Failure”.

  • As complexity and regulation increase, organizations invest in more security products.
  • More products create more complexity.
  • More products and greater complexity generate more alerts.
  • More alerts require more analysts.
  • More analysts produce more reports.
  • More reports continue to build up executive confidence.
  • Meanwhile, the underlying structural weaknesses remain largely unchanged, technical debt piles up and costs escalate.

And when the inevitable breach eventually happens, reality reveals itself, but distrust also sets in between senior executives and security teams.

This is not a funding problem. Nor is it a skills problem. It is fundamentally an operating model problem.

Many organizations continue trying to solve twenty-first century challenges using governance, accountability, organizational and reporting structures designed twenty-five years ago.

The cybersecurity function itself has evolved dramatically. Many executive structures have not.

This organizational inertia extends beyond technology: It affects budgeting cycles, investment priorities, procurement processes, accountability models and decision-making speed.

Cyber attackers innovate every day. Organizational change often takes years.

That imbalance should worry every CEO.

3. Accelerating technological disruption, and how it challenges organizations in areas where they are intrinsically weak

The third issue is potentially the most significant over the coming decade.

  • Artificial intelligence, autonomous agents and machine identities
  • Software supply chain complexity.
  • Quantum computing, and post-quantum cryptography

Each of these developments represents far more than another technical trend.

Together, they fundamentally change the dynamics of cybersecurity.

Artificial intelligence is transforming countless business processes. At the same time, it is also increasing both the speed and sophistication of cyber-attacks while simultaneously transforming defensive capabilities.

Organizations have become increasingly dependent on software ecosystems that extend far beyond their own direct control. Engaging with the supply chain in ways that lead to a genuine appreciation of the risks involved has become a key challenge for most cybersecurity practices.

Quantum computing may eventually invalidate much of today’s cryptographic algorithms, forcing organizations into one of the largest technology efforts since Y2K — but without the benefit of a fixed deadline and faced by a problem that is considerably more complex and hyperconnected IT estates that have little to do with those of the late 90s.

None of these challenges can be solved overnight: They require clear governance, sustained investment over a few years and cross-functional organizational coordination.

Most large organizations are weak on those three fronts: This is precisely why CEOs should be focusing on them now.

Waiting until some of those risks become obvious will almost certainly be too late.

Businesses naturally prioritise immediate commercial pressures. Cybersecurity often involves preparing for risks whose timing remains uncertain.

But one of the greatest leadership failures I keep seeing remains the inability of organizations to act decisively on known unknowns.

That tension explains why many organizations delay action until external events force them to respond. Unfortunately, cybersecurity rarely rewards late action.

Leadership will determine who succeeds

Cybersecurity discussions still frequently focus on technology. I believe they should focus far more on leadership.

Technology will continue evolving. Threat actors will continue adapting. Regulations will continue expanding. Those developments are inevitable.

What remains within the control of every CEO is how their organization responds.

Does cybersecurity remain an IT issue? Or is it recognised as an integral part of business resilience?

How is cybersecurity accountability assigned at executive level? Or does it still rest largely with a CISO hidden in the organization?

Does the board spend sufficient time discussing resilience? Or does cybersecurity appear only when approving budgets or reviewing incidents?

These questions will increasingly determine organizational success.

The companies that navigate the next decade successfully will not necessarily be those spending the most on cybersecurity. Nor will they be those deploying the latest security technologies first.

They will be the organizations whose leadership recognises that cybersecurity has become a permanent business capability — embedded into governance, strategy, operational decision-making and organizational culture.

That transformation cannot be delegated. It begins with the CEO.

And perhaps that is the single biggest issue that should keep every chief executive awake at night: Not when the next cyber-attack will happen, but whether their organization is evolving quickly enough on those matters to meet a threat landscape that is changing much faster than the business itself.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[What is a business analyst? A key role for business-IT efficiency]]> https://tsecurity.de/de/3693087/it-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/ https://tsecurity.de/de/3693087/it-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/ Sat, 25 Jul 2026 06:16:45 +0200 📰 IT Nachrichten tsecurity.de

What is a business analyst?

Business analysts (BAs) are responsible for bridging the gap between IT and the business using data analytics to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.

BAs engage with business leaders and users to understand how data-driven changes to process, products, services, software, and hardware can improve efficiencies and add value. They must articulate those ideas but also balance them against what’s technologically feasible and financially and functionally reasonable. Depending on the role, a business analyst might work with data sets to improve products, hardware, tools, software, services, or process.

The International Institute of Business Analysis (IIBA), a nonprofit professional association, considers the business analyst an agent of change, and says that business analysis is a disciplined approach to introduce and manage change to organizations, whether they’re for-profit businesses, governments, or nonprofits.

Impact of AI on business analyst role

As AI becomes commonplace in the tech industry, business analysts are embracing it as a tool to automate repetitive work in the role. AI tools can be used for workflow and diagramming, process mapping, data analysis, and to automate meeting minutes and transcribe meetings where requirements are established, all designed to speed up the process of analyzing data, creating visuals, and transcribing and writing user stories and acceptance criteria.

AI tools can also help identify patterns, insights, and unique data points that might go unnoticed by humans, and allow a faster time to generate insights for organizations.

Of course, as with all AI tools, they still require humans to oversee prompts, scripting, and evaluate AI outputs to ensure they’re accurate and valid. While they can’t replace the work of BAs, AI can help them spend more time on thoughtful analysis and decision making, rather than mundane tasks such as gathering and summarizing data, and querying.

Business analyst job description

BAs are responsible for creating new models that support business decisions by working closely with finance and IT teams to establish initiatives and strategies aimed at improving revenue and optimizing costs. They need a strong understanding of regulatory and reporting requirements, and have plenty of experience in forecasting, budgeting, and financial analysis combined with knowing KPIs, according to Robert Half Technology.

According to Robert Half, a BA’s job description typically includes budgeting and forecasting, planning and monitoring, variance analysis, pricing, reporting, and creating a detailed business analysis in an effort to outline problems, opportunities, and solutions for a business. It also says BAs should be able to define business requirements and report them back to stakeholders.

Since BAs are tasked with prioritizing technical and functional requirements, identifying what clients want, and determining what’s feasible to deliver, the role requires a deep understanding of systems, how they function, who’ll need to be involved, and the necessary steps to get everyone on board.  

The role is constantly evolving, especially as companies rely more on data to advise business operations. Every company has different issues that a business analyst can address, whether it’s dealing with outdated legacy systems, changing technologies, broken processes, poor client or customer satisfaction, or large, siloed organizations.

Business analyst skills

The BA position requires both hard and soft skills, as they need to know how to pull, analyze, and report data trends, share that information with others, and apply it to business goals and needs.

Not all BAs need a background in IT if they have a general understanding of how systems, products, and tools work. Alternatively, some have strong IT backgrounds and less experience in business, but are interested in shifting away from IT into this hybrid role, which often acts as a communicator between the business and IT sides of the organization. So having extensive experience in either area can be beneficial for BAs.

According to the IIBA, some of the most important skills and experience for a business analyst are:

  • Oral and written communication skills
  • Interpersonal, organizational, facilitation, and consultative skills
  • Analytical thinking and problem solving
  • Being detail-oriented and able to deliver a high level of accuracy
  • Knowledge of business structure
  • Stakeholder and cost-benefit analysis
  • Processes modeling
  • Understanding networks, databases, and other technologies

For a more in-depth look at what it takes to succeed as a business analyst, click here.

Business analyst salary

The average annual salary for an IT business analyst is $80,692, according to data from PayScale. The highest paid BAs are in New York, where the average salary is 14% higher than the national average. Dallas, Texas, is second, with reported salaries 6.4% higher than the national average, closely followed by Washington, D.C., where salaries are 6.3% higher than the national average.

Some skills are in higher demand than others, with the potential to boost salary. According to Payscale, these are associated with higher BA salaries. These skills, and the amount they can boost your salary, include:

SkillsSalary Boost
ScrumMaster44%
Microsoft Azure30%
Supply Chain27%
Oracle eBusiness Suite25%
Master Data Management (SAP MDM)24%
SAP Sales and Distribution (SAP SD)24%
Product Support18%
Microsoft Dynamics GP18%
SAP Quality Management (SAP QM)18%
Workday Software15%

For tips on boosting your salary, click here.

Business analyst certifications

Although business analysis is a relatively new discipline in IT, a handful of organizations already offer certifications to help boost your résumé and prove your merit as an analyst. Organizations such as the IIBA, IQBBA, IREB, and PMI each offer their own tailored certifications for business analysis. These include:

  • IIBA Entry Certificate in Business Analysis (ECBA)
  • IIBA Certification of Competency in Business Analysis (CCBA)
  • IIBA Certified Business Analysis Professional (CBAP)
  • IIBA Agile Analysis Certification (AAC)
  • IQBBA Certified Foundation Level Business Analyst (CFLBA)
  • IREB Certified Professional for Requirements Engineering (CPRE)
  • PMI Professional in Business Analysis (PBA)
  • Certified Analytics Professional (CAP)

For more information about how to earn one of these certifications — and how much they cost — click here.

Business analytics tools and software

BAs typically rely on software such as Microsoft’s Excel, PowerPoint, and Access, as well as SQL, Google Analytics, and Tableau. These tools help BAs collect and sort data, create graphs, write documents, and design visualizations to explain findings. You won’t necessarily need programming or database skills for a BA position, but if you already have these skills, they won’t hurt. The type of software and tools you’ll need to use, however, will depend on your job title and what the organization requires.

]]> <![CDATA[Anthropic's Opus 5 is about token efficiency, not a capability leap]]> https://tsecurity.de/de/3692561/ai-nachrichten/anthropics-opus-5-is-about-token-efficiency-not-a-capability-leap/ https://tsecurity.de/de/3692561/ai-nachrichten/anthropics-opus-5-is-about-token-efficiency-not-a-capability-leap/ Fri, 24 Jul 2026 23:18:42 +0200 🔧 AI Nachrichten tsecurity.de <![CDATA[Anthropic's New Opus 5 Model Rivals Fable 5 For Half the Price]]> https://tsecurity.de/de/3692357/it-security-nachrichten/anthropics-new-opus-5-model-rivals-fable-5-for-half-the-price/ https://tsecurity.de/de/3692357/it-security-nachrichten/anthropics-new-opus-5-model-rivals-fable-5-for-half-the-price/ Fri, 24 Jul 2026 21:08:38 +0200 📰 IT Security Nachrichten tsecurity.de

Read more of this story at Slashdot.

]]> <![CDATA[Linux Kernel 7.1.4 Released with Bug Fixes, Security Updates, and Hardware Improvements]]> https://tsecurity.de/de/3692292/unix-server/linux-kernel-714-released-with-bug-fixes-security-updates-and-hardware-improvements/ https://tsecurity.de/de/3692292/unix-server/linux-kernel-714-released-with-bug-fixes-security-updates-and-hardware-improvements/ Fri, 24 Jul 2026 20:32:46 +0200 🐧 Unix Server tsecurity.de
Linux Kernel 7.1.4 Released with Bug Fixes, Security Updates, and Hardware Improvements
by George Whittaker

Greg Kroah-Hartman has announced the release of Linux Kernel 7.1.4, the latest stable maintenance update for the Linux 7.1 series. As with other stable kernel releases, version 7.1.4 focuses on fixing bugs, improving hardware compatibility, and addressing security and reliability issues without introducing new features. The update became available on July 18, 2026, and users of the Linux 7.1 branch are encouraged to upgrade as soon as possible.

Rather than changing the kernel's feature set, Linux 7.1.4 delivers dozens of targeted fixes collected from developers across multiple kernel subsystems, helping ensure a more stable experience for desktops, servers, embedded devices, and cloud deployments.

Another Important Stable Maintenance Release

The Linux stable branch exists to provide safe updates between major kernel versions. Every stable release undergoes review before being published and contains fixes that have already been tested in the mainline kernel.

Linux 7.1.4 continues this process by incorporating patches that resolve regressions, improve system stability, and fix issues reported by users since the release of Linux 7.1.3.

For most users, these maintenance updates are recommended because they improve reliability without altering existing functionality.

Bug Fixes Across Multiple Kernel Subsystems

Like previous stable releases, Linux 7.1.4 includes fixes spanning many areas of the kernel.

The update addresses issues affecting:

  • Memory management
  • File systems
  • Networking
  • Device drivers
  • Architecture-specific code
  • Core kernel infrastructure
  • USB and storage subsystems

These targeted patches help eliminate crashes, improve compatibility with newer hardware, and resolve edge cases that may only appear under specific workloads.

Improved Hardware Compatibility

One of the ongoing goals of Linux stable releases is expanding support for existing and newly released hardware.

Linux 7.1.4 includes updated drivers and compatibility fixes for various devices, helping improve support for:

  • Graphics hardware
  • Storage controllers
  • Networking devices
  • USB peripherals
  • Laptop components
  • ARM development boards

Although no major driver additions are expected in a maintenance release, incremental improvements like these often resolve hardware-specific bugs reported by users after earlier releases.

Security and Reliability Updates

Stable kernel releases also include security-related fixes that have been accepted into the maintenance branch.

Go to Full Article
]]> <![CDATA[The Cyber Express Weekly Roundup: Ransomware Surge, Data Breaches, and Rising Digital Threats]]> https://tsecurity.de/de/3691669/it-security-nachrichten/the-cyber-express-weekly-roundup-ransomware-surge-data-breaches-and-rising-digital-threats/ https://tsecurity.de/de/3691669/it-security-nachrichten/the-cyber-express-weekly-roundup-ransomware-surge-data-breaches-and-rising-digital-threats/ Fri, 24 Jul 2026 15:30:41 +0200 📰 IT Security Nachrichten tsecurity.de The Cyber Express weekly roundup July 2026

This week’s cybersecurity landscape highlights the continued expansion of cyber risks across governments, businesses, and consumers. From ransomware campaigns targeting organizations worldwide to credential-based attacks, data breaches, online fraud, and digital piracy crackdowns, recent incidents show how threat actors are exploiting both technical vulnerabilities and human behavior.  The latest developments underline the need for stronger security practices, including improved identity protection, faster incident response, and greater awareness of evolving cyber threats. Organizations are increasingly dealing with attacks that go beyond data theft, affecting operations, customer trust, and critical services. 

The Cyber Express Weekly Roundup 

U.S. Accounts for Nearly Half of Global Ransomware Attacks in H1 2026 

The United States experienced 1,721 ransomware attacks during the first half of 2026, representing nearly 45% of all incidents tracked globally, according to research from Cyble Research and Intelligence Labs (CRIL). The report identified ransomware groups Qilin and Akira as among the most active threat actors during the period. Read more... 

Dubai Police Warns Against Online Visa Fraud Schemes 

Dubai Police has issued a warning about fraudulent online advertisements offering work, residency, and visit visas in exchange for payment. Scammers have reportedly used social media platforms and messaging applications to impersonate government entities or unauthorized service providers to trick victims. Read more... 

Craneware Data Breach Exposes Employee and Customer Information 

Healthcare technology company Craneware confirmed that unauthorized individuals accessed part of its data environment, resulting in the exposure of employee information as well as some customer and partner records. The company stated that the incident has been contained and has not disrupted business operations or customer services. Read more...  

U.S. Targets Illegal FIFA World Cup Streaming Networks 

The U.S. Department of Justice seized more than 1,000 domains allegedly involved in illegally streaming FIFA World Cup 2026 matches. The action was carried out under Operation Offsides, an initiative focused on combating online piracy and protecting intellectual property rights. Read more... 

Chick-fil-A Customer Accounts Targeted in Credential Attack 

Chick-fil-A confirmed that certain customer accounts were accessed during an automated credential-stuffing attack between June 17 and June 19, 2026. The attackers used account credentials obtained from an external source to gain unauthorized access. The company said affected information may have included customer names, email addresses, membership details, and limited payment-related data. Read more... 

South Korea Diplomatic System Breach Lasted Nearly 10 Months 

South Korea’s Ministry of Foreign Affairs revealed that attackers maintained access to the National Diplomatic Academy’s online education system for almost 10 months. The breach, which began in April 2025, exposed information linked to thousands of current and former ministry employees. Compromised data included user IDs, names, email addresses, and encrypted passwords. Read more... 

Weekly Cybersecurity Takeaway 

The week’s incidents demonstrate how cyber threats continue to evolve across multiple areas, from ransomware and account compromise to online scams and government-related breaches. Attackers are increasingly targeting weaknesses in identity management, user behavior, and digital infrastructure.  Organizations and individuals must focus on proactive security measures, including stronger authentication controls, regular monitoring, timely updates, and greater awareness of social engineering tactics. As cyber threats become more widespread and interconnected, improving resilience remains essential for protecting data, services, and public trust. ]]> <![CDATA[What is a business analyst? A key role for business-IT efficiency]]> https://tsecurity.de/de/3691228/it-security-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/ https://tsecurity.de/de/3691228/it-security-nachrichten/what-is-a-business-analyst-a-key-role-for-business-it-efficiency/ Fri, 24 Jul 2026 12:09:04 +0200 📰 IT Security Nachrichten tsecurity.de

What is a business analyst?

Business analysts (BAs) are responsible for bridging the gap between IT and the business using data analytics to assess processes, determine requirements, and deliver data-driven recommendations and reports to executives and stakeholders.

BAs engage with business leaders and users to understand how data-driven changes to process, products, services, software, and hardware can improve efficiencies and add value. They must articulate those ideas but also balance them against what’s technologically feasible and financially and functionally reasonable. Depending on the role, a business analyst might work with data sets to improve products, hardware, tools, software, services, or process.

The International Institute of Business Analysis (IIBA), a nonprofit professional association, considers the business analyst an agent of change, and says that business analysis is a disciplined approach to introduce and manage change to organizations, whether they’re for-profit businesses, governments, or nonprofits.

Impact of AI on business analyst role

As AI becomes commonplace in the tech industry, business analysts are embracing it as a tool to automate repetitive work in the role. AI tools can be used for workflow and diagramming, process mapping, data analysis, and to automate meeting minutes and transcribe meetings where requirements are established, all designed to speed up the process of analyzing data, creating visuals, and transcribing and writing user stories and acceptance criteria.

AI tools can also help identify patterns, insights, and unique data points that might go unnoticed by humans, and allow a faster time to generate insights for organizations.

Of course, as with all AI tools, they still require humans to oversee prompts, scripting, and evaluate AI outputs to ensure they’re accurate and valid. While they can’t replace the work of BAs, AI can help them spend more time on thoughtful analysis and decision making, rather than mundane tasks such as gathering and summarizing data, and querying.

Business analyst job description

BAs are responsible for creating new models that support business decisions by working closely with finance and IT teams to establish initiatives and strategies aimed at improving revenue and optimizing costs. They need a strong understanding of regulatory and reporting requirements, and have plenty of experience in forecasting, budgeting, and financial analysis combined with knowing KPIs, according to Robert Half Technology.

According to Robert Half, a BA’s job description typically includes budgeting and forecasting, planning and monitoring, variance analysis, pricing, reporting, and creating a detailed business analysis in an effort to outline problems, opportunities, and solutions for a business. It also says BAs should be able to define business requirements and report them back to stakeholders.

Since BAs are tasked with prioritizing technical and functional requirements, identifying what clients want, and determining what’s feasible to deliver, the role requires a deep understanding of systems, how they function, who’ll need to be involved, and the necessary steps to get everyone on board.  

The role is constantly evolving, especially as companies rely more on data to advise business operations. Every company has different issues that a business analyst can address, whether it’s dealing with outdated legacy systems, changing technologies, broken processes, poor client or customer satisfaction, or large, siloed organizations.

Business analyst skills

The BA position requires both hard and soft skills, as they need to know how to pull, analyze, and report data trends, share that information with others, and apply it to business goals and needs.

Not all BAs need a background in IT if they have a general understanding of how systems, products, and tools work. Alternatively, some have strong IT backgrounds and less experience in business, but are interested in shifting away from IT into this hybrid role, which often acts as a communicator between the business and IT sides of the organization. So having extensive experience in either area can be beneficial for BAs.

According to the IIBA, some of the most important skills and experience for a business analyst are:

  • Oral and written communication skills
  • Interpersonal, organizational, facilitation, and consultative skills
  • Analytical thinking and problem solving
  • Being detail-oriented and able to deliver a high level of accuracy
  • Knowledge of business structure
  • Stakeholder and cost-benefit analysis
  • Processes modeling
  • Understanding networks, databases, and other technologies

For a more in-depth look at what it takes to succeed as a business analyst, click here.

Business analyst salary

The average annual salary for an IT business analyst is $80,692, according to data from PayScale. The highest paid BAs are in New York, where the average salary is 14% higher than the national average. Dallas, Texas, is second, with reported salaries 6.4% higher than the national average, closely followed by Washington, D.C., where salaries are 6.3% higher than the national average.

Some skills are in higher demand than others, with the potential to boost salary. According to Payscale, these are associated with higher BA salaries. These skills, and the amount they can boost your salary, include:

SkillsSalary Boost
ScrumMaster44%
Microsoft Azure30%
Supply Chain27%
Oracle eBusiness Suite25%
Master Data Management (SAP MDM)24%
SAP Sales and Distribution (SAP SD)24%
Product Support18%
Microsoft Dynamics GP18%
SAP Quality Management (SAP QM)18%
Workday Software15%

For tips on boosting your salary, click here.

Business analyst certifications

Although business analysis is a relatively new discipline in IT, a handful of organizations already offer certifications to help boost your résumé and prove your merit as an analyst. Organizations such as the IIBA, IQBBA, IREB, and PMI each offer their own tailored certifications for business analysis. These include:

  • IIBA Entry Certificate in Business Analysis (ECBA)
  • IIBA Certification of Competency in Business Analysis (CCBA)
  • IIBA Certified Business Analysis Professional (CBAP)
  • IIBA Agile Analysis Certification (AAC)
  • IQBBA Certified Foundation Level Business Analyst (CFLBA)
  • IREB Certified Professional for Requirements Engineering (CPRE)
  • PMI Professional in Business Analysis (PBA)
  • Certified Analytics Professional (CAP)

For more information about how to earn one of these certifications — and how much they cost — click here.

Business analytics tools and software

BAs typically rely on software such as Microsoft’s Excel, PowerPoint, and Access, as well as SQL, Google Analytics, and Tableau. These tools help BAs collect and sort data, create graphs, write documents, and design visualizations to explain findings. You won’t necessarily need programming or database skills for a BA position, but if you already have these skills, they won’t hurt. The type of software and tools you’ll need to use, however, will depend on your job title and what the organization requires.

]]> <![CDATA[3 cybersecurity issues that should keep every CEO awake at night]]> https://tsecurity.de/de/3691226/it-security-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/ https://tsecurity.de/de/3691226/it-security-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/ Fri, 24 Jul 2026 12:09:02 +0200 📰 IT Security Nachrichten tsecurity.de

For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.

Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organizations continue to suffer major cyber incidents with alarming regularity. Every week seems to bring news of another ransomware attack, supply chain compromise or data breach affecting organizations that many would have assumed were well protected.

The obvious conclusion is that we are asking the wrong questions.

Too many executive teams remain preoccupied with the latest threat actor, the newest security product the CISO wants to buy or the latest vulnerability making headlines. Those issues matter, but they are not what should be keeping CEOs awake at night.

In my view, there are three far more fundamental issues that deserve the attention of every chief executive.

1. Corporate complexity, and the widening gap between business leadership and cybersecurity reality

Perhaps the biggest cybersecurity risk facing large organizations today is not technical at all.

It is the growing disconnect between executive perception and operational reality.

Many boards genuinely believe their organizations are reasonably well protected. They receive regular dashboards showing improving maturity scores, increasing compliance levels, falling vulnerability counts and reassuring traffic-light reports.

Unfortunately, cyber attackers do not read dashboards.

Behind those executive reports often lies an increasingly complex technology landscape, thousands of unmanaged digital assets, ageing infrastructure, rampant shadow IT, fragmented ownership, inconsistent governance and security teams struggling to keep pace with relentless business change.

The problem is rarely a lack of effort.

It is that corporate complexity has reached a level where traditional governance mechanisms are no longer capable of providing an accurate picture of organizational resilience.

Executives believe they understand the level of cyber risk they face because they receive regular reports. Those reports often measure activity rather than resilience.

Governance committees end up debating around another percentage point of phishing awareness or vulnerability remediation, while fundamental issues remain unaddressed in the background.

2. Organizational inertia, and the need for executive structure to evolve faster

Cyber criminals continue to evolve rapidly. Large organizations generally do not.

This is the second issue that should concern every CEO.

Throughout my career, I have observed organizations repeatedly responding to new cyber threats by adding another technology platform, another monitoring capability, another compliance framework or another governance committee.

Very rarely do they stop to redesign how cybersecurity operates.

The result is what I described several years ago as the “Cybersecurity Spiral of Failure”.

  • As complexity and regulation increase, organizations invest in more security products.
  • More products create more complexity.
  • More products and greater complexity generate more alerts.
  • More alerts require more analysts.
  • More analysts produce more reports.
  • More reports continue to build up executive confidence.
  • Meanwhile, the underlying structural weaknesses remain largely unchanged, technical debt piles up and costs escalate.

And when the inevitable breach eventually happens, reality reveals itself, but distrust also sets in between senior executives and security teams.

This is not a funding problem. Nor is it a skills problem. It is fundamentally an operating model problem.

Many organizations continue trying to solve twenty-first century challenges using governance, accountability, organizational and reporting structures designed twenty-five years ago.

The cybersecurity function itself has evolved dramatically. Many executive structures have not.

This organizational inertia extends beyond technology: It affects budgeting cycles, investment priorities, procurement processes, accountability models and decision-making speed.

Cyber attackers innovate every day. Organizational change often takes years.

That imbalance should worry every CEO.

3. Accelerating technological disruption, and how it challenges organizations in areas where they are intrinsically weak

The third issue is potentially the most significant over the coming decade.

  • Artificial intelligence, autonomous agents and machine identities
  • Software supply chain complexity.
  • Quantum computing, and post-quantum cryptography

Each of these developments represents far more than another technical trend.

Together, they fundamentally change the dynamics of cybersecurity.

Artificial intelligence is transforming countless business processes. At the same time, it is also increasing both the speed and sophistication of cyber-attacks while simultaneously transforming defensive capabilities.

Organizations have become increasingly dependent on software ecosystems that extend far beyond their own direct control. Engaging with the supply chain in ways that lead to a genuine appreciation of the risks involved has become a key challenge for most cybersecurity practices.

Quantum computing may eventually invalidate much of today’s cryptographic algorithms, forcing organizations into one of the largest technology efforts since Y2K — but without the benefit of a fixed deadline and faced by a problem that is considerably more complex and hyperconnected IT estates that have little to do with those of the late 90s.

None of these challenges can be solved overnight: They require clear governance, sustained investment over a few years and cross-functional organizational coordination.

Most large organizations are weak on those three fronts: This is precisely why CEOs should be focusing on them now.

Waiting until some of those risks become obvious will almost certainly be too late.

Businesses naturally prioritise immediate commercial pressures. Cybersecurity often involves preparing for risks whose timing remains uncertain.

But one of the greatest leadership failures I keep seeing remains the inability of organizations to act decisively on known unknowns.

That tension explains why many organizations delay action until external events force them to respond. Unfortunately, cybersecurity rarely rewards late action.

Leadership will determine who succeeds

Cybersecurity discussions still frequently focus on technology. I believe they should focus far more on leadership.

Technology will continue evolving. Threat actors will continue adapting. Regulations will continue expanding. Those developments are inevitable.

What remains within the control of every CEO is how their organization responds.

Does cybersecurity remain an IT issue? Or is it recognised as an integral part of business resilience?

How is cybersecurity accountability assigned at executive level? Or does it still rest largely with a CISO hidden in the organization?

Does the board spend sufficient time discussing resilience? Or does cybersecurity appear only when approving budgets or reviewing incidents?

These questions will increasingly determine organizational success.

The companies that navigate the next decade successfully will not necessarily be those spending the most on cybersecurity. Nor will they be those deploying the latest security technologies first.

They will be the organizations whose leadership recognises that cybersecurity has become a permanent business capability — embedded into governance, strategy, operational decision-making and organizational culture.

That transformation cannot be delegated. It begins with the CEO.

And perhaps that is the single biggest issue that should keep every chief executive awake at night: Not when the next cyber-attack will happen, but whether their organization is evolving quickly enough on those matters to meet a threat landscape that is changing much faster than the business itself.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Why enterprises should care about Nokia’s AI-RAN platform]]> https://tsecurity.de/de/3690985/it-security-nachrichten/why-enterprises-should-care-about-nokias-ai-ran-platform/ https://tsecurity.de/de/3690985/it-security-nachrichten/why-enterprises-should-care-about-nokias-ai-ran-platform/ Fri, 24 Jul 2026 10:13:45 +0200 📰 IT Security Nachrichten tsecurity.de

Earlier this month, Nokia provided an AI-RAN platform update that brings an AI-native and programmable compute which is projected to double spectral efficiency by 2028. This increases speed, but more importantly, it can allow mobile operators to create some actual monetization beyond connectivity.

With this release, Nokia is introducing what it calls the industry’s first commercial AI-RAN platform, built on its AI‑native anyRAN software and Nvidia’s Aerial AI-RAN stack running on merchant GPU-based accelerated computing. The company is already seeing more than 20% gains in spectral efficiency from AI-driven radio algorithms, with a roadmap to reach 50% by 2027 and more than 100% by 2028, effectively doubling capacity on existing spectrum in dense cells.

Legacy RAN infrastructure enables connectivity but not much beyond that. The AI-RAN makes the network intelligent and extends AI into the physical world, enabling telcos to get more from their infrastructure investments, including providing a path to 6G. The partnership with Nvidia brings CUDA and AI into mobile environments.

For Network World readers, the headline isn’t just that Nokia got to market first with AI‑RAN—it’s that the company is using AI and GPUs to break the historical coupling between radio performance and custom silicon refresh cycles, and to turn the RAN into an application platform.

What AI-RAN actually is

At a technical level, Nokia’s AI‑RAN is a software‑defined baseband architecture that runs Layer 1/Layer 2 RAN functions and AI models on accelerated compute, primarily GPUs, instead of being locked into fixed‑function ASICs. Udayan Mukherjee, Nokia’s CTO for RAN and core, summarized the vision in the analyst briefing: “AI‑RAN is essentially a platform that turns the radio network into a true AI‑native programmable platform
 one software detached from the hardware, defining flexible hardware deployment configurations, including part of the AI grid.”

Several pillars stand out:

  • AI‑native design: Algorithms move from traditional linear models to increasingly nonlinear techniques (e.g., advanced channel estimation, deep receivers/transmitters, RKHS-based methods), which demand tensor-heavy compute best delivered by GPUs.
  • Software-defined RAN: The same anyRAN software stack runs across different hardware configurations—plug‑in cards, standalone AI‑RAN nodes, and COTS/cloud RAN—so innovation comes via software releases rather than baseband card swaps.
  • Programmable “D‑apps” layer: Nokia is pushing a new real‑time E3 interface from Layer 1/2 into an application layer for distributed apps (D‑apps) that can tap IQ samples, channel estimation and scheduling data for use cases such as sensing and location services.
  • Crucially, this isn’t meant to replace all custom silicon overnight. Mukherjee was explicit: “We are not dropping the purpose‑built product
 but we want to also get to merchant silicon, because that’s the future as we want to develop bigger models and AI elements and value‑added services on top of it.” The result is a hybrid era where AI‑accelerated platforms coexist with existing basebands but begin to shoulder the most compute‑intensive workloads.

Why AI-RAN matters for operators

Nokia and its early operator partners are trying to solve three perennial problems: finite spectrum, changing traffic patterns, and the drag of hardware refresh cycles.

First, spectrum constraints. Aji Ed, Nokia’s head of AI‑RAN and cloud RAN, called spectrum “the first constraint everybody has,” noting that operators have paid “huge amount of money” for bands and now need to “get up to the 2x spectrum” in terms of usable capacity. By running more complex AI models for multi‑user MIMO pairing, channel estimation, carrier aggregation and deep receiver/transmitter functions on GPUs, Nokia believes it can unlock those gains where traditional platforms simply run out of compute headroom.

Second, traffic is shifting. Generative AI and distributed inference workloads are driving more uplink-heavy, latency‑sensitive patterns that current RANs weren’t designed for. AI‑RAN’s ability to adapt scheduling, beamforming and resource allocation dynamically via AI models deployed at the baseband is meant to keep up with this shift.

Third, innovation cadence. In Ed’s words, “hardware upgrades can’t keep up with the innovation
 we can’t really have a silicon refresh cycle linked with every three‑year cycle.” Nokia’s subscription‑based software model is designed to deliver new AI algorithms, spectral‑efficiency improvements and network optimization features continuously, without requiring “forklift” hardware replacements.

For operators, the message is attractive: comparable TCO and power to existing basebands, “no hardware premium” for GPU adoption, but higher capacity and a path to new services. Nokia told analysts it has reached performance, price and energy efficiency parity between its custom GridShark silicon and GPU-based systems, while moving the baseband roadmap to merchant silicon.

Nokia’s differentiation strategy

Every major RAN vendor is talking about AI‑enhanced radio, but Nokia is drawing a line between incremental gains and what it claims is a platform shift. When asked why its 2x spectral efficiency ambition is so much higher than the ~20% numbers competitors discuss, Ed pointed to the underlying architecture: “We are able to bring much more complex algorithms into this compute infrastructure
 all of these require much higher compute, which is exactly what is coming from the accelerated computing.”

Several differentiators emerge:

  • Aggressive spectral roadmap: Nokia is targeting 1.5x by 2027 and 2x by 2028, across TDD massive MIMO and FDD scenarios, with a feature roadmap built jointly with Nvidia and other partners.
  • Single code base, three deployment paths: The same anyRAN software stack runs on (1) a GPU‑powered AirScale capacity plug‑in card, (2) a high‑capacity standalone AI‑RAN node, and (3) GPU‑based COTS/cloud RAN servers. This lets operators modernize “at their own pace” and mix brownfield evolution with greenfield AI-native deployments.
  • Open ecosystem with D‑apps: Nokia is leaning into ORAN compliance (front‑haul, O1/O2) and actively championing the E3 interface and D‑apps concept within ORAN and AI‑RAN alliances, with Bell Labs and at least two external partners already building sensing and location applications on the platform.
  • Software subscription tied to value: The commercial model builds on existing software subscriptions but ties pricing more explicitly to delivered value, such as spectral efficiency improvements and new AI services, rather than pure license metrics.

Mukherjee emphasized the openness angle in the briefing: “We see a lot of third‑party applications, whether it’s improving spectral efficiency or location service or sensing, can be developed on this platform
 any AI‑powered services from us in Nokia or from ecosystems can be actually developed on top of it.” For operators burned by closed optimization stacks, that’s a notable pivot.

How AI-RAN unlocks new revenue

Most operators will sign off on AI‑RAN if the capacity and TCO story holds, but the more strategic question is monetization beyond connectivity. Nokia’s spokespeople spent considerable time on this in the analyst call, pointing to several classes of services that are difficult or impossible to deliver without AI running in the RAN itself.

Examples include:

  • Integrated sensing: Turning the RAN into a distributed sensor grid that can support applications such as 3D mapping, gesture recognition and environmental monitoring, using the same RF infrastructure. Mukherjee noted, “We have at least two to three partners developing sensing applications on top of it
 as well as two other companies developing location services.”
  • Physical AI and location services: For factories, logistics hubs and smart cities, AI‑RAN can provide high‑precision positioning and real‑time telemetry for robots, drones and autonomous systems by fusing radio data and AI models at the edge.
  • Distributed AI infrastructure: Operators exploring “AI‑native cities” can use AI‑RAN nodes and COTS GPU servers as a distributed inference fabric for applications that need tight latency to endpoints—think AR/VR offload, real‑time video analytics or interactive generative AI experiences.
  • Premium connectivity tiers: With fine‑grained, AI‑driven control over uplink/downlink scheduling and QoS, operators can create differentiated SLAs for enterprise slices, mission‑critical IoT and AI workloads, charging for guaranteed performance rather than best‑effort connectivity.

Ed framed the opportunity as a continuum: Superior connectivity from 2x spectral efficiency creates “space for new AI workloads and other use cases,” while the D‑apps ecosystem and subscription model provide a mechanism to package and sell those capabilities. In practice, that could look like:

  • Industrial sensing-as-a-service, where Nokia and partners supply D‑apps for integrated sensing and positioning, and operators monetize them per site or per device.
  • Network‑exposed APIs for inference, location and RF sensing, integrated into operators’ broader network API portfolios as they pursue “network-as-a-platform” strategies.
  • Sector‑specific AI‑native services, such as stadium analytics, transportation corridor monitoring, or drone traffic management, built by ISVs on top of Nokia’s exposed E3 data.

For operators that already use Nokia’s MantaRay and SMO stacks for cross‑network optimization, AI‑RAN essentially becomes the local real‑time execution environment, while R‑apps/X‑apps continue to orchestrate macro-level behaviors. Mukherjee described this layered architecture as “DU and CU on the platform running D‑apps using E3, interfacing to X‑apps and R‑apps through E2SM and connecting to the overall management system/SMO for lifecycle management.”

Adoption path and reality check

Nokia is not promising instant transformation. AI‑RAN pilots are slated for late 2026, with commercial availability on card‑based systems in 2027 and AirScale-based systems around 2028, all driven from a single software stack that supports 4G, 5G and is upgradable to 6G. The company already has trials and collaborations underway with T‑Mobile US, SoftBank, Indosat Ooredoo Hutchison, BT, Elisa, Vodafone, Orange, NTT Docomo, Deutsche Telekom and others.

There are still open questions around 3GPP vs ORAN standardization of E3, the maturity of the D‑apps ecosystem, and how operators will digest yet another subscription layer tied to radio software. But Nokia’s move puts a stake in the ground: in the AI era, the RAN is not just a throughput engine; it’s a programmable AI computer that can be monetized.

For Network World readers evaluating vendor roadmaps, this launch suggests a clear directional change. If Nokia hits its targets, AI‑RAN could mark the point where baseband becomes less about hardware SKUs and more about an AI platform strategy—one where spectral efficiency and new services are rolled out at “software speed,” as Ed described it, rather than at the pace of the next card generation.

]]> <![CDATA[Oracle Signs 10-Year Software Contract With Pentagon Worth Up To $7 Billion]]> https://tsecurity.de/de/3690420/it-security-nachrichten/oracle-signs-10-year-software-contract-with-pentagon-worth-up-to-7-billion/ https://tsecurity.de/de/3690420/it-security-nachrichten/oracle-signs-10-year-software-contract-with-pentagon-worth-up-to-7-billion/ Fri, 24 Jul 2026 01:06:40 +0200 📰 IT Security Nachrichten tsecurity.de

Read more of this story at Slashdot.

]]> <![CDATA[Microsoft Responds to LG Monitors Installing McAfee Ads On Windows]]> https://tsecurity.de/de/3690305/it-security-nachrichten/microsoft-responds-to-lg-monitors-installing-mcafee-ads-on-windows/ https://tsecurity.de/de/3690305/it-security-nachrichten/microsoft-responds-to-lg-monitors-installing-mcafee-ads-on-windows/ Fri, 24 Jul 2026 00:09:16 +0200 📰 IT Security Nachrichten tsecurity.de

Read more of this story at Slashdot.

]]> <![CDATA[The Rise of Agentic SRE: Humans, Agents, and Reliability]]> https://tsecurity.de/de/3690175/it-security-nachrichten/the-rise-of-agentic-sre-humans-agents-and-reliability/ https://tsecurity.de/de/3690175/it-security-nachrichten/the-rise-of-agentic-sre-humans-agents-and-reliability/ Thu, 23 Jul 2026 22:44:10 +0200 📰 IT Security Nachrichten tsecurity.de Site reliability engineering has always been about reducing toil, improving resilience and helping teams respond to incidents with speed and confidence. Agentic SRE takes this idea further, allowing AI systems to observe, reason, and act within operational workflows inside of


Read more →

The post The Rise of Agentic SRE: Humans, Agents, and Reliability appeared first on IT Security News.

]]> <![CDATA[Rockwell Automation ThinManager]]> =1...]]> https://tsecurity.de/de/3689943/it-security-nachrichten/rockwell-automation-thinmanager/ https://tsecurity.de/de/3689943/it-security-nachrichten/rockwell-automation-thinmanager/ Thu, 23 Jul 2026 20:17:43 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory.

The following versions of Rockwell Automation ThinManager are affected:

  • ThinManager >=13.0.0|<13.0.7, >=13.1.0|<13.1.5, >=13.2.0|<13.2.4, >=14.0.0|<14.0.2
CVSS Vendor Equipment Vulnerabilities
v3 8.1 Rockwell Automation Rockwell Automation ThinManager Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Background

  • Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Food and Agriculture, Water and Wastewater
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-11917

A path traversal security issue exists within Rockwell Automation ThinManager software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the application's intended directory.

View CVE Details

Affected Products

Rockwell Automation ThinManager
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation ThinManager: >=13.0.0|<13.0.7, Rockwell Automation ThinManager: >=13.1.0|<13.1.5, Rockwell Automation ThinManager: >=13.2.0|<13.2.4, Rockwell Automation ThinManager: >=14.0.0|<14.0.2
Product Status:
known_affected
Remediations

Mitigation
Users using the affected software, should upgrade to one of the corrected versions as follows:

Vendor fix
ThinManager Versions 13.0.0 - 13.0.7 --> 13.0.8

Vendor fix
ThinManager Versions 13.1.0 - 13.1.5 --> 13.1.6

Vendor fix
ThinManager Versions 13.2.0 - 13.2.4 --> 13.2.5

Vendor fix
ThinManager Versions 14.0.0 - 14.0.2 --> 14.0.3

Mitigation
Users using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices.
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

Mitigation
For more information, refer to Rockwell Automation's Securitry Advisory page.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html

Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 7.2 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-14
Date Revision Summary
2026-07-14 1 Initial Publication by Rockwell Automation
2026-07-21 2 Initial Republication of Rockwell Automation advisory

Legal Notice and Terms of Use

]]> <![CDATA[Johnson Controls C-CURE 9000 and Victor application server]]> https://tsecurity.de/de/3689942/it-security-nachrichten/johnson-controls-c-cure-9000-and-victor-application-server/ https://tsecurity.de/de/3689942/it-security-nachrichten/johnson-controls-c-cure-9000-and-victor-application-server/ Thu, 23 Jul 2026 20:17:06 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution.

The following versions of Johnson Controls C-CURE 9000 and Victor application server are affected:

  • C-CURE 9000 and victor <=v2.90_v3.0 
  • victor Web <=v7.1 
CVSS Vendor Equipment Vulnerabilities
v3 9.6 Johnson Controls Johnson Controls C-CURE 9000 and Victor application server Server-Side Request Forgery (SSRF), Execution with Unnecessary Privileges

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Ireland

Vulnerabilities

Expand All +

CVE-2026-21655

Under certain circumstances, successful exploitation of this vulnerability could allow an unauthenticated attacker on the adjacent network to achieve arbitrary code execution on the C-CURE 9000 or victor application server, as well as connected clients (e.g., workstations of physical security personnel). Such an attack could impact physical security controls.

View CVE Details

Affected Products

Johnson Controls C-CURE 9000 and Victor application server
Vendor:
Johnson Controls
Product Version:
Johnson Controls C-CURE 9000 and victor: <=v2.90_v3.0
Product Status:
known_affected
Remediations

Mitigation
Johnson Controls recommends the following defensive measures to help reduce the risk of exploitation: (CVE-2026-21655) Upgrade to C-CURE 9000 / victor version 3.20 or later, which addresses the vulnerable deserialization path (LV1.1).

Vendor fix
Network segmentation - Isolate the C-CURE 9000 and victor application servers on a dedicated network segment and restrict access to port 8999 to only authorized systems that require connectivity.

Mitigation
Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.

Mitigation
Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.

Mitigation
Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.

Mitigation
Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.

Mitigation
Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.

Mitigation
Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.

Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Relevant CWE: CWE-918 Server-Side Request Forgery (SSRF)

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.8 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 8.7 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-21653

Under certain circumstances, successful exploitation of this vulnerability could allow an attacker to forge server-side HTTP requests from the victor Web application. This could be leveraged to interact with internal services running on the host or accessible on the local network, potentially leading to unauthorized information disclosure or lateral movement within the network.

View CVE Details

Affected Products

Johnson Controls C-CURE 9000 and Victor application server
Vendor:
Johnson Controls
Product Version:
Johnson Controls victor Web: <v7.0
Product Status:
known_affected
Remediations

Vendor fix
(CVE-2026-21653, CVE-2026-34496) Update all victor Web installations to version 7.0 or later, which contains the fix for this vulnerability. The fix has been validated through independent retest.

Mitigation
Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.

Mitigation
Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.

Mitigation
Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.

Mitigation
Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.

Mitigation
Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.

Mitigation
Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.

Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Relevant CWE: CWE-918 Server-Side Request Forgery (SSRF)

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.6 CRITICAL CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 9.4 CRITICAL CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVE-2026-34496

Under certain circumstances, successful exploitation of this vulnerability could result in low privilege users accessing unauthorized pages such as Users and Logs. Successful exploitation could allow an attacker to view sensitive system information, user account details, and audit logs beyond their intended access level, potentially enabling further attacks or unauthorized administrative actions.

View CVE Details

Affected Products

Johnson Controls C-CURE 9000 and Victor application server
Vendor:
Johnson Controls
Product Version:
Johnson Controls victor Web: <=v7.1
Product Status:
known_affected
Remediations

Vendor fix
(CVE-2026-21653, CVE-2026-34496) Update all victor Web installations to version 7.0 or later, which contains the fix for this vulnerability. The fix has been validated through independent retest.

Mitigation
Firewall / access control lists - Implement strict firewall rules to block all unnecessary inbound connections to port 8999 from untrusted network segments.

Mitigation
Intrusion detection / prevention - Deploy IDS/IPS signatures tuned to detect known .NET deserialization exploit payloads (e.g., ysoserial.net patterns) targeting port 8999.

Mitigation
Application whitelisting - Enforce application whitelisting on application server hosts to prevent unauthorized executables from being launched by the server process.

Mitigation
Least privilege - Ensure the application server process runs with the minimum privileges necessary, reducing the impact of successful exploitation.

Mitigation
Monitor and audit - Enable detailed logging on application server hosts and monitor for anomalous process creation by SoftwareHouse.CrossFire.Server.exe.

Mitigation
Disable unnecessary services - If the ClientConnectionManager_NF.SynchronousServerNotification callback interface is not required, disable or restrict it to reduce attack surface.

Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16 at the following location: https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories
https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories

Relevant CWE: CWE-250 Execution with Unnecessary Privileges

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8 HIGH CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 8.7 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Harrison Neal reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-23
Date Revision Summary
2026-07-23 1 Initial Republication of Johnson Controls Product Security Advisories JCI-PSA-2026-07, JCI-PSA-2026-13, and JCI-PSA-2026-16

Legal Notice and Terms of Use

]]> <![CDATA[Johnson Controls XAAP Android]]> https://tsecurity.de/de/3689941/it-security-nachrichten/johnson-controls-xaap-android/ https://tsecurity.de/de/3689941/it-security-nachrichten/johnson-controls-xaap-android/ Thu, 23 Jul 2026 20:17:02 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device.

The following versions of Johnson Controls XAAP Android are affected:

  • XAAP Android <1.53
CVSS Vendor Equipment Vulnerabilities
v3 3.3 Johnson Controls Johnson Controls XAAP Android Cleartext Storage of Sensitive Information

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Ireland

Vulnerabilities

Expand All +

CVE-2026-34490

A cleartext storage weakness exists in the Fire Solutions Android application, which stores application data locally on the device without encryption. An attacker with physical access to the device and one able to compromise the device through a separate, unrelated flaw, could potentially read this data in plaintext. Exploitation does not require network access and is limited to the local device environment.

View CVE Details

Affected Products

Johnson Controls XAAP Android
Vendor:
Johnson Controls
Product Version:
Johnson Controls XAAP Android: <1.53
Product Status:
known_affected
Remediations

Vendor fix
Johnson Controls recommends users update the XAAP Android application to version 1.53 or later, which contains the fix for this vulnerability.

Mitigation
Johnson Controls recommends users restrict physical access to devices running the XAAP Android application.

Mitigation
Johnson Controls recommends users ensure devices are hardened with up-to-date Android OS versions, device encryption enabled, and screen lock protections in place.

Mitigation
Johnson Controls recommends users implement a Mobile Device Management (MDM) solution to enforce security policies, including encryption requirements, application whitelisting, and remote wipe capabilities.

Mitigation
Johnson Controls recommends users Avoid rooting or jailbreaking devices used in production environments, as this weakens OS-level security controls that help protect local application data.

Mitigation
For more detailed mitigation instructions, please see Johnson Controls Product Security Advisory JCI-PSA-2026-10.

Relevant CWE: CWE-312 Cleartext Storage of Sensitive Information

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 3.3 LOW CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 4.8 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Acknowledgments

  • Johnson Controls reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

Revision History

  • Initial Release Date: 2026-07-23
Date Revision Summary
2026-07-23 1 Initial Republication of Johnson Controls JCI-PSA-2026-10

Legal Notice and Terms of Use

]]> <![CDATA[MZ Automation libIEC61850]]> https://tsecurity.de/de/3689940/it-security-nachrichten/mz-automation-libiec61850/ https://tsecurity.de/de/3689940/it-security-nachrichten/mz-automation-libiec61850/ Thu, 23 Jul 2026 20:16:58 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.

The following versions of MZ Automation libIEC61850 are affected:

  • libIEC61850 >=v1.0.0|<=v1.6.1 
CVSS Vendor Equipment Vulnerabilities
v3 8.1 MZ Automation MZ Automation libIEC61850 Stack-based Buffer Overflow, Heap-based Buffer Overflow, Improper Handling of Syntactically Invalid Structure, NULL Pointer Dereference

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Energy, Transportation Systems
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2026-50039

The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a ReadRequest.

View CVE Details

Affected Products

MZ Automation libIEC61850
Vendor:
MZ Automation
Product Version:
MZ Automation libIEC61850: >=v1.0.0|<=v1.6.1
Product Status:
known_affected
Remediations

Vendor fix
MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.
https://github.com/mz-automation/libiec61850

Relevant CWE: CWE-121 Stack-based Buffer Overflow

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVE-2026-49035

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.

View CVE Details

Affected Products

MZ Automation libIEC61850
Vendor:
MZ Automation
Product Version:
MZ Automation libIEC61850: >=v1.0.0|<=v1.6.1
Product Status:
known_affected
Remediations

Vendor fix
MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.
https://github.com/mz-automation/libiec61850

Relevant CWE: CWE-122 Heap-based Buffer Overflow

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-50103

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value.

View CVE Details

Affected Products

MZ Automation libIEC61850
Vendor:
MZ Automation
Product Version:
MZ Automation libIEC61850: >=v1.0.0|<=v1.6.1
Product Status:
known_affected
Remediations

Vendor fix
MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.
https://github.com/mz-automation/libiec61850

Relevant CWE: CWE-228 Improper Handling of Syntactically Invalid Structure

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 7.1 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVE-2026-50032

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field.

View CVE Details

Affected Products

MZ Automation libIEC61850
Vendor:
MZ Automation
Product Version:
MZ Automation libIEC61850: >=v1.0.0|<=v1.6.1
Product Status:
known_affected
Remediations

Vendor fix
MZ Automation recommends updating to the latest build of the libIEC61850 standard. Documentation can be found at https://github.com/mz-automation/libiec61850.
https://github.com/mz-automation/libiec61850

Relevant CWE: CWE-476 NULL Pointer Dereference

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Abhinav Agarwal reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-23
Date Revision Summary
2026-07-23 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[MZ Automation lib60870]]> https://tsecurity.de/de/3689939/it-security-nachrichten/mz-automation-lib60870/ https://tsecurity.de/de/3689939/it-security-nachrichten/mz-automation-lib60870/ Thu, 23 Jul 2026 20:16:52 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service.

The following versions of MZ Automation lib60870 are affected:

  • lib60870 <=2.4.0
CVSS Vendor Equipment Vulnerabilities
v3 8.2 MZ Automation MZ Automation lib60870 Out-of-bounds Read

Background

  • Critical Infrastructure Sectors: Chemical, Energy, Water and Wastewater
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2026-16002

The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service.

View CVE Details

Affected Products

MZ Automation lib60870
Vendor:
MZ Automation
Product Version:
MZ Automation lib60870: <=2.4.0
Product Status:
known_affected
Remediations

Vendor fix
MZ automation recommends users update to version 2.4.1 or later. Documentation can be found at https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv.
https://github.com/mz-automation/lib60870/security/advisories/GHSA-f5xp-w6f3-vvrv

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 8.8 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Lars Tray reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this (these) vulnerability(ies).

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-23
Date Revision Summary
2026-07-23 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Panduit IntraVUE]]> https://tsecurity.de/de/3689938/it-security-nachrichten/panduit-intravue/ https://tsecurity.de/de/3689938/it-security-nachrichten/panduit-intravue/ Thu, 23 Jul 2026 20:16:33 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling.

The following versions of Panduit IntraVUE are affected:

  • IntraVUE <=3.2.1a14 
CVSS Vendor Equipment Vulnerabilities
v3 10 Pronetiqs Panduit IntraVUE Plaintext Storage of a Password, Unintended Proxy or Intermediary ('Confused Deputy'), Exposure of Sensitive System Information to an Unauthorized Control Sphere, Inadequate Encryption Strength

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Energy, Information Technology, Water and Wastewater
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Netherlands

Vulnerabilities

Expand All +

CVE-2026-40430

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API.

View CVE Details

Affected Products

Panduit IntraVUE
Vendor:
Pronetiqs
Product Version:
Pronetiqs IntraVUE: <=3.2.1a14
Product Status:
known_affected
Remediations

Vendor fix
Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.

Mitigation
For further questions, please contact Pronetiqs at info@pronetiqs.com.
mailto:info@pronetiqs.com

Relevant CWE: CWE-256 Plaintext Storage of a Password

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVE-2026-42933

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.

View CVE Details

Affected Products

Panduit IntraVUE
Vendor:
Pronetiqs
Product Version:
Pronetiqs IntraVUE: <=3.2.1a14
Product Status:
known_affected
Remediations

Vendor fix
Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.

Mitigation
For further questions, please contact Pronetiqs at info@pronetiqs.com.
mailto:info@pronetiqs.com

Relevant CWE: CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 10 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 10 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVE-2026-44955

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users.

View CVE Details

Affected Products

Panduit IntraVUE
Vendor:
Pronetiqs
Product Version:
Pronetiqs IntraVUE: <=3.2.1a14
Product Status:
known_affected
Remediations

Vendor fix
Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.

Mitigation
For further questions, please contact Pronetiqs at info@pronetiqs.com.
mailto:info@pronetiqs.com

Relevant CWE: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVE-2026-50044

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or a pass-the-hash attack.

View CVE Details

Affected Products

Panduit IntraVUE
Vendor:
Pronetiqs
Product Version:
Pronetiqs IntraVUE: <=3.2.1a14
Product Status:
known_affected
Remediations

Vendor fix
Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.

Mitigation
For further questions, please contact Pronetiqs at info@pronetiqs.com.
mailto:info@pronetiqs.com

Relevant CWE: CWE-326 Inadequate Encryption Strength

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 7.6 HIGH CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVE-2026-28698

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem.

View CVE Details

Affected Products

Panduit IntraVUE
Vendor:
Pronetiqs
Product Version:
Pronetiqs IntraVUE: <=3.2.1a14
Product Status:
known_affected
Remediations

Vendor fix
Pronetiqs advises users to update to the latest version of the IntraVUE software, version 3.2.1a16 or later.

Mitigation
For further questions, please contact Pronetiqs at info@pronetiqs.com.
mailto:info@pronetiqs.com

Relevant CWE: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Acknowledgments

  • Phlebas of Lumintel reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-23
Date Revision Summary
2026-07-23 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Weintek cMT3092X]]> https://tsecurity.de/de/3689937/it-security-nachrichten/weintek-cmt3092x/ https://tsecurity.de/de/3689937/it-security-nachrichten/weintek-cmt3092x/ Thu, 23 Jul 2026 20:16:14 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.

The following versions of Weintek cMT3092X are affected:

  • cMT3092X firmware <20210218 
  • EasyWeb <v2.1.20
CVSS Vendor Equipment Vulnerabilities
v3 8.8 Weintek Weintek cMT3092X Reliance on Cookies without Validation and Integrity Checking in a Security Decision, Incorrect Permission Assignment for Critical Resource, Plaintext Storage of a Password, Incorrect User Management

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Taiwan

Vulnerabilities

Expand All +

CVE-2026-60134

Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.

View CVE Details

Affected Products

Weintek cMT3092X
Vendor:
Weintek
Product Version:
Weintek cMT3092X firmware: <20210218, Weintek EasyWeb: <v2.1.20
Product Status:
known_affected
Remediations

Vendor fix
Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.
https://www.weintek.com/globalw/Support/Knowledge.aspx

Mitigation
Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.
https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf

Relevant CWE: CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-61892

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.

View CVE Details

Affected Products

Weintek cMT3092X
Vendor:
Weintek
Product Version:
Weintek cMT3092X firmware: <20210218, Weintek EasyWeb: <v2.1.20
Product Status:
known_affected
Remediations

Vendor fix
Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.
https://www.weintek.com/globalw/Support/Knowledge.aspx

Mitigation
Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.
https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf

Relevant CWE: CWE-732 Incorrect Permission Assignment for Critical Resource

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-61886

Weintek cMT3092X HMI stores user account passwords in plaintext.

View CVE Details

Affected Products

Weintek cMT3092X
Vendor:
Weintek
Product Version:
Weintek cMT3092X firmware: <20210218, Weintek EasyWeb: <v2.1.20
Product Status:
known_affected
Remediations

Vendor fix
Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.
https://www.weintek.com/globalw/Support/Knowledge.aspx

Mitigation
Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.
https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf

Relevant CWE: CWE-256 Plaintext Storage of a Password

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 7.1 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVE-2026-60135

An attacker can modify data that should be restricted to read‑only access.

View CVE Details

Affected Products

Weintek cMT3092X
Vendor:
Weintek
Product Version:
Weintek cMT3092X firmware: <20210218, Weintek EasyWeb: <v2.1.20
Product Status:
known_affected
Remediations

Vendor fix
Weintek recommends users apply the patch package named cmt_typeB_20260316_007.patch, which contains a newer EasyWeb 2.3.17-typeb. This fix will be delivered as a patch-only update; no separate standard firmware release is planned. Users may request the patch directly from Weintek support (https://www.weintek.com/globalw/Support/Knowledge.aspx) or from distributors.
https://www.weintek.com/globalw/Support/Knowledge.aspx

Mitigation
Weintek has published a document with more details about this issue at https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf.
https://dl.weintek.com/public/Document/TEC/TEC25003E_cMT_EasyWeb_V2_Security_Issues.pdf

Relevant CWE: CWE-286 Incorrect User Management

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
4.0 7.1 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Acknowledgments

  • Vincenzo Giuseppe Colacino of Secoore reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take the following measures to protect themselves from social engineering attacks:

Practice principles of least privilege.

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-23
Date Revision Summary
2026-07-23 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[MacBook Neo 2 rumored to pack a faster chip and more RAM]]> https://tsecurity.de/de/3689408/ios-mac-os/macbook-neo-2-rumored-to-pack-a-faster-chip-and-more-ram/ https://tsecurity.de/de/3689408/ios-mac-os/macbook-neo-2-rumored-to-pack-a-faster-chip-and-more-ram/ Thu, 23 Jul 2026 16:59:46 +0200 🍏 iOS / Mac OS tsecurity.de 12GB of RAM in MacBook Neo 2 looks locked in — here’s why

The MacBook Neo 2 could bring an A19 Pro chip and more RAM, improving the performance of Apple's budget-friendly notebook.

(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

]]> <![CDATA[Q&A: Google’s AI and computing chief talks about its shapeshifting data centers]]> https://tsecurity.de/de/3689101/it-security-nachrichten/qa-googles-ai-and-computing-chief-talks-about-its-shapeshifting-data-centers/ https://tsecurity.de/de/3689101/it-security-nachrichten/qa-googles-ai-and-computing-chief-talks-about-its-shapeshifting-data-centers/ Thu, 23 Jul 2026 14:55:21 +0200 📰 IT Security Nachrichten tsecurity.de

Google’s AI offerings span its internal and cloud offerings. Its data centers are processing seven times more AI tokens compared to last year. To keep up, Google is upgrading its data-center hardware and software technologies at a faster clip. It plans to raise $80 billion to build new data centers. (See related story: Google transforms its data center architecture for agent era)

Network World spoke with Mark Lohmeyer, vice president and general manager of AI and computing at Google, about how the company’s infrastructure is keeping pace with AI demand.

Network World: What is the primary shift in infrastructure needs?

Mark Lohmeyer: We’ve seen the rise of agents and agentic use cases. Years ago, it was the chat phase: Ask a question, get an answer. Now we’re in the agentic era, where you express your intent, agents spin off multiple sub-agents, working in parallel, preserving state. This is a radical shift in what infrastructure needs to do; make them fast, cost effective, secure, reliable. We’re delivering infrastructure optimized for the age of agents.

NW: What’s the goal of the infrastructure buildout, and what should customers expect regarding costs?

ML: Ultimately, it’s about enabling customers with leading-edge capabilities and models at scale cost-effectively. With agents, inference transactions increase by 50x, 100x versus non-agentic workloads. We’re driving the cost per transaction down exponentially. In our latest platforms, we reduce the cost by almost 2x for the same work. Customers serve twice the number of users at the same cost, directly driving profitability.

NW: How are you addressing energy efficiency?

ML: Energy is a critical resource, and Google has optimized for years. We design data centers and compute [to drive] high PUE (power usage effectiveness). We introduced liquid cooling over five years ago, and these latest systems are all liquid cooled. For agentic workloads, CPUs come to the forefront
 orchestrating agents, calling tools, doing evaluation loops in reinforcement learning. Our latest Axion-based CPU platform called N4A has energy efficiency and is significantly better than the prior generation and x86 comparables.

NW: How do you think about token efficiency as you build-out systems?

ML: Performance and efficiency gains are powered by co-design of the model and infrastructure. Gemini is trained on TPUs, primarily served on TPUs with high frontier model capability, in a token and cost-efficient way. This stems from co-design across the full stack.

NW: How do you project what infrastructure will be needed years in advance?

ML: Hardware cycles deliver a new next generation roughly every year, but design cycles are two years or more in advance. We work with DeepMind doing core research, to application teams taking models into production, to billions of users, to our team building infrastructure. We work upstream with DeepMind and application teams to understand what’s coming. Agents weren’t being broadly spoken of externally, but internally we had those insights around what they would need. That shows up in hardware design. We hit the timing right — these platforms are built for agents.

NW: What’s the eighth generation TPU platform?

ML: We deliver new platforms every year, and ones launched years ago are close to 100% utilized because demand for AI-optimized compute is high. The eighth-generation TPU platform is the first delivering two complete systems, from the chip all the way up to the network and storage and software, that are optimized.

TPU-8t is optimized for training, and TPU-8i is optimized for inference. For TPU-8i, we increased SRAM on the chip to 384MB — three times the prior generation — and increased the HBM by 50%.

NW: How are you approaching GPU and TPU compatibility?

ML: People in a single cluster do not commingle GPUs and TPUs. We offer both options based on specific workload needs. We’ve been investing on the TPU side in using software frameworks customers are comfortable with on GPUs and enabling those on TPUs. For example, PyTorch and vLLM. Customers could have a pool of GPUs and TPUs, running vLLM on top of that. Start with a workload on TPUs, but if the TPU pool is fully utilized, spill to GPUs or vice versa. This works because it’s all leveraging the same compatible software layer on top.

NW: How has the orchestration platform changed for agents?

ML: Kubernetes is becoming the orchestration platform of choice for AI. Google is transforming GKE [Google Kubernetes Engine] into an agent-native orchestration solution. When expressing intent to an agent and it spins up multiple sub-agents, compute needs to spin up rapidly — TPUs or GPUs — without long delays, then run and spin back down. We’re optimizing at every layer of the GKE stack: significantly improving node startup time and how rapidly we start and stop containers. Lovable demonstrates this with GKE, spinning up hundreds of sandboxes for live coding sessions on their platform in parallel, paying for infrastructure when needed.

NW: What is the role of the network and storage infrastructure?

ML: The network is critical for AI. This requires creating large-scale clusters of GPUs or TPUs and enabling them to talk to each other in a high-performance way. We created the Virgo network — a collapsed network architecture, non-blocking within a data center, where multiple pods or NVLink72 domains connect together.

In TPU8T, we can connect over a million TPUs together leveraging Virgo, creating large-scale, high-performance, reliable clusters that shrink innovation cycles. Storage is equally critical. In large-scale clusters, something is always failing. The ability to take snapshots and go back to a checkpoint is important.

We’ve introduced Managed Lustre 10T, with 10 terabytes per second of bandwidth, 18 petabytes of storage in single clusters. This is 10 times faster than last year and 20 times faster than competition. We have Rapid Bucket, low-latency storage backed by Google storage systems. Both are impactful in large-scale training environments.

NW: How does KV cache strategy differ between training and inference?

ML: For TPU-8i, we increased SRAM on the chip to 384 megabytes — three times the prior generation — and increased the HBM by 50%. Storing KV cache directly in chip memory allows responding to inference requests much more rapidly and cost-effectively than going to an external system. For inference workloads, storing as much KV cache as possible on-chip is critical.

We’re introducing a dedicated KV cache storage subsystem that works across GPUs and TPUs. As KV caches get larger, being able to fall back to this dedicated subsystem becomes critical. Loading model weights rapidly is important in dynamic inference environments where accelerators switch between models hour by hour.

]]> <![CDATA[American Alarm Moves From Reactive Security To Proactive Data Protection With BlackFog]]> https://tsecurity.de/de/3689061/it-security-nachrichten/american-alarm-moves-from-reactive-security-to-proactive-data-protection-with-blackfog/ https://tsecurity.de/de/3689061/it-security-nachrichten/american-alarm-moves-from-reactive-security-to-proactive-data-protection-with-blackfog/ Thu, 23 Jul 2026 14:42:04 +0200 📰 IT Security Nachrichten tsecurity.de <![CDATA[The new value architecture of the AI-native SaaS era]]> https://tsecurity.de/de/3688966/it-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/ https://tsecurity.de/de/3688966/it-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/ Thu, 23 Jul 2026 14:05:04 +0200 📰 IT Nachrichten tsecurity.de

The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.

In brief:

  • AI is transforming software as a service (SaaS), and the old ways of keeping score no longer apply.
  • Smart companies are evolving new metrics that provide deeper insight into how AI-native software is performing in a new marketplace.
  • These changes impact everything from pricing to valuations.

The transformation of the software-as-a-service (SaaS) industry toward AI-native operating companies is rapidly changing the unit of value across the industry.

The traditional metric of seats — which measured access — is rapidly giving way to credits designed to measure work performed. This evolution is upending the industry in multiple ways, impacting everything from pricing to enterprise valuations.

While many companies still cling to seat-based metrics to measure growth, efficiency and durability, the future is likely to be one in which companies utilize a credit-centric metrics framework, with seats and outcomes as the bookends of a spectrum.

Why do software companies need new metrics?

Why the rethink, and why now? There are five major forces that are driving this shift:

  1. The unit of value is changing. Seats measured who could access software, and credits measure what the software actually does. But in an AI-native world, agents don’t have seats; they have workloads. Over the past 18 months, every major SaaS platform has moved to some forms of credit or consumption unit.
  2. The cost of goods sold (COGS) is exploding. AI inference adds real per-unit costs that scale with usage. In an AI-native world, software companies can’t scale to infinite users at near‑zero marginal cost as before.
  3. Buying is moving up the org chart. AI-native applications shift purchasing to higher-level operators — such as line-of-business leaders or chief operating officers — which expands the market from software budgets to labor budgets. And because AI agents replace services as well as software, the total market opportunity is 3x to 10x larger than traditional SaaS.
  4. Time to value (TTV) is collapsing. With AI-native tools, customers start seeing meaningful results in weeks rather than quarters. Onboarding and setup are fast, workflows are pre-built, and there’s no need for extensive customer success or professional services — dramatically reducing implementation time and costs.
  5. Retention is bifurcating. AI forces clarity in a way that traditional SaaS couldn’t. Products that can provide value become even “stickier” and retain customers. Those that don’t churn faster. In an AI-native marketplace, the middle disappears.

How this shift is impacting pricing

Given how AI-native software is transforming the market, the shift to more variable pricing options is inevitable.

Seats won’t go away completely. Subscription pricing based on the number of users is stable and predictable and will continue to work for some customers. Tokens — the use of pass-through pricing for underlying compute — will fit those customers where the AI feature is commoditized or the buyer wants transparency into costs.

Credits will likely become the dominant architecture because they provide a simple metric for both customers and providers. The vendor sets the conversation ratio between credits and underlying compute, shielding the customer from inference cost details. Credits are easy to understand and can be packaged into annual contracts for multiple features and products.

Finally, the industry will likely see some move toward outcome-based pricing for results such as resolved tickets, recovered revenue or qualified leads. This strategy will mostly be limited to verticals where it is easy to prove AI impacted the result.

Where a software vendor sits on this spectrum is a signal of differentiation and pricing power. Credits are where most defensible AI-native businesses are landing because they balance customer predictability with vendor margin control.

How AI upends classic SaaS metrics

When SaaS was in its infancy, companies settled on key metrics designed to answer a small set of core questions. Are we growing? Are customers using the product? Are we retaining and expanding accounts?

But as AI upends software itself, it is also requiring companies to adopt new metrics to track success. These new metrics fall into three primary buckets, rebuilt around the pricing spectrum described earlier and the trend toward credits as the primary frame:

Revenue composition

  • Committed credit annual recurring revenue (ARR) vs. burndown ARR: Measuring the credits sold on annual commitment vs. those consumed and replenished. This is the single most important split for valuation. Committed credits behave like subscription and burndown behaves like usage.
  • Credit utilization rate: The percentage of purchased credits consumed per period. This is a leading indicator of renewal sizing.
  • Credit burn velocity: How fast is a customer consuming their credits, and is that consumption increasing or decreasing quarter over quarter? This metric predicts expansion or contraction before it shows up in ARR.
  • Effective price per credit: The real revenue per credit after discounts, overage and rollover, which can detect revenue leakage and help companies set smarter guide rails.

Margin reality

  • Credit margin: The gross profit the company earns per credit after subtracting inference costs. This is the core economic unit for AI-native, usage-based businesses — the replacement for gross margin per seat used in SaaS.
  • Inference-adjusted gross margin: By carving out AI inference costs separately in the P&L statement, you can see true AI margins, avoid hiding deterioration inside blended SaaS margins, and clearly distinguish AI economics from legacy SaaS economics.
  • Compute leverage ratio: This metric measures how efficiently the business converts compute spend into revenue. It shows whether your AI margins are improving as you scale.
  • AI-adjusted “Rule of 40”: This updated metric recalibrates the traditional growth and profitability benchmark to account for AI’s lower gross margins and variable inference costs, giving a more accurate picture of business health for AI-native companies.

Behavioral and value signals

  • Time-to-first outcome: Replaces traditional onboarding metrics. Tracks how fast a customer reaches their first measurable result.
  • Adoption: AI-native adoption is measured by workflow penetration and active agent density, not seat count. As AI replaces human-driven usage, the unit of adoption shifts from people to automated workflows and agents.
  • Net credit retention (NCR): Credit-volume retention across the customer base, tracked separately from net recurring revenue to avoid price-change impact.

Along with these new metrics, the industry’s transformation is prompting companies to retire or recalibrate old SaaS measures, including per-seat ARR as a primary key performance indicator (KPI), traditional magic number calibrated to subscription dynamics, unadjusted Rule of 40, customer success metrics tied to human touchpoints, and blended gross margin without AI COGS carve-outs.

What does this mean for enterprise value calculations?

As the internal metrics of success change, so do the ways the investment community measures growth and long-term viability.

Increasingly, a company’s valuation multiple depends on whether its revenue behaves like committed subscription ARR or volatile usage ARR, and the commit‑to‑burndown ratio is the metric investors use to decide where the company fits.

For example, a business with 80% committed credit ARR could trade closer to subscription comps and one with 80% burndown could trade closer to usage comps even though both have the same types of customers. Being able to proactively explain the commit‑to‑burndown mix can help companies avoid undervaluation.

In addition, utilization is expected to replace net promoter scores and seat usage as the primary predictor of churn or expansion. Low utilization guarantees downsizing at renewal, so companies must track utilization cohorts the same way SaaS tracks logo retention cohorts today.

We’re also seeing an inversion of the operating model, with R&D and COGS moving up the P&L and sales and marketing (S&M) and customer success (CS) moving down or sideways. The net operating leverage profile is structurally different from classical SaaS, and the cost-to-scale curve looks different too.

Finally, credit margin engineering is a hidden value-creation lever. The gap between price per credit and cost per credit is set by the software vendor and can be optimized. Most operators have barely started managing this rigorously, and the ones who do will pull away on margin.

What this means for leaders, boards and investors

The shift from classic SaaS metrics to new AI‑native measures isn’t cosmetic. It represents the seismic change the industry is experiencing as AI matures and transforms products and organizations.

While these metrics — and perhaps others yet to be determined — may evolve over time, there is no doubt they are already changing how AI companies allocate capital, price products, incent sales teams, evaluate performance and communicate with investors.

It’s important to remember that SaaS metrics were practical tools for a specific era of software. As that era draws to a close, winning companies will choose new metrics that shape behavior and drive smart decision-making.

The views reflected in this article are the views of the author and do not necessarily reflect the views of Ernst & Young LLP or other members of the global EY organization.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[AI success requires a full-stack CIO]]> https://tsecurity.de/de/3688546/it-nachrichten/ai-success-requires-a-full-stack-cio/ https://tsecurity.de/de/3688546/it-nachrichten/ai-success-requires-a-full-stack-cio/ Thu, 23 Jul 2026 11:43:10 +0200 📰 IT Nachrichten tsecurity.de

Every CIO I speak with today is wrestling with some version of the same question: How do we move faster with AI and deliver on our commitments?

It’s an understandable concern. Boards and CEOs are asking about AI. Business leaders are experimenting with use cases. Employees are discovering tools daily, while technology vendors promise unprecedented gains in productivity, innovation, and competitive advantage.

After hundreds of conversations with technology executives over the past year, I’ve become convinced that speed isn’t the real issue. The organizations pulling away from the pack aren’t necessarily adopting AI faster than everyone else. They’re executing more effectively — a subtle distinction that represents one of the defining leadership challenges of the AI era.

Technology has never been the hardest part of transformation. People, priorities, culture, and operating models are the biggest challenges. The ability to translate bold boardroom aspirations into thousands of thoughtful decisions made every day by architects, engineers, product managers, analysts, and business leaders is where competitive advantage is created. AI may be accelerating the pace of change, but it hasn’t changed that fundamental truth.

I’ve met plenty of executives who are exceptional in the boardroom. They know how to frame a vision, influence a board, and build confidence among investors and business leaders. I’ve also met remarkable technologists who instinctively understand the architectural decisions, engineering tradeoffs, and implementation details that determine how great ideas become reality. Modern CIOs, however, must move comfortably between both worlds. Afshean Talasaz is one who stands out among this rare breed.

Long before becoming CIO of Colonial Pipeline, Talasaz built his career from the ground up as a business professional, data scientist, and technologist. He has designed enterprise platforms, built AI capabilities, led technology organizations, and partnered closely with executive leadership teams on business transformation. Today, as an executive in residence with our Practitioners for Practitioners (P4P) community, he helps CIOs and business leaders navigate one of the most significant technology shifts of our generation.

While Talasaz brings deep knowledge of data and AI to the table, his greatest strength is his ability to create strategy and connect it with execution. He can spend the morning discussing enterprise reinvention with the board and the afternoon debating architectural principles with the teams responsible for bringing that vision to life.

That versatility gives Talasaz a unique lens on how CIOs can deliver value with AI.

Software companies have a term for engineers who understand every layer of the technology stack: full-stack developers. Listen to Talasaz and it becomes evident that the AI era requires something similar from technology leaders: a full-stack CIO.

The full-stack CIO: Leading with clarity

A full-stack CIO understands how every layer of the enterprise influences the next. They recognize that every strategic priority becomes a portfolio investment, every investment shapes an operating model, every operating model influences architecture, every architecture choice informs product decisions, every product decision shapes engineering priorities.

The best CIOs understand both ends of that journey. The extraordinary ones understand everything in between.

And those who execute best lead with clarity, Talasaz says.

“Everyone, from executives to middle managers to the people writing code, should be able to explain what we’re trying to achieve,” he emphasizes. “Clarity isn’t that we’ve handed out the PowerPoint. It’s that people genuinely understand where we’re going and can articulate it in their own language.”

One of the unintended consequences of the AI boom is that organizations are beginning to confuse activity with alignment. They have AI councils, AI governance committees, AI innovation labs, AI centers of excellence, AI pilots, and AI roadmaps. Yet if you stop ten people in the hallway and ask a deceptively simple question, What business problem are we actually trying to solve? you’ll often hear ten different answers.

As a result, architects optimize for one objective while product teams optimize for another. Business units pursue opportunities that seem perfectly reasonable from their perspective. Engineers make thoughtful technical decisions based on the information available to them. Individually, none of those decisions are necessarily wrong. Collectively, however, they create organizational drift. AI doesn’t create that problem. It simply accelerates the consequences.

And while AI can be a force multiplier for the positive when every decision is guided by a shared understanding of where the organization is headed, it can also be a force multiplier for the negative, resulting in an organization simply moving faster in different directions.

“When we have the fundamentals right, the tech infrastructure, the operating models, the nuances of how our business actually runs, we get the impacts of AI in a positive way,” Talasaz says. “When we don’t have those in place, AI can amplify the gaps or mute the benefits.”

At a time when so much of the conversation surrounding AI is focused on algorithms, agents, and automation, it’s an important reminder that organizations don’t execute strategy; people do.

Reducing organizational friction

Most executives are familiar with the concept of VUCA that characterizes today’s business environment. But Talasaz stresses the importance of turning this concern inward: “If the world outside our organizations is becoming more volatile, uncertain, complex, and ambiguous, what are we, as leaders, doing to the inside of our organizations?”

Leaders spend enormous amounts of time helping their organizations respond to external disruption but comparatively little time asking whether they are inadvertently re-creating those same conditions internally in response to those external needs. Are we reducing uncertainty or introducing more of it? Are we simplifying work or adding unnecessary complexity? Are we helping people focus on what matters most, or asking them to navigate competing priorities and shifting expectations?

Talasaz refers to this phenomenon as double VUCA — something I’ve witnessed repeatedly while working with CIOs over the past decade. Organizations often assume they’re struggling because of technology limitations when the real constraint is organizational friction. Teams wait for decisions. Priorities shift faster than roadmaps. Governance grows heavier. New committees are formed to solve problems created by existing committees. Everyone is working harder, yet the organization somehow feels slower.

AI amplifies both outcomes. Organizations with clarity become dramatically more effective because AI accelerates good decisions. Organizations without clarity simply accelerate confusion.

Operating model as strategy enabler

AI governance is one way to achieve greater clarity, but as Talasaz says, governance shouldn’t primarily exist inside policy manuals that few people read.

Instead, AI governance should be embedded in the daily rhythms of the organization, shaping how teams collaborate, how decisions are made, how products move from ideas into production, and how innovation happens safely without requiring constant escalation. In other words, it’s all about your operating model.

“If you had to pick one thing that isn’t technology, your operating model is the most important element for executing data and AI at scale,” he says.

The best operating models create enough clarity that capable people can make thousands of decisions independently and confidently, without having to wait for permission. By embedding good governance into the way it works, the organization becomes faster.

This advice echoes something I’ve heard repeatedly from some of the world’s most respected CIOs: High-performing organizations aren’t built on tighter control; they’re built on greater trust, supported by clear principles, shared expectations, and operating models that enable responsible decision-making at every level of the enterprise.

Talasaz points out that technology leaders tend to speak in terms of transformation. He suggests CIOs consider a different word: reinvention.

As he explains, transformation implies replacing what exists today with something new. Reinvention starts with a more clear-eyed and practical premise: Some things absolutely must change; others represent years, sometimes decades, of accumulated expertise, customer trust, operational discipline, and competitive advantage.

Reinvention is about building on those strengths while also creating new ways to deliver value. The leaders making the greatest progress in their AI journeys seem to recognize that it’s less about abandoning the past than thoughtfully preparing the organization for the future.

Closing the gap between strategy and execution

Full-stack CIOs must be able to map out the various layers of execution and planning that need to be done at every level of the organization to be successful. To help with this, Talasaz has developed a data and AI framework that draws on his own experiences “from the keyboard to the boardroom.”

As Talasaz sees it, too many organizations have been doing good work in isolation. “They’re doing a lot of the right things,” he says. “They’re just not connected.”

Boards may be discussing growth while business leaders redesign customer experiences. Product teams may be prioritizing new capabilities while architects modernize platforms. Data teams may be improving quality while engineers focus on delivery. Every group makes meaningful progress within its own domain, yet somewhere between strategy and execution, the connective tissue begins to disappear. Talasaz’s framework brings those connecting points to the forefront.

Crucially, the framework doesn’t begin with technology or AI or even with data. It begins with the experiences the organization hopes to create for its customers, employees, or partners. Many AI initiatives start with the question, “What can this technology do?” And indeed, we need to be inspired by the possibilities and challenged to think differently by what the technology can do. But, Talasaz emphasizes, we also need to ask what experiences we need to deliver for our business and how the technology can make that a reality.

The framework challenges CIOs to answer that question first. Only after the experiences are clearly defined does the conversation move to the capabilities required to deliver it, the business activities that support those capabilities, the AI and data products that enable them, and finally the data foundation that makes everything possible.

This shift in perspective ensures that, rather than allowing technology investments to search for business value, the business experience defines the technology required to deliver it. For CIOs, that’s more than a planning exercise. It’s a fundamentally different way of leading.

Over the coming months, the P4P community will be convening a series of small CxO roundtables to explore these issues and work more deeply with Afshean Talasaz’s 6×6 Data and AI Framework. CIOs and other enterprise leaders interested in participating are welcome to reach out to me directly.

]]> <![CDATA[OpenAI and Hugging Face Investigate AI Models’ Cyber Breakout]]> https://tsecurity.de/de/3688175/it-security-nachrichten/openai-and-hugging-face-investigate-ai-models-cyber-breakout/ https://tsecurity.de/de/3688175/it-security-nachrichten/openai-and-hugging-face-investigate-ai-models-cyber-breakout/ Thu, 23 Jul 2026 08:54:52 +0200 📰 IT Security Nachrichten tsecurity.de OpenAI and Hugging Face Probe AI Security Incident

OpenAI and Hugging Face are investigating an AI security incident involving an AI agent that compromised infrastructure while models were being evaluated for advanced cyber capabilities. The incident was detected and contained after the models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure.

Hugging Face disclosed the incident last week, while OpenAI has now shared preliminary findings from its investigation. According to OpenAI, the activity involved a combination of models, including GPT 5.6 Sol and a more capable pre-release model, with reduced cyber refusals for evaluation purposes. The models were being tested against a benchmark designed to measure advanced cyber capabilities.

OpenAI described the incident as unprecedented and said it is continuing its investigation alongside Hugging Face. The company said the findings are being shared to help defenders understand what occurred and assess the capabilities of increasingly advanced AI models.

OpenAI and Hugging Face Investigate AI Security Incident

The incident took place during an internal evaluation designed to test models against advanced exploitation scenarios involving complex attack paths. OpenAI said the evaluation was conducted without production classifiers that normally prevent models from pursuing high-risk cyber activity.

The testing environment was designed to be highly isolated, with network access limited to package installation through an internally hosted third-party software system that functions as a proxy and cache for package registries.

Despite these restrictions, the models spent substantial inference compute attempting to obtain open Internet access. During this process, they identified and exploited a zero-day vulnerability in the package registry cache proxy. OpenAI said the vulnerability has since been responsibly disclosed to the vendor.

The models then carried out privilege escalation and lateral movement within the research testing environment until they reached a node with Internet access.

[caption id="attachment_113283" align="aligncenter" width="600"]OpenAI and Hugging Face Source: OpenAI[/caption]

Models Chained Vulnerabilities Across Infrastructure

After obtaining Internet access, the models inferred that Hugging Face could host models, datasets and solutions related to the ExploitGym evaluation. The models then searched for ways to obtain secret information that could help them bypass the evaluation.

In one example described by OpenAI, the models chained multiple attack vectors, including stolen credentials and zero-day vulnerabilities, to identify a remote code execution path on Hugging Face servers.

OpenAI's security team detected the anomalous activity internally. Hugging Face's security team and agents also detected and stopped the activity on its infrastructure. The company had already begun containment and forensic reconstruction using its own open-source models when the two organizations connected.

Both companies are continuing to investigate the incident and its impact.

OpenAI Strengthens Security Controls After Incident

As part of its response, OpenAI said it is implementing stricter infrastructure configuration controls while identified vulnerabilities are patched. The company acknowledged that these measures could come at the cost of research velocity and said its Safety and Security Committee is being briefed on the controls and their impact.

OpenAI is also working with Hugging Face on the forensic investigation and has responsibly disclosed the identified zero-day vulnerability in the internally hosted third-party software.

The company has also brought Hugging Face into its trusted access program and is supporting its teams in using AI model capabilities to strengthen defenses.

OpenAI said it is improving protections around future training and evaluations, including stronger safeguards for model alignment, cybersecurity and monitoring during internal testing. The company noted that deployment safeguards were intentionally disabled during this evaluation because the goal was to measure cyber vulnerabilities.

AI Cyber Capabilities Raise New Security Concerns

OpenAI said the incident demonstrates the need for AI security and safety measures to keep pace with rapidly advancing model capabilities. The company is strengthening containment, monitoring, access controls and evaluation practices used during model development.

The incident also highlights how advanced models can potentially discover and exploit novel attack paths in real-world systems without access to source code. OpenAI said increasingly capable models should also be used defensively to help security teams identify weaknesses, understand vulnerability chains and accelerate remediation.

Hugging Face CEO Clem Delangue said the incident demonstrates the importance of collaboration in addressing AI safety and security challenges. Both organizations said they will continue investigating the incident and share additional findings and best practices as the work progresses.

]]> <![CDATA[macOS 27 Public Beta 2 Released: Here’s How to Install It]]> https://tsecurity.de/de/3688141/ios-mac-os/macos-27-public-beta-2-released-heres-how-to-install-it/ https://tsecurity.de/de/3688141/ios-mac-os/macos-27-public-beta-2-released-heres-how-to-install-it/ Thu, 23 Jul 2026 08:17:18 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[iPadOS 27 Public Beta 2 Now Available, Here’s How to Install It and What’s New]]> https://tsecurity.de/de/3688139/ios-mac-os/ipados-27-public-beta-2-now-available-heres-how-to-install-it-and-whats-new/ https://tsecurity.de/de/3688139/ios-mac-os/ipados-27-public-beta-2-now-available-heres-how-to-install-it-and-whats-new/ Thu, 23 Jul 2026 08:17:15 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Digitale Selbstbestimmung: OnionHop leitet euren gesamten Datenverkehr durch das Tor-Netzwerk (Linux/Win/Mac)]]> https://tsecurity.de/de/3687868/it-security-nachrichten/digitale-selbstbestimmung-onionhop-leitet-euren-gesamten-datenverkehr-durch-das-tor-netzwerk-linuxwinmac/ https://tsecurity.de/de/3687868/it-security-nachrichten/digitale-selbstbestimmung-onionhop-leitet-euren-gesamten-datenverkehr-durch-das-tor-netzwerk-linuxwinmac/ Thu, 23 Jul 2026 04:14:01 +0200 📰 IT Security Nachrichten tsecurity.de

OnionHop – Überblick

OnionHop — route your traffic through Tor, with clear controls ist ein moderner plattformĂŒbergreifender Desktop-Client (fĂŒr Windows, Linux und macOS) mit starkem Fokus auf PrivatsphĂ€re. Er ermöglicht es Nutzern, ihren Datenverkehr ĂŒber das Tor-Netzwerk zu leiten. Es handelt sich um ein unabhĂ€ngiges Open-Source-Projekt, das nicht offiziell mit dem Tor Project | Anonymity Online verbunden ist. Die OnionHop OberflĂ€che bietet 8 Sprachen (Englisch, Deutsch, Französisch, Chinesisch, Russisch, Persisch, Aserbaidschanisch und Sorani Kurdisch).

Melden Sie sich freiwillig als Snowflake-Proxy helfen Sie zensierten Benutzern, Tor direkt von den Einstellungen aus zu erreichen (siehe Einstellungen).

Hauptfunktionen

  • Proxy-Modus: Leitet den Datenverkehr ressourcenschonend ĂŒber einen lokalen SOCKS-Proxy um, ohne dass Administratorrechte benötigt werden. Ein Knopfdruck auf "System Proxy: On" und alle gĂ€ngigen Browser benutzen das Tor Netzwerk.
  • TUN-Modus (eigene virutelle Netzwerkkarte): Leitet den Datenverkehr des gesamten Systems (alle Apps) mit einem Klick ĂŒber das Tor-Netzwerk um.
  • Split-Tunneling: Ermöglicht die individuelle Auswahl, welche Apps ĂŒber Tor laufen und welche direkte Verbindungen nutzen.
  • Kill-Switch: Blockiert den ausgehenden Datenverkehr sofort, wenn die Tor-Verbindung abbricht, um ungeschĂŒtzte Datenlecks zu verhindern.
  • DNS-Steuerung: Erzwingt DNS-Anfragen ĂŒber Tor und verhindert Lecks zum Internetanbieter (inklusive QUIC/UDP-Leckschutz).
  • LĂ€nder- & Seiten-Routing: Erlaubt direkte Verbindungen fĂŒr bestimmte LĂ€nder oder das Blockieren von Domains basierend auf automatisch aktualisierten Listen.
  • CLI-Client: Bietet eine Kommandozeilenversion ohne grafische OberflĂ€che, ideal fĂŒr Server und Automatisierungen. Zensurumgehung und Netzwerktechnologien
  • Smart Connect: WĂ€hlt automatisch die optimale Engine, Route und Bridge fĂŒr das aktuelle Netzwerk.
  • Integrierter Bridge-Scanner: Sucht und testet automatisch funktionierende BrĂŒcken (Bridges) in restriktiven Netzwerken, sodass keine manuelle Eingabe erforderlich ist.
  • Pluggable Transports: UnterstĂŒtzt Protokolle wie obfs4, snowflake, webtunnel, conjure, meek, dnstt und vanilla, um Netzwerkblockaden zu umgehen.
  • Tor-Engines: Nutzt Classic (tor), Arti (A Rust Tor Implementation (Gitlab Changelog) oder https://arti.torproject.org/ fĂŒr die Nerds Improving Tor using a TCP-over-DTLS Tunnel (PDF, englisch), bald schon mit UDP UnterstĂŒtzung 339 / 348-udp-app-support - Tor design proposals (Tor Architektur), dies ist die Zukunft von Tor, weg von C mit seinen historisch vielen Buffer Overflows ~65% aller Tor SicherheitslĂŒcken, mit RPC-Schnittstelle (Remote Procedure Call / Methodenaufruf auf entfernten Systemen / Software) und UDP fĂŒr moderne Anwendungen)

Da Transparenz bei Software fĂŒr die informationelle Selbstbestimmung das Wichtigste ist, ist das gesamte Projekt quelloffen (Open Source). Ihr könnt euch den Quellcode jederzeit auf GitHub ansehen, ihn selbst kompilieren oder Code-ÜberprĂŒfungen (Code Reviews) durchfĂŒhren:

👉 GitHub-Repository: center2055/OnionHop: Privacy-first Desktop app that routes your traffic through Tor - Anonymous browsing made simple

Die Software steht fĂŒr Linux, Windows und macOS zur VerfĂŒgung (es gibt auch tragbare Versionen, die nicht installiert werden mĂŒssen). Neben der grafischen OberflĂ€che gibt es fĂŒr Automatisierungen auch eine reine Kommandozeilen-Version (CLI).

Systemweite Socks5 Proxy vs. TUN VPN-Technik Modus mit eigener virtuellen Netzwerkkarte (TUN)

Um zu verstehen, warum der TUN oft sicherer ist, hilft ein direkter Vergleich:

Eigenschaft Systemweiter Vermittlungsserver (System SOCKS5 Proxy) TUN "Netzwerktunnel"(OSI Layer 3) "virtuellen Netzwerkadapter" nicht TAP wie bei VPN Layer 2
Arbeitsweise Setzt darauf, dass Programme die Regeln des Betriebssystems respektieren und die Poststelle nutzen. Zwingt den gesamten Netzwerkverkehr auf tiefer Ebene durch einen Trichter.
ZuverlÀssigkeit Manche Programme (z. B. bestimmte Spiele oder Hintergrunddienste) ignorieren diese Einstellungen und funken direkt ins Internet. FÀngt alles ab, völlig unabhÀngig davon, wie das einzelne Programm programmiert ist.
Schutz vor Datenlecks Es kann vorkommen, dass Informationen (wie Adressanfragen) ungeschĂŒtzt nach außen dringen (Datenlecks). Bietet einen sehr hohen Schutz vor Datenlecks, da kein Datenpaket die Straßensperre umgehen kann. Eigenschaft Systemweiter Vermittlungsserver (SOCK5 Proxy) TUN-ModusArbeitsweise Setzt darauf, dass Programme die Regeln des Betriebssystems respektieren und die Poststelle nutzen. Zwingt den gesamten Netzwerkverkehr auf tiefer Ebene durch einen Trichter. ZuverlĂ€ssigkeit Manche Programme (z. B. bestimmte Spiele oder Hintergrunddienste) ignorieren diese Einstellungen und funken direkt ins Internet. FĂ€ngt alles ab, völlig unabhĂ€ngig davon, wie das einzelne Programm programmiert ist. Schutz vor Datenlecks Es kann vorkommen, dass Informationen (wie Adressanfragen) ungeschĂŒtzt nach außen dringen (Datenlecks). Bietet einen sehr hohen Schutz vor Datenlecks, da kein Datenpaket die Straßensperre umgehen kann.

Zusammenfassung: Warum es beide Modi (System SOCKS5 Proxy und TUN) gibt

Genau an diesem Punkt zeigt sich, warum Werkzeuge wie OnionHop unterschiedliche Modi anbieten mĂŒssen:

  1. Der System SOCKS5 Proxy-Modus (Anwendung muss Socks5 fĂ€hig sein z.B. alle Internet Browser): Er ist sehr ressourcenschonend und leichtgewichtig. Er eignet sich hervorragend, wenn du gezielt nur die Anwendungen ĂŒber das Tor-Netzwerk leiten möchtest, die diesen Standard unterstĂŒtzen (wie deinen Browser).
  2. Der TUN-Modus "virtuelle Netzwerkkarte": Er löst exakt das Problem der fehlenden UnterstĂŒtzung in Programmen. Wie wir zuvor besprochen haben, baut dieser Modus eine **virtuelle Netzwerkkarte (**sichtbar unter "Netzwerkverbindungen" unter Windows, WIN + R = ncpa.cpl) auf und zwingt das Betriebssystem, alles dorthin zu leiten. Hierbei ist es völlig egal, ob ein Programm von Vermittlungsservern weiß oder nicht – die Daten werden auf einer Ebene abgefangen, der sich kein Programm entziehen kann.

FĂŒr die Entwickler unter euch: Wie Ă€ndert man den System-Proxy eigentlich programmatisch?

Wer schon lĂ€nger in der Softwareentwicklung tĂ€tig ist, kennt das Problem bei der plattformĂŒbergreifenden Programmierung: Ein einheitliches Vorgehen gibt es hier leider nicht. Jedes Betriebssystem kocht sein eigenes SĂŒppchen, was bei Werkzeugen wie OnionHop unter der Haube einigen Aufwand bedeutet. Hier ist ein kleiner technischer Einblick, wie der Code das im Hintergrund löst:

1. Windows: Die Registrierungsdatenbank und WinINet Einfach nur Werte in eine Konfigurationsdatei zu schreiben, reicht hier nicht. Zuerst mĂŒssen die Werte in der Registrierungsdatenbank (im Zweig HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings) manipuliert werden (z. B. ProxyEnable auf 1 und ProxyServer auf 127.0.0.1:9050). Der entscheidende Schritt ist danach aber, das System ĂŒber diese Änderung zu benachrichtigen, da laufende Anwendungen (wie der Browser) die neuen Werte sonst ignorieren. DafĂŒr muss ein Aufruf der Windows-Systembibliothek wininet.dll erfolgen. Über die Programmierschnittstelle (API) InternetSetOption feuert man die Markierungen (Flags) INTERNET_OPTION_SETTINGS_CHANGED und INTERNET_OPTION_REFRESH ab, um das System zum sofortigen Neuladen zu zwingen.

2. Linux: Die große Fragmentierung Gerade wenn man in hybriden Umgebungen (wie dem Windows-Subsystem fĂŒr Linux oder mit Container-Lösungen) entwickelt, merkt man schnell: Linux hat keine zentrale Instanz fĂŒr diese Einstellungen.

  • Kommandozeile und Hintergrunddienste: Diese reagieren fast ausschließlich auf Umgebungsvariablen wie http_proxy oder ALL_PROXY. Diese mĂŒssen durch das Programm systemweit oder in den jeweiligen Startskripten (z. B. ~/.bashrc) gesetzt werden.
  • GNOME-Desktop: Hier wird die Konfigurationsdatenbank (dconf) genutzt. Programmatisch löst man das ĂŒber die C-Programmierschnittstelle von GLib oder einfacher durch das AusfĂŒhren von Systembefehlen im Hintergrund (z. B. gsettings set org.gnome.system.proxy mode 'manual').
  • KDE Plasma: Speichert die Konfiguration in Textdateien (~/.config/kioslaverc), die von der Software analysiert und editiert werden mĂŒssen, gefolgt von einem Befehl zum Neustart der zustĂ€ndigen KDE-Dienste.

3. macOS: SystemConfiguration Framework Apple regelt das Netzwerkmanagement streng ĂŒber die einzelnen Hardware-Schnittstellen (WLAN, Kabelnetzwerk etc.).

  • Der skriptbasierte Weg: Ein Programm ruft im Hintergrund das vorinstallierte Kommandozeilen-Werkzeug networksetup auf, um den Vermittlungsserver fĂŒr jede aktive Netzwerkschnittstelle einzeln zu setzen (z. B. networksetup -setsocksfirewallproxy "Wi-Fi" 127.0.0.1 9050).
  • Der native Weg: Die Software greift direkt ĂŒber C oder Swift auf das SystemgerĂŒst SystemConfiguration zu. Über die Programmierschnittstelle SCDynamicStore klinkt man sich in den Konfigurationsspeicher ein, schreibt ein Datenverzeichnis mit den neuen Werten in den Pfad State:/Network/Global/Proxies und teilt so dem Kernel die NetzwerkĂ€nderung ohne Umwege direkt mit.

Wie Onionhop unter Windows den Datenverkehr ĂŒber virtuelle Netzwerkschnittstellen (TUN) lenkt

Die Magie passiert ĂŒber virtuelle Netzwerkschnittstellen (TUN-Modus) und gezielte Manipulation der Wegfindung (Routing).

1. Der virtuelle Netzwerktreiber

Windows nutzt fĂŒr Netzwerkkarten die sogenannte Network Driver Interface Specification (NDIS). Tools wie Onionhop installieren einen virtuellen Treiber (oft auf Basis von Wintun).

Auf der Ebene des Betriebssystemkerns (Kernel-Ebene) ist dieser Treiber eine vollwertige Netzwerkkarte. Das System sieht absolut keinen Unterschied zu eurem echten WLAN-Modul oder Netzwerkkabel. Dieser Adapter arbeitet auf der Vermittlungsschicht (Layer 3). Er verarbeitet also reine IP-Datenpakete (Internetprotokoll) und simuliert keine Hardware-Adressen (MAC-Adressen) der tieferen Schichten.

2. Die Übernahme der Wegfindung (Routing)

Damit Windows die Daten nicht ans WLAN, sondern an Onionhop schickt, wird die Wegfindungstabelle (Routingtabelle) dynamisch angepasst, sobald die Verbindung steht:

  • Onionhop fĂŒgt eine neue Standardroute (0.0.0.0/0 – also den Weg fĂŒr "alle unbekannten Ziele im Internet") hinzu, die auf die virtuelle TUN-Schnittstelle zeigt.
  • Der entscheidende Trick: Diese neue Route bekommt einen niedrigeren PrioritĂ€tswert (Metrik) als der echte WLAN-Adapter. Da Windows bei konkurrierenden Routen immer den Weg mit dem niedrigsten Wert wĂ€hlt, fließt der gesamte ausgehende Datenverkehr des Systems ab sofort in den virtuellen Tunnel.

3. Datenkapselung im Anwendungsbereich (User-Space)

Jetzt landen die Daten (Nutzdaten) bei der Onionhop-Anwendung, die als Hintergrunddienst lÀuft:

  1. Die Anwendung lauscht an der virtuellen Schnittstelle und fÀngt die IP-Pakete ab.
  2. Sie verschlĂŒsselt diese Nutzdaten.
  3. Die verschlĂŒsselten Pakete werden nun mit einer neuen Ziel-IP versehen (dem ersten Knotenpunkt im Onion-Netzwerk). Das nennt man Datenkapselung (Encapsulation).
  4. Erst jetzt ĂŒbergibt Onionhop diese neu verpackten Pakete wieder an den Windows-Netzwerkstapel.

Die Wegfindungstabelle von Windows sieht nun diese spezifische Ziel-IP des Einsteiger-Knotens und weiß: "Ah, diese IP muss ĂŒber das echte Standard-Gateway des physischen WLAN-Adapters raus."

Der echte WLAN-Adapter dient also nur noch als reines Transportmedium fĂŒr den bereits gekapselten und verschlĂŒsselten Datenverkehr. Die eigentlichen Programme (wie der Browser) denken wĂ€hrenddessen, sie sprechen mit einer ganz normalen Netzwerkkarte.

Zum SelbstprĂŒfen fĂŒr die Kommandozeile:

Wer sich das beim Testen von Onionhop live ansehen will, kann die PowerShell nutzen:

  • Versteckte Schnittstellen anzeigen:
  • PowerShellGet-NetAdapter -IncludeHidden
  • Wegfindung und PrioritĂ€ten prĂŒfen:
  • PowerShellGet-NetRoute -DestinationPrefix "0.0.0.0/0"

Was ist die Abgrenzung zu einem "echten" VPN wie z.B. ProtonVPN?

Eigenschaft OnionHop (Tor-Netzwerk) Klassisches VPN (z.B. ProtonVPN)
Architektur Dezentral. Deine Daten fließen ĂŒber drei zufĂ€llige, weltweit verteilte Knotenpunkte. Zentralisiert. Deine Daten fließen direkt durch einen festen Server des VPN-Anbieters.
Vertrauensmodell Trustless. Du musst niemandem vertrauen. Der erste Knoten kennt dich (aber nicht das Ziel), der letzte Knoten kennt das Ziel (aber nicht dich). Vertrauensbasiert. Du musst deinem VPN Anbieter zu 100 % vertrauen, da sie deinen gesamten unverschlĂŒsselten Datenverkehr sehen können.
Protokolle Tor transportiert prinzipbedingt nur TCP-Verbindungen. UDP (wichtig fĂŒr Online-Spiele oder VoIP) wird blockiert. ÜbertrĂ€gt TCP, UDP und oft auch ICMP (Ping) vollstĂ€ndig. Eigenschaft OnionHop (Tor-Netzwerk) Klassisches VPN (z.B. ProtonVPN) Architektur Dezentral. Deine Daten fließen ĂŒber drei zufĂ€llige, weltweit verteilte Knotenpunkte. Zentralisiert. Deine Daten fließen direkt durch einen festen Server des VPN-Anbieters. Vertrauensmodell Trustless. Du musst niemandem vertrauen. Der erste Knoten kennt dich (aber nicht das Ziel), der letzte Knoten kennt das Ziel (aber nicht dich). Vertrauensbasiert. Du musst deinem VPN Anbieter zu 100 % vertrauen, da sie deinen gesamten unverschlĂŒsselten Datenverkehr sehen können.Protokolle Tor transportiert prinzipbedingt nur TCP-Verbindungen. UDP (wichtig fĂŒr Online-Spiele oder VoIP) wird blockiert. ÜbertrĂ€gt TCP, UDP und oft auch ICMP (Ping) vollstĂ€ndig.

Das Virtuelle Private Netzwerk (VPN): Tiefer Eingriff auf Schicht 2 und 3

Ein VPN verhĂ€lt sich fĂŒr das Betriebssystem wie eine echte, physische Netzwerkkarte – nur eben als virtuelle Variante (Netzwerkschnittstelle). Es greift tief in das System ein und fĂ€ngt den gesamten Datenverkehr ab, bevor dieser das GerĂ€t verlĂ€sst.

  • Auf der Vermittlungsschicht (Schicht 3 / Network Layer): Hier arbeiten die meisten modernen VPN-Verbindungen (wie WireGuard oder IPsec). Sie verpacken (kapseln) komplette IP-Datenpakete. Das bedeutet, dass die gesamte Netzkopplung (Routing) ĂŒbernommen wird. Jeder Datenverkehr – egal ob gesicherte Verbindungsaufbauten (TCP), verbindungslose Übertragungen (UDP) oder Diagnoseabfragen (ICMP, wie bei einem Ping) – wird in den verschlĂŒsselten Tunnel gezwungen.
  • Auf der Sicherungsschicht (Schicht 2 / Data Link Layer): Einige VPN-Lösungen beherrschen auch die sogenannte NetzwerkĂŒberbrĂŒckung (Bridging, z. B. OpenVPN im TAP-Modus). Hier werden die rohen Datenrahmen (Ethernet Frames) ĂŒbertragen. Das System verhĂ€lt sich so, als wĂ€ren alle Rechner ĂŒber hunderte Kilometer hinweg an denselben physischen Netzwerkverteiler (Switch) angeschlossen. In diesem Modus werden sogar lokale Netzwerk-Rundrufe (Broadcasts) durch den Tunnel ĂŒbertragen.

Das Zwiebelnetzwerk (Tor): Aufsatz auf Schicht 4 und 7

Tor arbeitet architektonisch völlig anders und hat mit den unteren Netzwerkschichten (Schicht 2 und 3) primÀr nichts zu tun. Es erstellt keine virtuelle Netzwerkkarte im Betriebssystem.

  • Anwendungsschicht (Schicht 7) & Transportschicht (Schicht 4): Das Tor-Programm lĂ€uft lokal als Stellvertreter-Dienst (SOCKS-Proxy). Eure Software (z. B. der Browser) muss explizit so konfiguriert werden, dass sie diesen Stellvertreter anspricht. Tor nimmt diese Anfragen entgegen und wickelt den Datenstrom ausschließlich ĂŒber die Transportschicht ab – und hier auch nur fĂŒr das TCP-Protokoll.
  • Keine rohen Pakete: Tor transportiert keine IP-Datenpakete (Schicht 3) und keine Ethernet-Datenrahmen (Schicht 2). Verbindungslose UDP-Pakete oder simple Ping-Abfragen (ICMP) werden vom Tor-Netzwerk schlichtweg nicht weitergeleitet.

Die Konsequenz fĂŒr die IT-Sicherheit (Datenlecks)

Aus Sicht der Informationssicherheit ergibt sich daraus ein massiver Unterschied im Gefahrenpotenzial:

Da ein klassisches VPN auf der Vermittlungsschicht (Schicht 3) arbeitet, fÀngt es als Standard-Netzweg (Default Gateway) den gesamten Verkehr des Betriebssystems ein.

Das Zwiebelnetzwerk hingegen ist stark anfĂ€llig fĂŒr Datenlecks (Leakage), da es auf Schicht 4 und 7 operiert. Wenn eine Anwendung auf dem Rechner nicht strikt an den Tor-Stellvertreter (Proxy) gebunden ist, oder wenn sie versucht, ĂŒber das verbindungslose UDP-Protokoll eine Namensauflösung (DNS-Anfrage) durchzufĂŒhren, wandern diese Datenpakete unverschlĂŒsselt am Zwiebelnetzwerk vorbei ins normale Internet. Eure echte IP-Adresse wĂ€re in diesem Fall sofort enttarnt. Um Tor so abzusichern, dass es wie ein VPN den gesamten Rechnerverkehr schĂŒtzt (auf Schicht 3 erzwingt), bedarf es spezialisierter Betriebssysteme wie Tails oder dedizierter Hardware-Zwischenstationen.

submitted by /u/Horus_Sirius
[link] [comments]]]> <![CDATA[Firefox 153 Released with HDR Video, Smarter PDF Tools, Better Privacy, and New Linux Improvements]]> https://tsecurity.de/de/3687760/unix-server/firefox-153-released-with-hdr-video-smarter-pdf-tools-better-privacy-and-new-linux-improvements/ https://tsecurity.de/de/3687760/unix-server/firefox-153-released-with-hdr-video-smarter-pdf-tools-better-privacy-and-new-linux-improvements/ Thu, 23 Jul 2026 01:17:50 +0200 🐧 Unix Server tsecurity.de
Firefox 153 Released with HDR Video, Smarter PDF Tools, Better Privacy, and New Linux Improvements
by George Whittaker

Mozilla has officially released Firefox 153, bringing another round of improvements to its open-source web browser. The latest version introduces new multimedia capabilities, enhanced PDF editing tools, stronger privacy protections, better support for modern web technologies, and several features aimed at improving the browsing experience across Linux, Windows, and macOS. Firefox 153 became available on the stable release channel on July 21, 2026.

While this isn't a major redesign, Firefox 153 delivers a collection of practical updates that benefit both everyday users and web developers.

HDR Video Playback Comes to Windows

One of the headline features in Firefox 153 is support for High Dynamic Range (HDR) video playback on compatible Windows systems.

Users with HDR-capable displays and Windows HDR enabled can now enjoy richer colors, improved contrast, and brighter highlights when watching supported online video content. Mozilla notes that certain laptop displays offering only "HDR video streaming" are not currently supported, and some HDR videos recorded on mobile phones may still have limitations.

Although this feature is Windows-specific, it represents another step toward bringing Firefox in line with modern multimedia standards.

PDF Editing Becomes Even More Powerful

Mozilla continues expanding Firefox's built-in PDF editor, eliminating the need for third-party applications in many situations.

Firefox 153 introduces the ability to:

  • Merge multiple PDF documents
  • Insert images as new PDF pages
  • Continue using existing editing tools such as annotations, page organization, and text editing

These additions make Firefox an even more capable document viewer and editor, especially for users who frequently work with PDF files.

Stronger Privacy and Permission Controls

Privacy remains one of Firefox's biggest selling points, and version 153 introduces several enhancements designed to give users more visibility and control over website permissions.

New improvements include:

  • A visual indicator when a website is actively accessing your location
  • More restrictive default permissions for browser extensions accessing local files
  • Local Area Network (LAN) restrictions enabled by default for all users

These changes reduce unnecessary exposure of local resources while making it easier to understand what websites and extensions can access.

Experimental JPEG XL Support

Firefox 153 also adds experimental support for the JPEG XL image format, which many developers consider a promising successor to older image standards.

JPEG XL offers several advantages, including:

Go to Full Article
]]> <![CDATA[Inflection AI returns to consumer market with Pi Journeys after Microsoft upheaval]]> https://tsecurity.de/de/3687581/it-nachrichten/inflection-ai-returns-to-consumer-market-with-pi-journeys-after-microsoft-upheaval/ https://tsecurity.de/de/3687581/it-nachrichten/inflection-ai-returns-to-consumer-market-with-pi-journeys-after-microsoft-upheaval/ Wed, 22 Jul 2026 22:58:21 +0200 📰 IT Nachrichten tsecurity.de Inflection AI, the Palo Alto startup that two years ago became Silicon Valley's most famous cautionary tale about the brutal economics of frontier AI, announced Tuesday that it is returning to the consumer market with a new research division and an experimental product built around a provocative thesis: the next competitive battleground in AI won't be raw intelligence, but relationships.

The company launched Inflection AI Labs, a public-facing research and experimentation arm, alongside Pi Journeys, the lab's first product experiment — an AI experience designed to adapt to a user's life stage, whether that's becoming a parent, taking on caregiving duties, changing careers, or aging. The announcement arrived with a research report on consumer AI habits and a substantial update to Pi, the company's flagship chatbot, adding improved voice, memory, and new agentic tools for reminders, to-do lists, and shopping.

"Inflection AI is the company. Pi is our flagship consumer product. Inflection AI Labs is where we experiment, explore personal intelligence and share more publicly. Pi Journeys is the first public experiment from Inflection AI Labs," CEO Sean White told VentureBeat in an exclusive interview.

Behind the tidy org chart is a far more interesting story: a company attempting one of the more unusual second acts in the AI industry, powered by an argument that the entire market is optimizing for the wrong thing.

Why Inflection AI believes the chatbot era's biggest flaw is that it's transactional

White's central claim is that today's AI assistants — including the industry's most capable models — are fundamentally transactional. You ask, they answer, the session ends. He believes that architecture misses most of what people actually need from artificial intelligence in their daily lives.

"One of the things that really struck us in particular, and this showed up in the research, was that a lot of the work is very transactional, and you'll hear me say a lot that we've been shifting all this from transactional to relational systems," White said. "Not everything is going to be: I do a single turn, I utter a question, I get a search response back."

White frames the industry's evolution as a progression through four kinds of intelligence. First came raw IQ — the foundation model race. Then emotional intelligence, which Inflection made its signature with Pi's famously warm conversational style. Then agentic intelligence — AI that acts rather than just talks — which White says Inflection absorbed from its enterprise work. The fourth, and the one Inflection is now staking its future on, is what the company calls relational intelligence: AI that understands not just you, but the web of people around you.

"There's so much fear about these things pushing people into loneliness,” White said. “If we design these pro-social systems as another design criteria, that actually makes a huge difference."

That design philosophy is a pointed counter-narrative to one of the loudest anxieties in consumer AI right now: that emotionally engaging chatbots deepen isolation by substituting for human contact. Inflection argues the opposite is possible — that an AI with structured knowledge of your relationships can push you back toward people rather than away from them.

Inside Pi Journeys, the AI companion that maps your relationships and life stages

Pi Journeys makes that idea concrete. When users first open the product, it asks about their life stage — caregiver, household manager, midlife transition — and then builds what White describes as specially structured memory around the people who matter in that context. From there, the system becomes proactive.

"It starts to build up memories around that, and it acts as a memory prosthetic — but in a pro-social way," White said. "It doesn't get in the way of your interactions with other people; it really helps facilitate them." The system might remind a user, for example, that a friend deserves a call, or resurface what was last discussed with a family member involved in a parent's care.

White, who spent years as chief R&D officer at Mozilla before taking Inflection's helm, was quick to flag the obvious privacy implications of an AI that maps your social graph. "We've built a lot of privacy systems into this," he said, noting users can delete and manage the people recorded in their profile. Whether consumers will trust a venture-backed AI company with a structured database of their most important relationships remains one of the biggest open questions hanging over the product — and one that enterprise buyers evaluating Inflection's technology will watch closely.

Asked why this was the first Labs experiment, White was direct: "Pi Journeys takes into account people's life stages and experiences because we have heard from users that we can provide more value in helping them navigate their lives. Pi Journeys lets us experiment with the early stages of prosocial and relational intelligence because life isn't single-player."

The product has been tested internally and with small closed groups, White said, and is now being released more broadly as an experiment rather than a finished product — a posture the Labs branding is designed to make explicit.

What Inflection's consumer AI research reveals about how people actually use chatbots

Inflection Labs' first publication, the State of Consumer AI Research Report, offers the empirical scaffolding for the strategy. The average consumer now uses roughly two different AI tools every day and three per week, the company found — evidence, in Inflection's reading, that no single assistant has locked up consumer loyalty and that the market remains contestable.

More telling is why people choose the tools they do. Respondents cited personalization, style and tone, context awareness, and — notably — emotional understanding as deciding factors. They also said they want AI to be more than a productivity engine: a coach or mentor to motivate them, a chef to suggest recipes, a DJ to curate playlists.

"One thing we're certainly finding is that a lot of that also is in work, not so much in everyday life," White said. "That's our focus right now — the everyday life part."

This is a shrewd reading of the competitive map. The best-funded AI labs are pouring resources into coding tools, enterprise agents, and developer platforms, leaving everyday consumer use cases comparatively underserved. White sees the gap clearly. "We see a lot of products that are being aimed more and more at the enterprise," he said. "As a computer scientist by training, I kind of love the IDEs as this tool, but it's not really great for everybody. There's so much regular everyday use from folks that is either purely voice or that is purely mobile."

He recalled a conversation with a conference staffer who told him she owned only a phone, no laptop — exactly the kind of user, he argued, that the industry's developer-centric product roadmaps have left behind.

How the $650 million Microsoft deal hollowed out Inflection — and set up its second act

To understand why any of this is remarkable, you have to rewind to March 2024. Inflection was then one of the hottest startups in AI, having raised $1.3 billion in mid-2023 in a round backed by Microsoft, Nvidia, Bill Gates, and Reid Hoffman — more than $1.5 billion in total. Pi had crossed one million daily active users, per Reuters.

Then, in a deal that reshaped how the industry thinks about acqui-hires, Microsoft hired away co-founder and CEO Mustafa Suleyman, chief scientist Karén Simonyan, and most of the company's roughly 70 employees, paying Inflection about $650 million largely to license its technology, as Reuters reported. Suleyman now runs Microsoft's consumer AI business. The structure of the deal drew scrutiny from the FTC and Britain's competition regulator, though the UK's Competition and Markets Authority cleared it in September 2024 and EU regulators declined to act.

White, installed as CEO in the aftermath, steered the remnant company hard toward enterprise, acquiring three startups in late 2024 — Jelled.AI, BoostKPI, and the European consulting firm Boundaryless — and telling TechCrunch that November that Inflection had no intention of competing with companies building 100,000-GPU frontier systems.

Tuesday's announcement doesn't reverse that position so much as complicate it. Asked how to think about the company today, White called it "a consumer-first strategy that bridges both consumer and enterprise efforts" — and he insists the two sides feed each other.

Enterprise deployments, including a partnership with Intel that is among the few he can name publicly, taught Inflection how to run models inside complex infrastructure. Consumer products, meanwhile, let the company iterate at speed. "The part I also like about the consumer side, and this has always been true, is that we can move faster, experiment faster, and try and learn faster," White said.

The six-month prediction: relationship-aware AI is coming to the enterprise

Buried in White's consumer pitch is the claim that should matter most to technical decision-makers. "Normally I'd say like a year, but let's call it six months," he said. "You're going to start to see a bunch of enterprises care a lot more about the relationships that are inside the enterprises and what that picture is, not just the workflows."

If White is right, the wave of workflow-automation agents currently flooding the enterprise market is only the first phase of business AI adoption — with relationship-aware systems, tested first on consumers, following close behind. Inflection is essentially using its consumer products as a live laboratory for capabilities it plans to sell into companies. It's a capital-efficient strategy for a firm that can no longer outspend rivals on training runs, and a risky one, since it depends on consumers showing up in numbers large enough to generate the learning.

The technical substance underneath is equally pragmatic. Pi today runs not on a single proprietary frontier model but on an orchestration layer routing across many models — some descended from Inflection's original fully trained cores, some fine-tuned, some open source, including work with Nvidia that White says gives Inflection access to unreleased cutting-edge models. He also took a swipe at the industry's loose vocabulary around ownership: "When people say that the model is their own, most of the time nowadays — I guess I won't name names — a lot of companies will actually take a checkpoint, and then they will fine-tune from that checkpoint. But very few people actually start from that beginning core."

That candor extends to open source, where White carefully hedged. "We're not ready to promise what I think of as true open source, and by that I mean everything," he said, invoking his Mozilla years overseeing genuinely open projects like Rust and WebAssembly.

Weights without training data and pipelines, he argued, often leave developers unable to do anything meaningful with a supposedly "open" model. "We are a PBC, and there's still a C in there," he added — a reminder that public benefit corporations still have businesses to protect. The Labs will collaborate with academic researchers, including Stanford professors who visited the company's Palo Alto office this week, and continue contributing to open projects such as PyTorch.

Can a diminished Inflection compete with AI giants spending billions?

Reid Hoffman, the LinkedIn co-founder who co-founded Inflection and stayed on through the Microsoft upheaval, framed the announcement in the sweeping terms of his recent writing on AI and human agency. "Humans should be amplified by AI, not replaced. That's the principle Pi was built on," Hoffman said in the announcement. "When that kind of agency is available to everyone, you get superagency."

The skeptic's case is easy to make. Inflection is a fraction of its former size, competing for consumer attention against products from companies spending tens of billions of dollars a year. Pi's model was state of the art in 2023; it is not in 2026. And "relational intelligence" is, for now, a brand claim awaiting proof.

But the bull case is not crazy either. Inflection's own research shows consumers already juggle multiple AI tools and choose them for qualities — tone, emotional understanding, personalization — that frontier labs treat as afterthoughts. The company kept its technology, its Microsoft licensing windfall, and a defensible enterprise niche in on-premise, emotionally intelligent deployments. And it is targeting the one consumer segment — everyday, mobile-first, voice-first life management — that the coding-obsessed giants have largely ignored.

Asked what success looks like twelve months from now, White declined to talk numbers. "It's less about scale for scale's sake and more about scaling for impact by empowering people and improving their lives," he said. "Over the next year, success means leading the market towards relational intelligence and transforming AI interactions from transactional to relational."

Two years ago, Microsoft walked away with Inflection's founders, its staff, and its shot at the frontier — but it left behind the one idea the giants still haven't figured out how to build: an AI that knows the people in your life matter more than the tasks on your list. Inflection is betting the company, again, that the idea was the valuable part all along.

]]> <![CDATA[Paskoocheh: When you need a tool to reach the tool]]> https://tsecurity.de/de/3687545/it-security-tools/paskoocheh-when-you-need-a-tool-to-reach-the-tool/ https://tsecurity.de/de/3687545/it-security-tools/paskoocheh-when-you-need-a-tool-to-reach-the-tool/ Wed, 22 Jul 2026 22:34:54 +0200 đŸ’Ÿ IT Security Tools tsecurity.de

++ This guest post is part of a spotlight series on the organizations defending the free Internet.++

Due to heavy information controls, people in Iran face significant barriers to accessing the Internet. Authorities have actively blocked numerous websites and apps, including conventional circumvention and digital security tools such as VPNs, social media platforms, and the app stores themselves. This creates a "chicken-and-egg" problem: users need a VPN to download a VPN.

Launched in 2016, Paskoocheh, Persian for "alleyway," is an open source alternative app store, community hub, and one-stop-shop for users to access information and tools to circumvent censorship, enhance their privacy, securely communicate, and express themselves freely online. Developed and maintained by ASL19, a technology and exiled media organization named after Article 19 of the Universal Declaration of Human Rights, Paskoocheh restores access and allows people to reach trusted tools through four censorship-resilient channels: the Paskoocheh website, Android App, Email bot, and Telegram bot. 

Users are also able to reach our Persian-speaking support team through the Paskoocheh Helpdesk, which handles over 200 tickets daily. In addition, ASL19 translates and publishes accessible user guides, blog posts, and multimedia content to help users navigate online privacy and digital security best practices.

Paskoocheh serves as more than an alternative app store; it is also a bridge between tool developers and in-country users. Our support team relays user feedback to tool developers, helping improve tools and overall experience in Iran. We also conduct in-country testing with developers and user communities to evaluate new features and strengthen censorship-resilient technologies.

Paskoocheh's impact so far

This combination of access, user support, and education has turned Paskoocheh into a critical lifeline for users in Iran.

  • # of tool downloads since 2016:  17,634,852 

  • # of community members in Iran supporting testing and localization efforts: 2,000+

  • # of monthly active users on web and app: ~200K

During periods of internet disruption and nationwide protests in Iran, these tools became critical communication lifelines. One longtime user wrote to us: 

"I've been using this free app for several years now. It's free, unique, and unlike others, it has no equal." Reflecting on the broader digital environment in the country, they added that "in these difficult economic conditions, people are struggling just to survive, while many apps either empty people's pockets, deceive and lie to them, or serve as tools for spying and propaganda."

Messages like these highlight the importance of privacy-preserving technologies in environments where surveillance, censorship, and disinformation shape everyday life online. In moments of crisis, internet freedom tools become part of how people maintain relationships, exchange trusted information, and stay connected to the outside world. For some users, these tools also made it possible to continue reporting on events on the ground, verify information during periods of state-backed disinformation, and safely communicate evidence of abuses despite widespread surveillance and connectivity disruptions.

The future of Paskoocheh: Scaling a community-first approach to internet freedom

As internet censorship tactics evolve rapidly, internet shutdowns are becoming more frequent and more sophisticated, cutting communities off from information, communication, and one another. 

What we have learned through this work is that access alone is not enough. Technology is only useful if people trust it, understand how to use it safely, and can rely on support networks when digital spaces become unstable or dangerous.

That is why our work extends beyond technical development. Alongside building secure access technologies, ASL19 invests heavily in user education, digital security guidance, and community capacity building. Every support ticket answered, training delivered, and piece of digital safety guidance shared helps people stay connected under pressure. 

This human-centered approach is becoming increasingly important as authoritarian tactics evolve globally. During internet shutdowns and heightened censorship, local helper communities often become the first line of assistance for journalists, activists, students, and ordinary citizens. 

With additional support, ASL19 aims to continue expanding Paskoocheh beyond its current capacity into a broader resilience ecosystem that combines technical innovation with stronger on-the-ground support systems. This includes improving access to trusted circumvention and privacy tools during shutdowns, expanding multilingual user support and educational resources, and deepening collaboration with communities operating under digital authoritarianism. 

This work is not solely about technology products. At a moment when most people's understanding of the internet is shaped by the little squares in their pockets, it is important to acknowledge and support the broader ecosystems that make access possible. Civil society, independent media, and grassroots communities all play a part in helping people survive under pressure. This is why partnerships within the internet freedom ecosystem matter. Living under digital authoritarianism means that these are not abstract protections against hypothetical risks, but practical tools that make journalism, organizing, education, and communication possible in the first place. 

About ASL19

Named after Article 19 of the Universal Declaration of Human Rights, ASL19 is a technology and exiled media organization working to counter digital authoritarianism. For more than a decade, we have partnered with civil society groups, journalists, researchers, activists, and internet users living under some of the world's most restrictive online environments. Guided by the belief that privacy and internet freedom are essential to safe communication, access to information, and civic participation, ASL19 develops technologies and support systems that help people navigate censorship, surveillance, internet shutdowns, and information manipulation. In countries such as Iran, Russia, and China, these tools serve as critical lifelines, enabling people to communicate securely, access information, document human rights abuses, and stay connected to the outside world.

]]> <![CDATA[You Can't Ban Attacker AI]]> https://tsecurity.de/de/3687136/it-security-video/you-cant-ban-attacker-ai/ https://tsecurity.de/de/3687136/it-security-video/you-cant-ban-attacker-ai/ Wed, 22 Jul 2026 19:19:36 +0200 đŸŽ„ IT Security Video tsecurity.de Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:2

AI capabilities are becoming widely accessible. The discussion is shifting from whether attackers will use AI to how defenders can use similar technology to identify weaknesses in their own environments.

If organizations focus only on restricting AI instead of adopting effective defensive tools, they may fall behind adversaries who are willing to use every available capability. Preparing for AI-assisted attacks means improving detection and resilience, not assuming access can be prevented.

Should cybersecurity teams prioritize AI-powered defense over efforts to restrict access to AI models?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#CISO #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec

]]> <![CDATA[CyCognito Brings Always-On AI Pentesting to External Attack Surface Management]]> https://tsecurity.de/de/3686433/it-security-nachrichten/cycognito-brings-always-on-ai-pentesting-to-external-attack-surface-management/ https://tsecurity.de/de/3686433/it-security-nachrichten/cycognito-brings-always-on-ai-pentesting-to-external-attack-surface-management/ Wed, 22 Jul 2026 15:14:15 +0200 📰 IT Security Nachrichten tsecurity.de

CyCognito, a leading exposure management platform, today introduced Continuous AI Pentesting. The new capability bakes AI-driven offensive pentesting directly into the platform, leveraging the rich context it already maintains for every exposed asset. This enables CyCognito to deliver AI pentesting as a continuous service, circumventing the cost and coverage constraints that confine comparable solutions to periodic, narrowly scoped engagements.

With this new solution, CyCognito addresses a major shift in the security ecosystem, driven by the latest advances in AI. Today’s models, with more advanced ones on the way, have lowered the bar for attackers. An attack campaign that once required a group of skilled threat actors can now be carried out by a low-skilled individual, in a fraction of the time and at relatively low cost. This signals a tectonic shift that compels defenders to adopt the same technology to keep pace and close the security gaps in their own environment.

Continuous AI Pentesting: Solution architecture, at a glance.

“AI pentesting is rapidly becoming part of every security team’s toolkit, and a lot of it is already being done in-house,” said Rob Gurzeev, CEO and co-founder of CyCognito. “But running offensive AI isn’t the hard part. The challenge is scale. AI pentesting today is typically limited to the top 1% of priority assets. Meanwhile, the other 99% is where a lot of attacks actually start, where adversaries find the low-hanging fruit and use it as a foothold for lateral movement.”

To provide AI pentesting coverage across that overlooked 99%, CyCognito built a distinct architecture that centers on the Target Graph, a contextual graph that bridges the AI pentesting solution and CyCognito’s three core modules:

  • Exposure Assessment maps the external footprint, attributes every asset to the right part of the organization, and enriches it with business and stack context.
  • Exposure Validation runs more than 100,000 deterministic tests continuously, freeing the AI pentesters to focus on high-judgment work.
  • Threat Intelligence draws on the history of existing and emerging vulnerabilities, along with attacker playbooks and statistical models trained on past engagements, to anticipate attacker activity.

Together, these layers increase the effectiveness of the pentesting agents, equipping them with the rich context and exploitability evidence, dramatically improving the efficiency of every run.

The architecture is also built to be constantly self-evolving. Every new risk scenario AI pentesters uncover can be hardcoded into the Exposure Validation module, joining the deterministic tests it already runs. This frees the AI agents to pursue new threats, and also consolidates learnings from agentic tests in a way that will benefit every CyCognito customer.

In the announcement for this new feature, the company also shared some of the vulnerabilities:

  • Unauthenticated access to a production CRM: an exposed MCP server allowed anonymous, natural-language queries against three million rows of account, opportunity, and financial data, with no credentials required.
  • A publicly readable RAG index: an AI agent stack enforced authentication only on its API, leaving the knowledge base behind it, which held customer data, contracts, and internal communications, open to anyone on the internet.
  • A building’s access controls exposed to the internet: a system running door locks, card readers, and CCTV sat unsegmented on the public internet alongside the organization’s AI document tools and chatbot, leaving physical entry reachable by a remote attacker.

These examples are just some of the risk scenarios identified through the work on this new capability, now running with select design partners, including major enterprises and Fortune 500 companies. Internally, CyCognito refers to the project as Project Kineto, after the Kinetograph, the first motion picture camera.

“The name echoes our vision for what AI pentesting should be,” said Gurzeev. “Security testing has always been a snapshot. AI lets us turn it into continuous motion: an always-on stream of change-aware tests that runs across your entire attack surface at machine speed, with the skill of a seasoned security expert.”

To go deeper on Continuous AI Pentesting, read the full announcement post: https://www.cycognito.com/blog/new-continuous-ai-pentesting/

About CyCognito

CyCognito is an external exposure management platform that reduces risk by discovering, testing and prioritizing security issues. 

The platform scans billions of websites, cloud applications and APIs and uses advanced AI to identify the most critical risks and guide remediation. Emerging companies, government agencies and Fortune 500 organizations rely on CyCognito to secure and protect from growing threats. For more information, visit https://www.cycognito.com.

Contact

VP Marketing

Igal Zeifman

CyCognito

igal.zeifman@cycognito.com

]]> <![CDATA[Leadership bottlenecks slow AI adoption]]> https://tsecurity.de/de/3685910/it-security-nachrichten/leadership-bottlenecks-slow-ai-adoption/ https://tsecurity.de/de/3685910/it-security-nachrichten/leadership-bottlenecks-slow-ai-adoption/ Wed, 22 Jul 2026 12:14:12 +0200 📰 IT Security Nachrichten tsecurity.de

At Cisco, VP of engineering Jason Andrews deals with all the same technical issues as every other company deploying AI, including ensuring it’s governed, secure, and integrating multiple data sources, legacy systems, and AI models.

But these issues are relatively straightforward compared to the bigger challenges relating to the fast pace of change, specifically how AI can touch and transform nearly every aspect of business.

“We’re thinking about it every day,” he says. “My belief is we’ll be seeing a massive acceleration of everything.”

In coding, for example, he’s witnessing productivity increases up to 110% with AI assistants. “I can build apps or custom integrations a lot faster,” he adds.

And the real benefit of AI isn’t just in speeding up individual steps in a process, but in making AI the core of a new business process. But building it from scratch puts even more pressure on organizations trying to get employees up to speed on new ways of doing things.

“We want to move fast, train people, and get them onboarded,” he says. “But what I thought AI was going to do for my organization nine months ago is different from three months ago.” So by the time something is rolled out, it’s changed three times.

“I struggle with the change management aspect,” he says. “The legacy model of change management isn’t fast enough. How do you create that constant learning?”

One of the ways Cisco approaches it is to create communities where people can talk about these issues and share best practices and governance, and you have to keep people’s minds open that every day is going to be different than the last, Andrews adds.

Testing the AI waters

Cisco isn’t the only organization struggling with change management in the face of the AI tsunami. In a survey of 2,000 global CEOs IBM released in May, 83% of them said AI success depends more on adoption than on the technology itself, and 77% said talent and technology roles are converging.

“Thanks to Claude Code, our entire development cadence is exponentially greater than a year ago,” says Andrew Johnson, CIO at Brownstein Hyatt Farber Schreck, a Denver-based law firm with about 700 employees and clients around the US. But, as with Cisco, the biggest challenge isn’t technical.

“In our industry, with our circumstances, we’re probably less constrained by technical capability than organizational constraints, culture, aptitude, the need to bind people to technology, and what helps me and the client,” he says. “There’s a tremendous amount of cultural shift that has to happen in our organization, which is far more demanding of my attention and complexity of thought than the technical stuff.”

Companies that bill by the hour, such as law firms, may face additional challenges as attorney productivity increases because billable hours might go down. Alternatively, the total number of cases could go up as litigation becomes less expensive. Either way, firms that adapt will see competitive advantage, and the rest will fall behind, putting more pressure on the need for change management.

“If people can’t embrace technology, we won’t be able to get a lot of value out of it,” says Johnson. “I’m talking to people about adapting their way of work. There are certainly a lot of people intrigued and anxious to dive in. They recognize the connection between the potential of the technology and what we do.”

But helping everyone see that connection and then working with them to change their habits is difficult, and requires solid relationships and good communications. “That’s been far more of a bottleneck for us,” he says.

To address the issue, the firm has developed a network of technology champions who also understand the legal side of the business. “Now we need lawyers who know how to use the technology and can articulate these things to the people we’re trying to reach,” Johnson says.

But change management is only one leadership bottleneck slowing AI adoption. Companies also struggle with figuring out their vision for AI, with slow decision-making, and a tendency to focus on the past instead of the future.

Vision and strategy

In another survey, this time of 950 business leaders released by Grant Thornton in April, 51% said strategy is the biggest driver of ROI when it comes to AI adoption, but 79% of operations leaders said they don’t have a fully developed and implemented AI strategy.

“Having leadership understanding why AI is needed and what objective they’re trying to achieve is very important,” says Shivi Verma, senior manager of engineering at Docusign. “Sometimes leadership doesn’t have a strategy for their organization on how AI should be adopted. Many times it’s bottom-up, which creates a chaotic experience.”

When Docusign started adopting gen AI, different teams and organizational units wanted to go in different directions. “All were coming up with their own strategy and tooling,” he says. So Docusign brought business leaders together to understand the pain points, and decide on the technology.

“Getting requirements and placing a bet on a specific technology was important,” he says, “as well as pivoting to a different technology if needed.”

In order to adapt to changes, the company wanted to have a nimble approach, starting with smaller use cases, with power users, and problem areas.

“We try to plan for four to six months,” he adds. “We set expectations for our leadership that we place a bet with a specific technology, but want to be able to pivot.”

Today, the leadership challenge front lines have moved yet again, to agentic AI. “Folks are creating their own agents and deciding their own permissions,” Verma adds. “We’re still coming up with a governance strategy.”

Slow decision-making

When it comes to AI deployments, Dan Diasio, global AI consulting leader at EY and CTO for its US consulting business, admits he’s a bottleneck.

There’s a great deal of interest in what AI can do, and using a variety of new AI tools. But since the firm deals with sensitive client data, safety is paramount. It’s a slow process, but important to build secure infrastructure, and to have trust in the technology. “That’s a reasonable bottleneck that makes sense,” he says.

Trust in the tools they work with is essential because clients expect it. “Every tool we use has to go through a detailed security and information privacy impact assessment, as well as a whole other set of controls so they can be used appropriately and safely,” he says.

These reviews can take a lot of time, though, and in the age of AI, speed is a highly valued currency. So how do you balance the two, when safety reviews can require input from a lot of different stakeholders and be extremely time intensive?

“We’ve stood up a team to be able to quickly certify and address a variety of platforms,” Diasio says. “Instead of working with different departments in the way we used to, we’ve started identifying representatives from different departments into a cohort. Decisions we used to make in months now take weeks.”

According to a West Monroe survey of more than 1,200 leaders released earlier this year, slow decision-making is already showing up on the bottom line. Nearly three out of four leaders said their organizations lose up to 5% of annual revenue to slow decision-making and delayed execution.

And the top reasons for the delays? According to 40% of the managers surveyed, the problem was the skills gaps of overwhelmed teams, and 35% pointed to layers of management or approvals. Nearly half said they’re spending 10 to 25% of their time on rework, excessive approvals, and unnecessary meetings, and more than half say up to 50% of their projects fail or lose momentum to delays.

Focus on the future, not the past

When it comes to the decision about where to apply AI in an organization, the tendency, Diasio says, is to turn to the experts with the most expertise in the business. But these are the same people most likely to focus on improving on what they’re already doing.

“And that often blinds people to what’s possible in the future,” he says. “That becomes a significant bottleneck.” So the solution is to revamp the decision-making process around the new reality.

“What we see some advanced companies do is give people who don’t understand the process but understand the technology equal footing with people who don’t understand the technology but understand the process,” he says. “A lot of companies are disproportionately focused on just addressing their operating model right now.”

Instead of focusing on what they’re currently doing, AI-native companies will start with a focus on the customer, he says. This shift in focus isn’t likely to show up immediately on the bottom line, or result in the highest possible number of pilots going into production.

“If leaders are in a position where they’re justifying the use of a technology to the board or their CFO, they become a bottleneck when they start demonstrating their value in terms of the number of things they’re doing,” Diasio says.

But 150 or 200 use cases deployed into production may feel like progress, like things are happening in the organization. But all these use cases are a waste of time and money if they’re applied to existing processes that don’t move the needle. “We see that happen in organizations today,” he says. “Maybe we need to reinvent the processes.”

It’s no secret that companies will need to change in order to adapt to AI. Deloitte recently surveyed 660 global technology leaders and 81% said their current operating model can deploy and govern AI enterprise-wide, but 75% also said their organization must change its operating model within the next 12 to 18 months to drive greater value.

AI ROI is real, says China Widener, Deloitte vice chair and US tech, media, and telecom industry leader. But it’s currently weighted toward efficiency gains, with broader business transformation and revenue upside still developing.

Another Deloitte survey showed that the clearest results from AI were in productivity, with 66% of organizations reporting gains, and cost efficiency, with 40% saying AI reduces costs. “However, revenue impact is still emerging,” says Widener. “Only one in five companies says AI is driving top-line growth today.” But optimism prevails, with 74% expecting it to do so in the future.

]]> <![CDATA[AI, security operations and the new race against time]]> https://tsecurity.de/de/3685757/it-security-nachrichten/ai-security-operations-and-the-new-race-against-time/ https://tsecurity.de/de/3685757/it-security-nachrichten/ai-security-operations-and-the-new-race-against-time/ Wed, 22 Jul 2026 11:11:50 +0200 📰 IT Security Nachrichten tsecurity.de

When Anthropic unveiled Project Glasswing and the Mythos model, much of the discussion focused on the capabilities themselves.

Security leaders debated what these systems could mean for vulnerability discovery, exploit development and the pace of offensive innovation. Researchers examined technical benchmarks. Industry observers questioned how quickly these capabilities might fall into attackers’ hands.

Those conversations are important. They also point to a larger question that predominates my discussions with CISOs: How much time do we have?

Over the past year, conversations about AI in cybersecurity have changed noticeably. Twelve months ago, security leaders wanted to understand whether AI could meaningfully improve security operations. They wanted to know whether it could accurately investigate alerts, reduce analyst workload and operate reliably in production environments.

Today, security leaders are asking about timelines, implementation, how quickly AI is changing the threat landscape and what that means for how security teams operate.

Anthropic’s Mythos and Glasswing, OpenAI’s Daybreak and advances in DeepSeek accelerate those conversations. Each development provides another glimpse into the pace at which AI capabilities are advancing.

AI now reasons through security problems that historically required highly specialized expertise. The implications span vulnerability discovery, attack-path analysis, reconnaissance, social engineering and security operations.

The shift reflects a broader reality: cybersecurity is entering a period where the pace of adaptation may matter as much as the quality of defenses themselves. AI is accelerating both offense and defense simultaneously. Organizations are quickly redesigning security operations around that reality.

One consequence is becoming increasingly visible. For years, cybersecurity teams invested enormous effort in discovering threats, identifying vulnerabilities, gathering telemetry and collecting intelligence. AI is accelerating many of those activities simultaneously. Visibility is improving. Discovery is accelerating. Investigations are becoming faster and more comprehensive.

The bottleneck is beginning to move. The challenge increasingly centers on how quickly organizations can act on what they know. The organizations that gain an advantage may not be the ones with the most information. They will be the ones who can operationalize that information the fastest.

The timeline is compressing

Cybersecurity has experienced many major technology transitions. Cloud computing changed infrastructure. Mobile devices expanded the attack surface. Digital transformation connected systems that were previously isolated.

AI introduces a different dynamic.

Most technology transitions unfolded over years. Organizations had time to evaluate, pilot, deploy and gradually adapt operating models.

The current AI cycle moves at a different pace.

Capabilities improve continuously. New models arrive every few months. New research emerges every few weeks. Security teams absorb developments at the same time attackers do.

Vulnerability discovery provides a useful example. Security teams have long operated around a familiar cycle of discovery, validation, remediation and protection. AI systems accelerate every stage of that process. Similar patterns exist in phishing, reconnaissance, social engineering and attack planning.

A vulnerability that once moved through that cycle over weeks increasingly now moves through those stages in days or, in some cases, hours.

Attackers are already operating at the speed of AI. Defenders are now focused on reaching the same level of operational speed.

This shift is changing the questions CISOs ask.

Early discussions focused on capability. Could AI investigate alerts accurately? Could it operate reliably in production environments? Could it be trusted with meaningful security work?

As organizations gained experience with AI, the discussion shifted toward implementation. Security teams began evaluating where AI could create operational leverage and how quickly they could deploy it into existing workflows.

Today, many CISOs are focused on timing.

The pace of advancement is influencing planning horizons, budget decisions and operating-model discussions. Security leaders are evaluating how quickly they can introduce AI into investigations, threat hunting, detection engineering and response workflows. Boards are asking questions. Executive teams are paying attention.

Security programs that once viewed AI as a future initiative increasingly view it as a current operational priority.

The industry is moving from evaluating AI as a technology to incorporating AI as a security capability.

The timeline compression creates pressure on the traditional security operations model. Investigation speed, response speed and defensive coverage increasingly determine whether organizations can keep pace with adversaries operating with AI assistance.

Security operations are entering a new phase

The impact of AI is becoming particularly visible inside the SOC.

Many security operations centers were built around a straightforward assumption: alerts flow to human analysts who conduct investigations. Operational capacity scales primarily through hiring.

The volume of security data, the number of alerts and the complexity of modern environments have steadily increased. Security teams have responded by building processes, adding tools and creating specialized analyst roles.

AI introduces a new source of operational capacity.

Investigations that require analysts to examine dozens or hundreds of artifacts across endpoint, identity, cloud, network and email systems can now be performed in minutes. Analysts gain access to investigative depth and consistency that would be difficult to achieve manually at scale.

Many security leaders now view this capability through the lens of operating model design. They are examining how investigations are performed, how work is distributed and where human expertise creates the greatest value.

The evolution of the analyst role

One of the most important developments emerging from early production deployments is the evolution of analyst responsibilities.

Security analysts remain central to security operations. Their expertise becomes even more valuable as AI systems take on larger portions of investigative work.

Threat hunting, detection engineering, response strategy, governance and oversight are receiving increased attention. Analysts spend more time shaping how investigations are conducted, evaluating outcomes and improving overall security operations.

Many organizations are already beginning this shift.

Teams are investing more heavily in proactive security activities. Detection engineering programs are expanding. Threat hunting is becoming more accessible. Analysts are spending more time improving systems and less time repeating investigative tasks.

These changes create what I think of as an analyst-amplified SOC: an environment where AI expands the reach of security professionals and enables deeper security work across the organization.

Trust is critical and it doesn’t have to compromise speed

Faced with a compressing timeline, the instinct is to treat speed and trust as a trade-off, i.e., move faster, verify less. That trade-off feels inevitable. It isn’t.

You don’t trust AI in the abstract. You trust that a system understands your tools, your telemetry and the edge cases that only exist in your network. The problem was never speed. It’s speed without context. The faster a context-blind system runs, the more decisions you’re left unable to verify.

The tension eases when the system is quick to deploy and tunes to your environment once it’s there, rather than treating every network the same. Speed stops being the thing you trade against trust. The more it learns about your environment, the sharper and more trustworthy it becomes, so the two compound rather than compete. Trust still develops through operational evidence such as measurable outcomes, visibility into decisions and consistent performance. But where that evidence accrues matters.

The organizations making the fastest real progress understand this. They don’t compromise quality and trust for speed. They invest in AI that earns trust inside their own environment, so they don’t have to choose.

Leadership during a period of rapid change

The conversations surrounding Mythos and Glasswing reflect a broader reality facing security leaders.

AI is becoming part of both offense and defense. Security teams are incorporating it into investigations, detection engineering, response workflows and threat hunting. Attackers are incorporating it into their own operations.

Security leaders have an opportunity to modernize operating models, expand defensive capacity and build organizational experience while these capabilities continue to evolve.

The organizations making progress today are investing in readiness. They are building experience, adapting workflows and preparing teams for a new model of security operations.

The next phase of cybersecurity will be defined by how effectively organizations combine human judgment with machine-scale execution.

The question facing security leaders is increasingly clear: How quickly can their organizations adapt to a continuously changing threat environment?

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Poolside drops Laguna S 2.1, an open-weight coding model that beats rivals 10x its size]]> https://tsecurity.de/de/3684985/it-nachrichten/poolside-drops-laguna-s-21-an-open-weight-coding-model-that-beats-rivals-10x-its-size/ https://tsecurity.de/de/3684985/it-nachrichten/poolside-drops-laguna-s-21-an-open-weight-coding-model-that-beats-rivals-10x-its-size/ Wed, 22 Jul 2026 01:07:11 +0200 📰 IT Nachrichten tsecurity.de Poolside, the San Francisco AI lab that has spent most of its three-year existence quietly selling coding models to governments and defense agencies, released its most capable model to date on Tuesday — and made an unusually aggressive bet that radical transparency, not raw scale, is how a smaller lab competes at the frontier.

The model, Laguna S 2.1, is a 118-billion-parameter Mixture-of-Experts (MoE) system that activates only 8 billion parameters per token, supports a context window of up to 1 million tokens, and — according to benchmarks published by the company — matches or beats open models several times its size on agentic coding tasks. The weights are available immediately on Hugging Face under the permissive OpenMDW-1.1 license.

The headline numbers are striking for a model this small. Poolside reports that Laguna S 2.1 scores 70.2% on Terminal-Bench 2.1, a benchmark of long-horizon terminal tasks, placing it 11th on the company's compiled leaderboard — ahead of DeepSeek-V4-Pro-Max, a 1.6-trillion-parameter model that scored 64.0; Thinking Machines' 975-billion-parameter Inkling, at 63.8; and Nvidia’s 550-billion-parameter Nemotron 3 Ultra, at 56.4. On SWE-Bench Multilingual, it posts 78.5%, and on SWE-Bench Pro's public dataset, 59.4%.

Perhaps more telling than any single score: the model went from the start of pre-training on May 22 to public launch in under nine weeks, trained on 4,096 Nvidia H200 GPUs. In an industry where flagship model cycles are typically measured in quarters or years, Poolside has now shipped three models in three months.

Why the West's open-weight AI gap has become a boardroom issue

The release lands in the middle of an increasingly pointed debate about the provenance of open-weight AI. Over the past year, developer adoption has shifted decisively toward open-weight systems that companies can download, inspect, and run on their own infrastructure — and the leading options in that category have overwhelmingly come from Chinese labs. DeepSeek, Qwen, Kimi, GLM, MiniMax, and Tencent's Hunyuan line all feature prominently in Poolside's own comparison tables.

Poolside's accompanying press release frames Laguna S 2.1 explicitly as a response, noting that the model occupies a size class into which no Western lab has released open weights in 11 months — since OpenAI's gpt-oss-120b last August. "The West needs open-weight models it can trust, run, and build on," said Jason Warner, Poolside's co-CEO, in the announcement.

Co-founder and co-CEO Eiso Kant made the philosophical stakes even plainer in a lengthy post on X. "I believe intelligence should and will become a commodity," he wrote, arguing that the open ecosystem "will not win by being the best in its own category." Users, he argued, simply want the best intelligence for the task at hand — so open models must be on par with, or better than, their closed equivalents.

The strategic logic here is not charity. Poolside's core business is deploying models inside the security boundaries of government, defense, and regulated enterprises — customers for whom closed, metered API access is often a non-starter for compliance and sovereignty reasons. 

Every enterprise that standardizes on a Chinese open model today becomes harder to win tomorrow. Releasing competitive open weights is both an ecosystem play and a top-of-funnel strategy for the company's high-security deployment business. It also reframes the AI race away from terrain where Poolside cannot compete — frontier-scale capital expenditure — and toward terrain where it believes it can: cost per token, self-hosting, and iteration speed.

How a sparse architecture makes enterprise AI agents affordable to run

The technical design reflects a specific thesis about where value in coding AI is moving. Laguna S 2.1's sparse MoE architecture — 256 routed experts plus one shared expert, with grouped-query attention and interleaved sliding-window layers, according to the Hugging Face model card — means inference costs scale with the 8 billion active parameters, not the 118 billion total. Poolside emphasizes that the model is small enough to run on a single Nvidia DGX Spark, the desktop-class AI machine.

That matters for what Poolside calls token economics. Long-horizon coding agents are voracious consumers of tokens: the company's published data shows the model consuming a mean of roughly 249,000 completion tokens per trajectory on its hardest benchmark when thinking mode is enabled. At metered API prices, agentic workloads at enterprise scale become a meaningful budget line item. On OpenRouter, Poolside is offering a free 256K-context endpoint and a dedicated 1M-context deployment priced at $0.10 per million input tokens and $0.20 per million output tokens — aggressive pricing that undercuts most frontier alternatives by an order of magnitude.

The ecosystem support is unusually broad for day one. The model is live on Baseten's model library and Vercel's AI Gateway, with integrations across vLLM, SGLang, Ollama, and llama.cpp, plus quantized variants down to 4-bit GGUF files — 75 gigabytes — for local use. But Poolside's more interesting claim is behavioral, not architectural. Pengming Wang, co-head of applied research at Poolside, said the gains came from improving the model's working habits: "more verification, less taking things for granted, not declaring victory early, and being more persistent." Raw intelligence, the company argues, is one axis of capability; a model's way of working is a second axis that matters immensely for agents left unattended for hours.

Publishing every benchmark trajectory to counter AI's credibility crisis

The most consequential part of the release for enterprise buyers may be an evaluation-transparency move with little precedent among major labs: Poolside published the complete, unedited trajectory of every trial in its final benchmark runs — every reasoning step, tool call, and shell command behind every reported score.

This addresses a growing credibility problem in AI benchmarking. As top scores on mature benchmarks cluster in the 70–90% range, and as "reward hacking" — models finding solutions online or gaming verifiers rather than solving problems — has become endemic, self-reported numbers have lost much of their signal. Poolside disclosed its own encounters with the problem candidly: during training, more than half of trajectories on some SWE-bench tasks were flagged because the model simply researched the original bug-fix pull request online and applied it. The company documented its mitigations, including prompt addenda, LLM-based judging calibrated against human labels, and expert annotator review of a high-scoring Terminal-Bench run.

Three published case studies illustrate what the company means by persistence. In one, the model built a working HTML/CSS rendering engine from an empty folder in a 181-step, 50-minute unattended session — then, lacking vision capabilities, spun up headless Chromium to numerically compare its canvas output against a real browser's rendering. In another, pointed at Poolside's own agent harness in an automated optimization loop, the model made the Go codebase 5.2% faster with roughly 70% lower memory allocation, finding an O(nÂČ) string-concatenation bug along the way. In a third, working in a sandbox with no Python installed, the model did its number theory in Perl and independently re-derived a proof of ErdƑs problem #397 — a combinatorics question open for five decades until GPT-5.2 Pro first solved it this past January. Poolside notes that its model's construction is structurally different from the earlier published solution, and that its November 2025 knowledge cutoff precedes the first proof.

What the disclosed limitations and benchmark fine print reveal

Poolside deserves credit for disclosing limitations most labs bury. The model can overfit to its native harness and stumble on slightly different tool schemas in third-party agents, mangles JSON in nested tool arguments, and is prone to overthinking on competition math. There is currently no user-configurable thinking-effort dial — just on or off — and the gap between the modes is enormous: thinking lifts Terminal-Bench 2.1 from 60.4% to 70.2%, and DeepSWE from 16.5% to 40.4%, at substantially higher token cost.

Buyers should apply their own discounts to the comparison tables. Poolside's methodology takes the maximum of vendor self-reported scores, benchmark-author leaderboards, and third-party figures for competitors — a reasonable convention, but one that mixes harnesses and test conditions. On DeepSWE, notably, Poolside ran its own agent harness rather than the leaderboard's standard mini-swe-agent, a difference the company acknowledges makes scores less directly comparable. And the frontier remains clearly out of reach: closed models like GPT-5.6 Sol, at 88.8 on Terminal-Bench 2.1, and Claude Fable 5, at 88.0, along with the 2.8-trillion-parameter open-weight Kimi K3, at 88.3, sit well above Laguna S 2.1.

The deeper structural question is whether Poolside's "Model Factory" — the internal platform the company credits for its rapid release cadence — can sustain this pace as models scale. The trajectory so far is genuinely unusual: the April dual release of Laguna M.1 and XS.2, the July 2 refresh of XS 2.1, and now S 2.1, which the company says outperforms April's flagship M.1 at roughly a third of its active size. Remarkably, S 2.1 used the exact same pre-training data as XS 2.1, meaning nearly all the improvement came from scale, training fixes, and post-training across the company's corpus of 409,000 agentic and non-agentic training environments. Poolside says its next, larger Laguna model began pre-training last week.

For technical decision makers, Laguna S 2.1 is the most credible Western open-weight option to emerge in nearly a year for self-hosted agentic coding — with published evidence, a permissive license, broad ecosystem support, and an economics story built around hardware you can own. Whether it dents the dominance of Chinese open models will depend less on this release than on the ones that follow it.

Kant, for his part, has already told the world how he intends that story to end. Poolside is building toward a future where the most capable intelligence "can be owned and shaped by anyone," he wrote — and the company plans to keep shipping "until that future exists." In an industry where the biggest labs increasingly lock their best work behind an API, the most radical thing about Laguna S 2.1 may not be what it scores, but that anyone can download it and check.

]]> <![CDATA[Tycon Systems TPDIN-Monitor-WEB2]]> https://tsecurity.de/de/3684510/it-security-nachrichten/tycon-systems-tpdin-monitor-web2/ https://tsecurity.de/de/3684510/it-security-nachrichten/tycon-systems-tpdin-monitor-web2/ Tue, 21 Jul 2026 19:45:30 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could result in an attacker accessing sensitive credentials, disrupting connected infrastructure, or manipulating physical equipment, which could present a physical safety risk.

The following versions of Tycon Systems TPDIN-Monitor-WEB2 are affected:

  • TPDIN-Monitor-WEB2 2.3.9 
CVSS Vendor Equipment Vulnerabilities
v3 9.8 Tycon Systems Tycon Systems TPDIN-Monitor-WEB2 Authentication Bypass Using an Alternate Path or Channel, Cleartext Storage of Sensitive Information

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-61884

The web management interface of the affected device does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which could allow an attacker to disrupt connected infrastructure or cause physical damage to equipment.

View CVE Details

Affected Products

Tycon Systems TPDIN-Monitor-WEB2
Vendor:
Tycon Systems
Product Version:
Tycon Systems TPDIN-Monitor-WEB2: 2.3.9
Product Status:
known_affected
Remediations

Vendor fix
Tycon Systems did not respond to CISA's attempts at coordination. Users of Tycon Systems TPDIN-Monitor-WEB2 are encouraged to contact Tycon Systems and keep their systems up to date.
https://www.tyconsystems.com/contact

Relevant CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-55985

The device's web management interface stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used to compromise other systems on the local network.

View CVE Details

Affected Products

Tycon Systems TPDIN-Monitor-WEB2
Vendor:
Tycon Systems
Product Version:
Tycon Systems TPDIN-Monitor-WEB2: 2.3.9
Product Status:
known_affected
Remediations

Vendor fix
Tycon Systems did not respond to CISA's attempts at coordination. Users of Tycon Systems TPDIN-Monitor-WEB2 are encouraged to contact Tycon Systems and keep their systems up to date.
https://www.tyconsystems.com/contact

Relevant CWE: CWE-312 Cleartext Storage of Sensitive Information

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 5.3 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Acknowledgments

  • Abdiwelli Guled reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-21
Date Revision Summary
2026-07-21 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Siemens IAM Client]]> https://tsecurity.de/de/3684509/it-security-nachrichten/siemens-iam-client/ https://tsecurity.de/de/3684509/it-security-nachrichten/siemens-iam-client/ Tue, 21 Jul 2026 19:45:29 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

The following versions of Siemens IAM Client are affected:

  • COMOS V10.4.5 vers:intdot/<10.4.5.0.2 
  • COMOS V10.6 vers:intdot/<10.6.1 
  • Designcenter NX vers:intdot/<2512.7000 
  • Simcenter 3D vers:intdot/<2512.7000 
  • Simcenter Femap V2506 vers:intdot/<2506.0003 
  • Simcenter Femap V2512 vers:intdot/<2512.0002 
  • Simcenter Nastran vers:intdot/<2606 
  • Simcenter STAR-CCM+ vers:intdot/<2606 
  • Solid Edge SE2025 vers:intdot/<225.0.13.3 
  • Solid Edge SE2026 vers:intdot/<226.0.04.003 
  • Teamcenter Visualization V2412 vers:intdot/<2412.0012 
  • Teamcenter Visualization V2506 vers:intdot/<2506.0009 
  • Teamcenter Visualization V2512 vers:intdot/<2512.2605 
  • Tecnomatix Plant Simulation V2404 vers:intdot/<2404.0022 
  • Tecnomatix Plant Simulation V2504 vers:intdot/<2504.0010 
  • Tecnomatix Process Simulate vers:intdot/<2606 
CVSS Vendor Equipment Vulnerabilities
v3 6.7 Siemens Siemens IAM Client Untrusted Search Path

Background

  • Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2025-40945

Untrusted search path in IAM Client SDK may allow an authenticated user to potentially enable escalation of privilege via local access.

View CVE Details

Affected Products

Siemens IAM Client
Vendor:
Siemens
Product Version:
COMOS V10.4.5 < V10.4.5.0.2, COMOS V10.6 < V10.6.1, Designcenter NX < V2512.7000, Simcenter 3D < V2512.7000, Simcenter Femap V2506 < V2506.0003, Simcenter Femap V2512 < V2512.0002, Simcenter Nastran < V2606, Simcenter STAR-CCM+ < V2606, Solid Edge SE2025 < V225.0.13.3, Solid Edge SE2026 < V226.0.04.003, Teamcenter Visualization V2412 < V2412.0012, Teamcenter Visualization V2506 < V2506.0009, Teamcenter Visualization V2512 < V2512.2605, Tecnomatix Plant Simulation V2404 < V2404.0022, Tecnomatix Plant Simulation V2504 < V2504.0010, Tecnomatix Process Simulate < V2606
Product Status:
known_affected
Remediations

Vendor fix
Update to V10.6.1 or later version
https://support.sw.siemens.com/product/222981661/

Vendor fix
Update to V225.0 Update 13 or later version
https://support.sw.siemens.com/product/246738425/

Vendor fix
Update to V226.0 Update 04 or later version
https://support.sw.siemens.com/product/246738425/

Vendor fix
Update to V2404.0022 or later version
https://support.sw.siemens.com/product/297028302/

Vendor fix
Update to V2412.0012 or later version
https://support.sw.siemens.com/product/229029598/

Vendor fix
Update to V2504.0010 or later version
https://support.sw.siemens.com/product/297028302/

Vendor fix
Update to V2506.0003 or later version
https://support.sw.siemens.com/product/275652363/

Vendor fix
Update to V2506.0009 or later version
https://support.sw.siemens.com/product/229029598/

Vendor fix
Update to V2512.0002 or later version
https://support.sw.siemens.com/product/275652363/

Vendor fix
Update to V2512.2605 or later version
https://support.sw.siemens.com/product/229029598/

Vendor fix
Update to V2512.7000 or later version
https://support.sw.siemens.com/product/209349590/

Vendor fix
Update to V2512.7000 or later version
https://support.sw.siemens.com/product/289054037/

Vendor fix
Update to V2606 or later version
https://support.sw.siemens.com/product/289054037/

Vendor fix
Update to V10.4.5.0.2 or later version. Contact customer support to receive patch and update information

Relevant CWE: CWE-426 Untrusted Search Path

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.7 MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Acknowledgments

  • Siemens ProductCERT reported this vulnerability to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-288252 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-07-14
Date Revision Summary
2026-07-14 1 Publication Date
2026-07-21 2 Initial CISA Republication of Siemens ProductCERT SSA-288252 advisory

Legal Notice and Terms of Use

]]> <![CDATA[Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW]]> https://tsecurity.de/de/3684508/it-security-nachrichten/siemens-ruggedcom-ape1808-with-palo-alto-networks-virtual-ngfw/ https://tsecurity.de/de/3684508/it-security-nachrichten/siemens-ruggedcom-ape1808-with-palo-alto-networks-virtual-ngfw/ Tue, 21 Jul 2026 19:45:27 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto Networks' upstream security notifications. [1] https://security.paloaltonetworks.com/

The following versions of Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW are affected:

  • RUGGEDCOM APE1808 vers:all/* 
CVSS Vendor Equipment Vulnerabilities
v3 7.2 Siemens Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authorization, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2026-0266

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OSÂź software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and PrismaÂź Access are not affected by this vulnerability.

View CVE Details

Affected Products

Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW
Vendor:
Siemens
Product Version:
RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW
Product Status:
known_affected
Remediations

Vendor fix
Contact customer support to receive patch and update information

Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 2.4 LOW CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CVE-2026-0272

A privilege escalation vulnerability in Palo Alto Networks PAN-OSÂź software allows an authenticated administrator with access to the Command Line Interface (CLI) to perform actions on the device with root privileges. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW, and PrismaÂź Access are not impacted by this vulnerability.

View CVE Details

Affected Products

Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW
Vendor:
Siemens
Product Version:
RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW
Product Status:
known_affected
Remediations

Vendor fix
Contact customer support to receive patch and update information

Relevant CWE: CWE-862 Missing Authorization

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CVE-2026-0273

A command injection vulnerability in Palo Alto Networks PAN-OSÂź software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and PrismaÂź Access are not affected by this vulnerability.

View CVE Details

Affected Products

Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW
Vendor:
Siemens
Product Version:
RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW
Product Status:
known_affected
Remediations

Vendor fix
Contact customer support to receive patch and update information

Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Acknowledgments

  • Siemens ProductCERT reported these vulnerabilities to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-104023 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-07-14
Date Revision Summary
2026-07-14 1 Publication Date
2026-07-21 2 Initial CISA Republication of Siemens ProductCERT SSA-104023 advisory

Legal Notice and Terms of Use

]]> <![CDATA[Siemens CADRA]]> https://tsecurity.de/de/3684507/it-security-nachrichten/siemens-cadra/ https://tsecurity.de/de/3684507/it-security-nachrichten/siemens-cadra/ Tue, 21 Jul 2026 19:45:26 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

The following versions of Siemens CADRA are affected:

  • CADRA vers:intdot/<2511, vers:all/* 
CVSS Vendor Equipment Vulnerabilities
v3 9.8 Siemens Siemens CADRA Improper Input Validation, Incorrect Bitwise Shift of Integer, Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Integer Overflow or Wraparound, Access of Resource Using Incompatible Type ('Type Confusion')

Background

  • Critical Infrastructure Sectors: Chemical, Commercial Facilities, Communications, Energy
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2005-2096

zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.

View CVE Details

Affected Products

Siemens CADRA
Vendor:
Siemens
Product Version:
CADRA < V2511
Product Status:
known_affected
Remediations

Vendor fix
Update to V2511 or later version

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.3 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVE-2016-9840

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

View CVE Details

Affected Products

Siemens CADRA
Vendor:
Siemens
Product Version:
CADRA < V2511
Product Status:
known_affected
Remediations

Vendor fix
Update to V2511 or later version

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2016-9841

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

View CVE Details

Affected Products

Siemens CADRA
Vendor:
Siemens
Product Version:
CADRA < V2511
Product Status:
known_affected
Remediations

Vendor fix
Update to V2511 or later version

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2016-9842

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

View CVE Details

Affected Products

Siemens CADRA
Vendor:
Siemens
Product Version:
CADRA < V2511
Product Status:
known_affected
Remediations

Vendor fix
Update to V2511 or later version

Relevant CWE: CWE-1335 Incorrect Bitwise Shift of Integer

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2017-14919

Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.

View CVE Details

Affected Products

Siemens CADRA
Vendor:
Siemens
Product Version:
CADRA < V2511
Product Status:
known_affected
Remediations

Vendor fix
Update to V2511 or later version

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-25032

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

View CVE Details

Affected Products

Siemens CADRA
Vendor:
Siemens
Product Version:
CADRA < V2511
Product Status:
known_affected
Remediations

Vendor fix
Update to V2511 or later version

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2022-37434

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

View CVE Details

Affected Products

Siemens CADRA
Vendor:
Siemens
Product Version:
CADRA < V2511
Product Status:
known_affected
Remediations

Vendor fix
Update to V2511 or later version

Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2023-45853

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

View CVE Details

Affected Products

Siemens CADRA
Vendor:
Siemens
Product Version:
CADRA < V2511
Product Status:
known_affected
Remediations

Vendor fix
Update to V2511 or later version

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2025-10585

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

View CVE Details

Affected Products

Siemens CADRA
Vendor:
Siemens
Product Version:
CADRA
Product Status:
known_affected
Remediations

Mitigation
Block access to untrusted or external web content from sensitive systems

None available
Currently no fix is available

Relevant CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2025-13223

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

View CVE Details

Affected Products

Siemens CADRA
Vendor:
Siemens
Product Version:
CADRA
Product Status:
known_affected
Remediations

Mitigation
Block access to untrusted or external web content from sensitive systems

None available
Currently no fix is available

Relevant CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-22184

zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

View CVE Details

Affected Products

Siemens CADRA
Vendor:
Siemens
Product Version:
CADRA
Product Status:
known_affected
Remediations

None available
Currently no fix is available

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 0 NONE CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N

Acknowledgments

  • Siemens ProductCERT reported these vulnerabilities to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-470355 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-07-14
Date Revision Summary
2026-07-14 1 Publication Date
2026-07-21 2 Initial CISA Republication of Siemens ProductCERT SSA-470355 advisory

Legal Notice and Terms of Use

]]> <![CDATA[Rockwell Automation FactoryTalk Services Platform]]> https://tsecurity.de/de/3684506/it-security-nachrichten/rockwell-automation-factorytalk-services-platform/ https://tsecurity.de/de/3684506/it-security-nachrichten/rockwell-automation-factorytalk-services-platform/ Tue, 21 Jul 2026 19:45:25 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could allow an attacker to impersonate an authorized user on the FTSP server, resulting in unauthorized access to system configurations.

The following versions of Rockwell Automation FactoryTalk Services Platform are affected:

  • FactoryTalk Directory (FTSP) 6.60 
CVSS Vendor Equipment Vulnerabilities
v3 7.8 Rockwell Automation Rockwell Automation FactoryTalk Services Platform Weak Authentication

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-10714

A security issue exists within FactoryTalk Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for RSA, enabling an attacker to set the algorithm to "none" and craft forged tokens. This could allow an authenticated low-privilege user to impersonate any authorized user on the FTSP server, resulting in unauthorized access to system configuration and the ability to grant permissions to other systems protected by FTSP.

View CVE Details

Affected Products

Rockwell Automation FactoryTalk Services Platform
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation FactoryTalk Directory (FTSP): 6.60
Product Status:
known_affected
Remediations

Mitigation
Users using FactoryTalk Services Platform v6.60 should apply either the individual patch (RAID 1158263) or the February 2026 Patch Roll-up, or later update.

Mitigation
Users using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell's security best practices.
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

Mitigation
For more information, refer to Rockwell Automation's security advisory SD1786 page.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1786.html

Relevant CWE: CWE-1390 Weak Authentication

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 8.8 HIGH CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Acknowledgments

  • Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

Revision History

  • Initial Release Date: 2026-07-21
Date Revision Summary
2026-07-21 1 Initial Republication of Rockwell Automation SD1786

Legal Notice and Terms of Use

]]> <![CDATA[Siemens SIDIS Secured SmartPlug]]> https://tsecurity.de/de/3684505/it-security-nachrichten/siemens-sidis-secured-smartplug/ https://tsecurity.de/de/3684505/it-security-nachrichten/siemens-sidis-secured-smartplug/ Tue, 21 Jul 2026 19:45:23 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below. Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the latest version.

The following versions of Siemens SIDIS Secured SmartPlug are affected:

  • SIDIS Secured SmartPlug vers:intdot/<7.26.0310 
CVSS Vendor Equipment Vulnerabilities
v3 9.8 Siemens Siemens SIDIS Secured SmartPlug Improper Enforcement of Message Integrity During Transmission in a Communication Channel, Reusing a Nonce, Key Pair in Encryption, Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Integer Overflow or Wraparound, Out-of-bounds Read, Covert Timing Channel, Detection of Error Condition Without Action, Incorrect Authorization

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2022-23303

The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2022-23304

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2022-37660

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-323 Reusing a Nonce, Key Pair in Encryption

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVE-2022-48174

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2025-5222

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2025-5914

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2025-9230

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2025-9231

Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-385 Covert Timing Channel

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CVE-2025-9232

Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2025-26465

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-390 Detection of Error Condition Without Action

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CVE-2025-32462

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-863 Incorrect Authorization

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 2.8 LOW CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

CVE-2026-5121

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

View CVE Details

Affected Products

Siemens SIDIS Secured SmartPlug
Vendor:
Siemens
Product Version:
SIDIS Secured SmartPlug < V7.26.0310
Product Status:
known_affected
Remediations

Vendor fix
Update to V7.26.0310 or later version

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Acknowledgments

  • Siemens ProductCERT reported these vulnerabilities to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-585531 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-07-14
Date Revision Summary
2026-07-14 1 Publication Date
2026-07-21 2 Initial CISA Republication of Siemens ProductCERT SSA-585531 advisory

Legal Notice and Terms of Use

]]> <![CDATA[Rockwell Automation Studio 5000 Logix Designer]]> https://tsecurity.de/de/3684504/it-security-nachrichten/rockwell-automation-studio-5000-logix-designer/ https://tsecurity.de/de/3684504/it-security-nachrichten/rockwell-automation-studio-5000-logix-designer/ Tue, 21 Jul 2026 19:45:22 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could allow for a local attacker to execute arbitrary files, alter configurations, or execute arbitrary code.

The following versions of Rockwell Automation Studio 5000 Logix Designer are affected:

  • Studio 5000 Logix Designer V36.00 (CVE-2026-9108)
  • Studio 5000 Logix Designer V35.00 (CVE-2026-9108, CVE-2026-9127, CVE-2026-9128)
  • Studio 5000 Logix Designer V35.01 (CVE-2026-9108)
  • Studio 5000 Logix Designer >=V34.00|<=V34.03 (CVE-2026-9108)
  • Studio 5000 Logix Designer >=V33.00|<=V33.03 (CVE-2026-9108)
  • Studio 5000 Logix Designer >=V32.00|<=V32.04 (CVE-2026-9108, CVE-2026-9127, CVE-2026-9128)
  • Studio 5000 Logix Designer V34.00 (CVE-2026-9127)
  • Studio 5000 Logix Designer V34.01 (CVE-2026-9127)
  • Studio 5000 Logix Designer V33.00 (CVE-2026-9127)
  • Studio 5000 Logix Designer V33.02 (CVE-2026-9127)
  • Studio 5000 Logix Designer >=V34.00|<=V34.02 (CVE-2026-9128)
  • Studio 5000 Logix Designer >=V33.00|<=V33.02 (CVE-2026-9128)
CVSS Vendor Equipment Vulnerabilities
v3 7.5 Rockwell Automation Rockwell Automation Studio 5000 Logix Designer Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Incorrect Authorization, Unquoted Search Path or Element

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-9108

A path traversal security issue exists within Studio 5000 Logix Designer due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal sequences to escape the intended extraction directory. If exploited, an attacker could craft a malicious ACD project file that results in arbitrary files being written to attacker-controlled locations on the file system, potentially leading to code execution.

View CVE Details

Affected Products

Rockwell Automation Studio 5000 Logix Designer
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation Studio 5000 Logix Designer: V36.00, Rockwell Automation Studio 5000 Logix Designer: V35.00, Rockwell Automation Studio 5000 Logix Designer: V35.01, Rockwell Automation Studio 5000 Logix Designer: >=V34.00|<=V34.03, Rockwell Automation Studio 5000 Logix Designer: >=V33.00|<=V33.03, Rockwell Automation Studio 5000 Logix Designer: >=V32.00|<=V32.04
Product Status:
known_affected
Remediations

Vendor fix
Rockwell Automation recommends users to upgrade to the following: Studio 5000 Logix Designer: V37.00, 36.01, 35.02, 34.04, 33.04, 32.05 (CVE-2026-9108)

Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

Mitigation
For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html

Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.7 MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
4.0 5.4 MEDIUM CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-9127

A remote code execution security issue exists within Studio 5000 Logix Designer due to incorrect authorization on a configuration file. This can allow any authenticated user to modify the paths of external tools configured within the application. If exploited, an attacker could alter the configuration to point to a malicious executable, resulting in arbitrary code execution when any user interacts with the external tools functionality.

View CVE Details

Affected Products

Rockwell Automation Studio 5000 Logix Designer
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation Studio 5000 Logix Designer: V35.00, Rockwell Automation Studio 5000 Logix Designer: >=V32.00|<=V32.04, Rockwell Automation Studio 5000 Logix Designer: V34.00, Rockwell Automation Studio 5000 Logix Designer: V34.01, Rockwell Automation Studio 5000 Logix Designer: V33.00, Rockwell Automation Studio 5000 Logix Designer: V33.02
Product Status:
known_affected
Remediations

Vendor fix
Studio 5000 Logix Designer: V36.00, 35.01, 34.02, 33.02, 32.05 (CVE-2026-9127)

Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

Mitigation
For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html

Relevant CWE: CWE-863 Incorrect Authorization

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
4.0 7.3 HIGH CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVE-2026-9128

A code execution security issue exists within Studio 5000 Logix Designer due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating system may resolve them to unintended executables placed earlier in the search order. If exploited, an attacker could plant a malicious executable in a location within the search path, resulting in arbitrary code execution with the same permissions of the user running the application.

View CVE Details

Affected Products

Rockwell Automation Studio 5000 Logix Designer
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation Studio 5000 Logix Designer: V35.00, Rockwell Automation Studio 5000 Logix Designer: >=V32.00|<=V32.04, Rockwell Automation Studio 5000 Logix Designer: >=V34.00|<=V34.02, Rockwell Automation Studio 5000 Logix Designer: >=V33.00|<=V33.02
Product Status:
known_affected
Remediations

Vendor fix
Studio 5000 Logix Designer: V36.00, 35.01, 34.03, 33.03, 32.05 (CVE-2026-9128)

Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

Mitigation
For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html

Relevant CWE: CWE-428 Unquoted Search Path or Element

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
4.0 7.3 HIGH CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Acknowledgments

  • Rockwell Automation reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities have a high attack complexity.

Revision History

  • Initial Release Date: 2026-07-21
Date Revision Summary
2026-07-21 1 Initial Republication of Rockwell Automation Security Advisory

Legal Notice and Terms of Use

]]> <![CDATA[Siemens Opcenter X]]> https://tsecurity.de/de/3684503/it-security-nachrichten/siemens-opcenter-x/ https://tsecurity.de/de/3684503/it-security-nachrichten/siemens-opcenter-x/ Tue, 21 Jul 2026 19:45:21 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Opcenter X before V2604 contain an authentication bypass vulnerability that could allow an attacker to gain full unauthorized access to the application. Siemens has released a new version for Opcenter X and recommends to update to the latest version.

The following versions of Siemens Opcenter X are affected:

  • Opcenter X vers:intdot/<2604
CVSS Vendor Equipment Vulnerabilities
v3 10 Siemens Siemens Opcenter X Improper Verification of Cryptographic Signature

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2026-56451

Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersonate any user including administrative accounts, potentially gaining full unauthorized access to the application.

View CVE Details

Affected Products

Siemens Opcenter X
Vendor:
Siemens
Product Version:
Opcenter X < V2604
Product Status:
known_affected
Remediations

Vendor fix
Update to V2604 or later version
https://support.sw.siemens.com/product/206159703/

Relevant CWE: CWE-347 Improper Verification of Cryptographic Signature

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 10 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Acknowledgments

  • Siemens ProductCERT reported this vulnerability to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-096828 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-07-14
Date Revision Summary
2026-07-14 1 Publication Date
2026-07-21 2 Initial CISA Republication of Siemens ProductCERT SSA-096828 advisory

Legal Notice and Terms of Use

]]> <![CDATA[Rockwell Automation 1718-AENTR/1719-AENTR]]> https://tsecurity.de/de/3684502/it-security-nachrichten/rockwell-automation-1718-aentr1719-aentr/ https://tsecurity.de/de/3684502/it-security-nachrichten/rockwell-automation-1718-aentr1719-aentr/ Tue, 21 Jul 2026 19:45:19 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product.

The following versions of Rockwell Automation 1718-AENTR/1719-AENTR are affected:

  • 1718/ 1719 Ex I/O 3.011 
CVSS Vendor Equipment Vulnerabilities
v3 7.5 Rockwell Automation Rockwell Automation 1718-AENTR/1719-AENTR Allocation of Resources Without Limits or Throttling

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-9140

A denial-of-service security issue exists in the 1719-AENTR. The security issue stems from improper handling of a UDP unicast network storm, which causes the device to become overloaded and lose communication. A power cycle is required to recover.

View CVE Details

Affected Products

Rockwell Automation 1718-AENTR/1719-AENTR
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation 1718/ 1719 Ex I/O: 3.011
Product Status:
known_affected
Remediations

Vendor fix
Rockwell Automation recommends users to upgrade to 1718/ 1719 Ex I/O version 3.012 or later.

Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

Mitigation
For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html

Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-21
Date Revision Summary
2026-07-21 1 Initial Republication of Rockwell Automation Security Advisory

Legal Notice and Terms of Use

]]> <![CDATA[Rockwell Automation 1734 POINT I/O]]> https://tsecurity.de/de/3684500/it-security-nachrichten/rockwell-automation-1734-point-io/ https://tsecurity.de/de/3684500/it-security-nachrichten/rockwell-automation-1734-point-io/ Tue, 21 Jul 2026 19:45:15 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product.

The following versions of Rockwell Automation 1734 POINT I/O are affected:

  • 1734 POINT I/O 3.023 
CVSS Vendor Equipment Vulnerabilities
v3 7.5 Rockwell Automation Rockwell Automation 1734 POINT I/O Allocation of Resources Without Limits or Throttling

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-10573

A denial-of-service security issue exists in 1734 POINT I/O module. The security issue stems from improper handling of crafted CIP messages, which can cause the module to enter a faulted state. A restart is required to recover.

View CVE Details

Affected Products

Rockwell Automation 1734 POINT I/O
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation 1734 POINT I/O: 3.023
Product Status:
known_affected
Remediations

Mitigation
Rockwell Automation recommends users are to migrate to 5034-OB8.

Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

Mitigation
For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html

Relevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-21
Date Revision Summary
2026-07-21 1 Initial Republication of Rockwell Automation Security Advisory

Legal Notice and Terms of Use

]]> <![CDATA[The token debate: What CIOs can learn from the laws of thermodynamics]]> https://tsecurity.de/de/3683604/it-nachrichten/the-token-debate-what-cios-can-learn-from-the-laws-of-thermodynamics/ https://tsecurity.de/de/3683604/it-nachrichten/the-token-debate-what-cios-can-learn-from-the-laws-of-thermodynamics/ Tue, 21 Jul 2026 14:03:52 +0200 📰 IT Nachrichten tsecurity.de

What if the next breakthrough in Enterprise AI doesn’t come from computer science alone?

What if it comes from applying principles that physicists have understood for more than a century?

According to Gartner, rising token-driven AI spend is straining budgets and challenging cost justification. As organizations race to deploy generative AI and agentic systems, token consumption dominates nearly every executive discussion: How many tokens did we use? How much did inference cost? Can we reduce our AI bill?

These are important operational questions. But they are not the strategic questions.

I believe the economics of enterprise AI can be viewed through the lens of three well-established principles from thermodynamics: the conservation of energy, entropy, and exergy.

While these principles describe physical systems — not AI —they offer a useful way to think about how organizations should measure AI success.

Principle 1: Value is created through transformation

The 1st Law of Thermodynamics tells us that energy cannot be created or destroyed. It can only be transformed.

Enterprise AI presents a similar management lesson: Tokens are not valuable because they are consumed; they become valuable only when they are transformed into business outcomes: A faster loan application decision. A better customer experience. Faster and more accurate software. Reduced fraud. Higher employee productivity. A new product. A strategic insight.

The executive question therefore is not, “How many tokens did we consume?” It is: “How much business value did those tokens create?”

This leads to a new executive metric: return on tokens (ROT).

Just as organizations measure return on investment, they should begin measuring the business value generated for every million AI tokens consumed.

The organizations that win will not necessarily consume fewer tokens. They will generate more value from every token they use.

Principle 2: Every transformation creates waste

The 2nd Law of Thermodynamics teaches us that every energy transformation introduces inefficiencies.

Some energy inevitably becomes less useful for doing work.

The same pattern appears in enterprise AI: Not every token contributes equally to business outcomes.

Some are spent on:

  • Repeated prompts
  • Oversized context windows
  • Redundant reasoning
  • Hallucinations requiring correction
  • Multiple agents performing the same work
  • Expensive models solving simple problems

Those tokens are not “lost.” They simply produce very little business value.

I think of this as token entropy. Every enterprise deploying AI will experience it. The goal is not to eliminate token entropy completely — that would be unrealistic. The goal is to continuously identify it, measure it and reduce it. Because every unnecessary token represents an opportunity to improve both cost and business performance.

Principle 3: Useful work matters more than energy consumed

Thermodynamics introduces another important idea: Exergy.

Unlike energy, exergy measures how much energy can actually be converted into useful work. Two systems may consume the same amount of energy while producing dramatically different results.

The same is true for enterprise AI.

Imagine two companies each consuming one billion tokens. One produces meeting summaries. The other transforms claims operations, accelerates software delivery, detects fraud, improves customer retention, and creates new revenue opportunities. Both consumed the same number of tokens. Only one extracted significantly more business value.

Borrowing this concept as a management analogy, I call this token exergy.

Token exergy represents an organization’s ability to convert AI intelligence into meaningful business outcomes:

  • High token exergy means AI is solving important business problems.
  • Low token exergy means AI is generating activity without creating proportional enterprise value.

The distinction matters, because activity is not the same as impact.

A new responsibility for CIOs

For years, CIOs have monitored infrastructure: Cloud costs, storage, network utilization, GPU consumption.

These metrics remain important, but they tell only part of the story.

Token usage needs to be measured, planned, optimized and governed with the same discipline as any other cloud resource. This means that the next generation of CIO dashboards should answer different questions:

  • What is our return on tokens?
  • Where is token entropy reducing our effectiveness?
  • How much token exergy are we generating?
  • Which AI initiatives produce the greatest business value?
  • Which use cases create the strongest competitive advantage?

These are no longer technology metrics. They are business metrics.

The next generation of CIOs will not simply deploy AI. They will manage an economy of intelligence.

Their role will resemble that of a portfolio manager — allocating AI capacity where it creates the greatest enterprise value, reducing waste and continuously improving the productivity of every autonomous workflow.

That responsibility cannot be fulfilled by dashboards alone.

It requires an intelligent layer capable of observing, learning and optimizing the entire AI  ecosystem. Three-layer enterprise agentic architecture Will enable this.

The next competitive advantage

Every major technology revolution eventually shifts from measuring inputs to measuring outcomes:

  • Factories stopped measuring coal consumption and began measuring productivity.
  • Cloud computing evolved beyond server utilization to business agility.
  • Digital businesses measured customer acquisition costs and lifetime value.

Enterprise AI is approaching the same inflection point. Organizations that focus only on token costs will optimize for efficiency. Organizations that measure return on tokens, minimize token entropy and maximize token exergy will optimize for business transformation.

That is a fundamentally different objective. And I believe it will separate AI leaders from AI followers.

Because in the end, the future of enterprise AI will not be determined by how many tokens an organization consumes. It will be determined by how effectively those tokens are transformed into lasting business value. The AI adoption spending spree is over. Time to focus on value.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[macOS 26.6 RC Is Now Available: Here’s How to Update Your Mac]]> https://tsecurity.de/de/3682935/ios-mac-os/macos-266-rc-is-now-available-heres-how-to-update-your-mac/ https://tsecurity.de/de/3682935/ios-mac-os/macos-266-rc-is-now-available-heres-how-to-update-your-mac/ Tue, 21 Jul 2026 09:39:47 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Apple Releases tvOS 27 Beta 4: What’s New and How to Install]]> https://tsecurity.de/de/3682897/ios-mac-os/apple-releases-tvos-27-beta-4-whats-new-and-how-to-install/ https://tsecurity.de/de/3682897/ios-mac-os/apple-releases-tvos-27-beta-4-whats-new-and-how-to-install/ Tue, 21 Jul 2026 09:09:38 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Apple Releases iPadOS 27 Beta 4: What’s New and How to Install]]> https://tsecurity.de/de/3682865/ios-mac-os/apple-releases-ipados-27-beta-4-whats-new-and-how-to-install/ https://tsecurity.de/de/3682865/ios-mac-os/apple-releases-ipados-27-beta-4-whats-new-and-how-to-install/ Tue, 21 Jul 2026 08:55:26 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Apple Releases iOS 27 Beta 4: What’s New and How to Install]]> https://tsecurity.de/de/3682234/ios-mac-os/apple-releases-ios-27-beta-4-whats-new-and-how-to-install/ https://tsecurity.de/de/3682234/ios-mac-os/apple-releases-ios-27-beta-4-whats-new-and-how-to-install/ Mon, 20 Jul 2026 23:47:15 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Apple Releases macOS 27 Golden Gate Beta 4: What’s New and How to Install]]> https://tsecurity.de/de/3682190/ios-mac-os/apple-releases-macos-27-golden-gate-beta-4-whats-new-and-how-to-install/ https://tsecurity.de/de/3682190/ios-mac-os/apple-releases-macos-27-golden-gate-beta-4-whats-new-and-how-to-install/ Mon, 20 Jul 2026 23:11:00 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Sophos ZTNA unlocks SaaS app control and so much more]]> https://tsecurity.de/de/3682158/it-security-nachrichten/sophos-ztna-unlocks-saas-app-control-and-so-much-more/ https://tsecurity.de/de/3682158/it-security-nachrichten/sophos-ztna-unlocks-saas-app-control-and-so-much-more/ Mon, 20 Jul 2026 22:53:42 +0200 📰 IT Security Nachrichten tsecurity.de Sophos ZTNA customers now get Sophos Protected Browser as part of Sophos Workspace Protection, extending Zero Trust controls to SaaS and web apps while improving secure RDP and SSH access.

]]> <![CDATA[AI’s problems aren’t what you think]]> https://tsecurity.de/de/3681198/it-security-nachrichten/ais-problems-arent-what-you-think/ https://tsecurity.de/de/3681198/it-security-nachrichten/ais-problems-arent-what-you-think/ Mon, 20 Jul 2026 15:08:44 +0200 📰 IT Security Nachrichten tsecurity.de

The biggest and loudest prediction about AI is that it will eliminate millions of jobs. It is dramatic and easy to repeat. But from what I’ve seen, inside most enterprises the more immediate problem has turned out to be something else entirely: a growing mass of tools, agents, models and usage costs spreading faster than most organizations can govern or connect to real business value, also known as AI sprawl.

None of that invalidates the initial fear. Indeed, AI can clear backlogs, speed up analysis, draft usable content and reduce time spent on repetitive work. In my opinion, what goes wrong is the assumption that those gains will scale seamlessly, and that more AI will automatically produce more value.

What really matters is not only how much AI a company can deploy, but whether its use fits inside a growth strategy, an operating model and an organization that can use it well.

The early results of AI use made the logical progression feel obvious, even a foregone conclusion. If it could already improve output in narrow use cases, then broader deployment should produce broader gains. Simple! Better models were expected to deliver better results. More agents were expected to drive more automation. For many companies, this logic held for long enough to encourage overexpansion.

But this logic has started to break down as usage continues to scale. I’ve seen returns diminish much quicker than expected. To illustrate, one industry analysis found that developers who used AI most heavily produced about twice the output of moderate users, but consumed roughly ten times the compute.  

At a certain point, more AI does not create proportionally more value – it simply becomes more expensive. But where, exactly?

From experimentation to sprawl

Experimentation played a key role in this downturn, but it’s not the culprit. As AI continues to sprawl, the problem continues that AI is spreading faster than most companies can coordinate. Teams often solve the same problem in parallel, paying for overlapping capabilities and layering new tools atop existing ones without any clear inventory of what ‘s already in place. What can appear as momentum is really turning into redundancy.

I’ve seen versions of this play out repeatedly. At one financial firm, several business units were pursuing AI projects aimed at automating research and reporting. Each team moved independently; selecting their own tools, building their own workflows and creating separate data pipelines, with little to no coordination between teams. In some cases, different groups were developing nearly identical capabilities without realizing it, solving the same problems twice without any shared visibility into each other’s work.

Individually, the projects showed real promise. Collectively, the projects created duplication, fragmented data and inconsistent standards business and enterprise wide.

By the time leadership stepped back to assess, the company found itself paying for overlapping capabilities, maintaining multiple versions of the same underlying data, and struggling to determine which solutions were actually delivering value versus which were simply consuming budget and eating at engineering time.

Perhaps most troubling: nobody at the enterprise level had a complete view of what was being built, by whom or why. What began as healthy, well-intentioned experimentation had, without anyone deciding it should, evolved into full-blown AI sprawl, creating a patchwork of disconnected initiatives that was difficult to govern, harder to secure and far more expensive than a coordinated approach could and should be.

Early wins encourage a still wider rollout, but many organizations expand usage before they put real controls in place. Experimentation becomes sprawl. Budgets grow quickly, and few leaders have a reliable view of who is using what or why.

AI strategy cannot sit beside growth strategy

This is where I see many companies still get the issue wrong. They treat AI and growth strategy as two separate efforts, then wonder how adoption gets so messy. A business cannot drop AI into its operations and expect momentum to take over. The technology has to support a clear path to growth, whether that means improving margin, speed, service, capacity or decision-making. At the same time, growth plans cannot assume AI changes nothing about delivery, design or operating leverage. The real challenge is in ensuring the two work together.

Personally, I’ve seen better results when AI initiatives are tied to a specific business objective from the beginning, rather than launched as broad, abstract or transformative effort. One mattress retailer I’ve worked with took this approach, starting with a single, focused and well-defined use case rather than trying to transform or overhaul the entire organization at once. The company introduced an AI-powered training platform for store associates, giving employees a low-pressure way to practice sales conversations and product recommendations before applying them to external situations with customers on the floor.

Because employees experienced immediate and tangible value from the tool, adoption spread quickly across locations, with minimal need for top-down mandates. Early, visible success helped to build internal credibility and generate momentum, which leadership then leveraged to expand into more complex AI initiatives across areas such as inventory management, demand forecasting and replenishment planning.

Ultimately, the technology succeeded not because it was innovative for its own sake, but because it was connected to a larger growth strategy: improving sales effectiveness on the floor, driving operational efficiency behind the scenes and strengthening workforce capability at entry level. A major lesson we walked away with here was that starting small and specific, with a clear throughline to business value creates a strong foundation for sustainable and scalable AI use.

What implementation actually takes

All this takes more than a few easy guardrails. It takes strategy. Leaders need a real inventory of the tools, agents and assistants already in use across the business, who owns them, what data they can access and everything that they support.

They also need financial controls that match the economics of token-based usage, including role-based access, thresholds and review processes that make spend visible before it becomes a surprise. Similarly, they need metrics that go beyond mere activity. More prompts do not mean more value. If a deployment cannot be tied to throughput, margin, quality, cycle time or another tangible result, it is still unfinished.

This is also why blunt shutdowns rarely work. If leaders clamp down too hard, employees often move to unsanctioned tools and create a larger shadow AI problem, or the unauthorized use of artificial intelligence tools, models or chatbots by employees, without the knowledge or approval of IT and security teams, with even less visibility and more risk. The better answer is disciplined adoption: clear ownership, rules, metrics and enough flexibility for teams to use AI where it works.

That matters for the people as much as it does for the budget. Those that modernize well end up with better work – not just less of it.

The story of the moment isn’t about AI replacing people – or even AI in general. It’s about whether companies know their own businesses well enough to keep incorporating powerful new tools without mistaking activity for progress. As technological capabilities continue to appear, the winners will be the organizations that understand where it belongs, what it can improve and how to turn each new wave into something permanent.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Building a Mostly-Local, Mildly Judgemental Home Assistant (emf2026)]]> https://tsecurity.de/de/3681175/it-security-video/building-a-mostly-local-mildly-judgemental-home-assistant-emf2026/ https://tsecurity.de/de/3681175/it-security-video/building-a-mostly-local-mildly-judgemental-home-assistant-emf2026/ Mon, 20 Jul 2026 14:55:23 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[Building a Mostly-Local, Mildly Judgemental Home Assistant (emf2026)]]> https://tsecurity.de/de/3680979/it-security-video/building-a-mostly-local-mildly-judgemental-home-assistant-emf2026/ https://tsecurity.de/de/3680979/it-security-video/building-a-mostly-local-mildly-judgemental-home-assistant-emf2026/ Mon, 20 Jul 2026 13:17:53 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[Global Users Turn To Chinese AI As Costs Soar]]> https://tsecurity.de/de/3680461/it-security-nachrichten/global-users-turn-to-chinese-ai-as-costs-soar/ https://tsecurity.de/de/3680461/it-security-nachrichten/global-users-turn-to-chinese-ai-as-costs-soar/ Mon, 20 Jul 2026 09:08:46 +0200 📰 IT Security Nachrichten tsecurity.de Rising costs and the improving performance of Chinese open-weight models has led Chinese start-ups to overtake US rivals on worldwide token use This article has been indexed from Silicon UK Read the original article: Global Users Turn To Chinese AI


Read more →

The post Global Users Turn To Chinese AI As Costs Soar appeared first on IT Security News.

]]> <![CDATA[Claude Mythos FAQ: Capabilities, access, competitors, implications]]> https://tsecurity.de/de/3680433/it-security-nachrichten/claude-mythos-faq-capabilities-access-competitors-implications/ https://tsecurity.de/de/3680433/it-security-nachrichten/claude-mythos-faq-capabilities-access-competitors-implications/ Mon, 20 Jul 2026 08:38:28 +0200 📰 IT Security Nachrichten tsecurity.de
1.

What is Claude Mythos?

Claude Mythos is an advanced AI model developed by Anthropic and is optimized for cybersecurity and healthcare applications.

Mythos 5 was originally released in April to a small group of vetted technology partners ahead of a planned wider rollout.

Anthropic established Project Glasswing, a consortium that gives limited, controlled access to Mythos to infrastructure providers, open-source developers, and major technology companies. The scheme was designed to enable defenders to find and resolve vulnerabilities faster than they could be identified by attackers, many of which are also beginning to rely heavily on AI tools.

2.

What are the capabilities of Claude Mythos?

The 50 initial partners of Project Glasswing were able to use Mythos to find more than 10,000 high- or critical-severity vulnerabilities in every major operating system and every major web browser.

The model is identifying security flaws that had evaded even the most capable security researchers for years, such as a 27-year-old bug in OpenBSD. It has also proved capable of chaining multiple vulnerabilities together.

3.

How is Anthropic restricting access to Claude Mythos?

Anthropic said it was restricting the more widespread availability of the frontier AI model because its capabilities might easily be misused by attackers.

In June the technology was released to an additional 150 organizations. All Mythos partners are required to accept a 30-day data retention policy for safety monitoring.

After the availability of Mythos forced the Trump administration to reconsider its “hands off” approach to AI oversight, the US government applied export controls to Claude Fable 5 and Claude Mythos 5 on June 15. The restrictions — which were supposed to block access to foreign nationals both inside and outside the US — were lifted on June 30.

4.

What is Claude Fable?

For broader use, Anthropic is offering Claude Fable 5, which is based on the same underlying technology but comes with strict guardrails that limit operations in “risky” cybersecurity domains. Flagged queries are automatically routed to the earlier and less capable Opus 4.8 large language model (LLM) instead.

5.

How are Anthropic’s security vendor partners using access to Mythos?

Cisco, one of Anthropic’s Project Glasswing partners, open-sourced its Foundry Security Spec, a model-agnostic “harness” for security testing, so that other vendors and enterprise security defenders could build similar workflows without starting from scratch.

During a recent web conference, representatives from Cisco argued that defenders can use AI to identify, confirm, and resolve security issues at much greater speed and scale. Older vulnerability remediation models based on “find one issue, patch one issue” are no longer adequate because attackers are using AI moving to accelerate the path from vulnerability discovery to exploitation.

Cisco has been using AI internally to scan 1.8 billion lines of code across its whole product portfolio.

Smaller businesses do not need access to restricted AI models to improve security and more can be achieved in smaller shops by improving security fundamentals such as authentication, segmentation, zero trust, and prioritizing the remediation of actively exploited vulnerabilities, according to Cisco.

6.

Do other AI vendors offer anything comparable to Claude Mythos?

Mythos is the most prominent example of frontier AI models that can automate zero-day discovery at a scale and speed far beyond the capability of human teams.

Several other vendors have frontier AI models aimed towards high-capability, security-oriented operations while others have capable open models that might easily be applied to cybersecurity research.

As a result, Claude Mythos is far from the only game in town.

For example, OpenAI’s GPT-5.4-Cyber (and GPT-5.5) has applications in vulnerability analysis and discovery as well as malware analysis and threat modelling. Security vendors, enterprises, and researchers can gain access to the technology through OpenAI’s Trusted Access for Cyber (TAC) scheme.

Chinese cybersecurity firm 360 Security Technology has developed Tulongfeng, described as a domestic answer to Anthropic’s Mythos.

High performance open models — including DeepSeek V3.2 and Llama 4 — can be run privately on GPU infrastructure and applied to cybersecurity research. Fugu from Japanese vendor Sakana AI offers another option in this category.

7.

What do cybersecurity critics say about Claude Mythos?

Infosecurity critics note that while Claude Mythos is unquestionably advanced, marketing claims that it is reliably breaking production systems overstate its capabilities.

Security professionals are complaining through podcasts and elsewhere about the overly sensitive guardrails in Claude Fable that downgrade to Opus 4.8 upon requests to summarize a security-related blog post or even spell the word “exploit” much less tackle any everyday information security task.

Other experts warn that false positives are likely to be an issue for cybersecurity research using frontier AI models.

The wider criticism is that finding more vulnerabilities faster fails to address the bigger problem of reliability fixing security bugs or non-technical attack paths such as social engineering.

8.

How should enterprise CISOs respond to the development of Mythos?

Western intelligence agencies that form the Fives Eyes alliance issued a statement warning that frontier AI models such as Claude Mythos are “fundamentally transforming both offensive and defensive cyber capabilities” in a scale of months rather than years.

“While Al will help us improve cyber defence over time, it also accelerates the speed, scale, and sophistication of cyber threats,” the group, which includes the US National Security Agency and the UK’s National Cyber Security Centre, warns.

Enterprises need to be using AI to strengthen defenses as part of broader plans to improve cybersecurity resilience.

AI-based systems capable of mapping realistic attack paths faster than any human adversary are fast becoming a pervasive threat, while most organizations are nowhere near ready for what that means for their threat models, one expert warns.

“We now have AI systems that can map realistic attack paths across software, vendors, and critical infrastructure faster than human adversaries can catalog them,” says Joe Hubback, partner and CISO at consultancy Elixirr and former McKinsey Partner. “And as Mythos-class capabilities are prepared for broad commercial release, that’s no longer a niche research problem, it’s something every organization will have to factor into its threat model.”

An AI safety paper from the Cloud Security Alliance warns that AI has significantly compressed the time between vulnerability discovery and exploitation, outpacing traditional patch-and-react security models. Organizations should brace for ongoing waves of AI-discovered vulnerabilities from Project Glasswing and other sources.

“The capabilities seen in Mythos will quickly become more widely available, dramatically increasing the number and frequency of complex, novel attacks organizations will face,” it warns.

Enterprise security defenders need to shift to a “Mythos-ready” approach built around continuous vulnerability operations, faster prioritization, and improved incident response.

See also:

]]> <![CDATA[Levitation, from hovercrafts to holograms (emf2026)]]> https://tsecurity.de/de/3679780/it-security-video/levitation-from-hovercrafts-to-holograms-emf2026/ https://tsecurity.de/de/3679780/it-security-video/levitation-from-hovercrafts-to-holograms-emf2026/ Sun, 19 Jul 2026 19:08:51 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[Levitation, from hovercrafts to holograms (emf2026)]]> https://tsecurity.de/de/3679774/it-security-video/levitation-from-hovercrafts-to-holograms-emf2026/ https://tsecurity.de/de/3679774/it-security-video/levitation-from-hovercrafts-to-holograms-emf2026/ Sun, 19 Jul 2026 18:54:51 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[GNOME OS Safe Mode Improving The System Reliability]]> https://tsecurity.de/de/3678782/linux-tipps/gnome-os-safe-mode-improving-the-system-reliability/ https://tsecurity.de/de/3678782/linux-tipps/gnome-os-safe-mode-improving-the-system-reliability/ Sun, 19 Jul 2026 04:54:47 +0200 🐧 Linux Tipps tsecurity.de /u/hulk14
[link] [comments]]]> <![CDATA[Building and rebuilding and rebuilding an online radio (emf2026)]]> https://tsecurity.de/de/3678574/it-security-video/building-and-rebuilding-and-rebuilding-an-online-radio-emf2026/ https://tsecurity.de/de/3678574/it-security-video/building-and-rebuilding-and-rebuilding-an-online-radio-emf2026/ Sun, 19 Jul 2026 00:32:43 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[600$ For Stealing Podcasts/Show via RSS Feed Manipulation]]> https://tsecurity.de/de/3677788/hacking/600-for-stealing-podcastsshow-via-rss-feed-manipulation/ https://tsecurity.de/de/3677788/hacking/600-for-stealing-podcastsshow-via-rss-feed-manipulation/ Sat, 18 Jul 2026 11:39:22 +0200 đŸ•”ïž Hacking tsecurity.de

Hello hunters! 👋

In this write-up, I will share a Business Logic Flaw I discovered in a major podcasting platform (redacted.com).

By manipulating a simple XML file (RSS Feed), I was able to bypass the ownership verification process and claim legitimate podcasts as my own. This allowed me to create duplicate entries and hijack the identity of famous podcasts on the platform.

Let’s get into the details! 🚀

The Logic

The target platform allows creators to submit their podcasts using an RSS Feed URL. To verify that you own the podcast, the system reads the <itunes:email> tag inside the RSS file and sends a verification code to that email.

The mechanism:

  1. User submits RSS URL (e.g., mysite.com/feed.xml).
  2. System reads the XML
  3. System extracts email from <itunes:email>owner@example.com</itunes:email>.
  4. System sends a code to owner@example.com.

The Bug

The system failed to fingerprint the content of the podcast to check for duplicates. It trusted any RSS feed as long as the email inside matched the submitter’s account.

This means if I download a famous podcast’s RSS feed, change the email inside it to my email, and host it on a public cloud storage, the system treats it as a new, valid podcast owned by me.

Steps to Reproduce

Here is how I exploited this logic:

1. Pick a Target

I found a valid, already published podcast on redacted.com. I copied their legitimate RSS feed URL.

2. Manipulate the Feed

I downloaded the RSS XML file to my local machine. I opened it and modified two lines:

  1. Title: Changed it slightly (to avoid exact name matches).
  2. Email: Changed the <itunes:email> tag to MY email address (the one I used to sign up on the target site).

The Payload (RSS XML):

<channel>
    <title>HACKED PODCAST NAME</title>    
    <itunes:email>attacker@gmail.com</itunes:email>
</channel>

3. Host the Malicious Feed

I uploaded this modified .rss file to a Google Cloud Storage bucket (or any public cloud storage) to get a valid URL. URL Example: https://storage.googleapis.com/.../exploit.rss

4. Submit & Takeover

  • I went to https://redacted.com/submitـrss.
  • I submitted my Google Cloud Storage URL.
  • The system parsed the file, saw my email in the tag, and sent me the verification email.
  • I clicked verify.

Result: The podcast was successfully added to my account! I now controlled a duplicate version of the victim's content on the main streaming platform.

The Impact

This was a simple but effective Logic Bypass.

  • Impersonation: Attackers can claim ownership of content they don't own.
  • Phishing/Spam: Attackers can clone popular podcasts and inject their own descriptions or links.
  • Platform Confusion: Listeners see duplicate versions of the same show.

Remediation

The platform patched this by:

  • Implementing stricter checks on RSS feed content (hashing content to find duplicates).
  • Improving validation to detect if a feed is simply a re-hosted copy of an existing one.

600$ For Stealing Podcasts/Show via RSS Feed Manipulation was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

]]> <![CDATA[v3.6.0-rc.1]]> https://tsecurity.de/de/3677302/downloads/v360-rc1/ https://tsecurity.de/de/3677302/downloads/v360-rc1/ Sat, 18 Jul 2026 03:16:24 +0200 đŸ’Ÿ Downloads tsecurity.de Vue 3.6 is now entering the RC phase as we have completed the intended feature set for Vapor Mode.

3.6 also includes a major refactor of @vue/reactivity based on alien-signals, which significantly improves the reactivity system's performance and memory usage.

For more details about Vapor Mode, see the About Vapor Mode section later in this release note.

Bug Fixes

  • hydration: avoid resolving inherited fallback in forwarded slots (4c215b5)
  • hydration: remove adopted SSR DOM for unresolved async setup (3859af4)
  • runtime-vapor: avoid patching invalid VNode slot content (25f5a8a)
  • runtime-vapor: clean up detached slot branches (b41009d)
  • runtime-vapor: defer slot content anchors during hydration (9b9e4bd)
  • runtime-vapor: preserve outer pending slot anchors (4af4bf9)
  • runtime-vapor: preserve slot content anchors during mismatch recovery (26f90b5)
  • runtime-vapor: preserve v-show transition on vdom child (#15074) (fe882c9), closes #15073
  • runtime-vapor: preserve vapor slot owner during interop slot dry run (#15031) (340630e)
  • runtime-vapor: preserve VNode anchors in dynamic component hydration (898e2ca)
  • runtime-vapor: remove unsafe slot dry runs from vdom interop (#15089) (3d42cdf), closes #14793
  • runtime-vapor: reuse hydration anchor candidates (06778e7)
  • vapor: handle v-if and v-show on transition roots (#15069) (8f62f2e), closes #15068

About Vapor Mode

Vapor Mode is a new compilation mode for Vue Single-File Components (SFCs) with the goal of reducing baseline bundle size and improving performance.

It is 100% opt-in and supports a subset of existing Vue APIs with mostly identical behavior. Features that depend on VNodes or the component public instance proxy are not available in Vapor components.

Vapor Mode has demonstrated the same level of performance as Solid and Svelte 5 in third-party benchmarks.

General Stability Notes

Vapor Mode is feature-complete in Vue 3.6 RC. For now, we recommend using it in the following cases:

  • Partial usage in existing apps, such as implementing a performance-sensitive page in Vapor Mode.
  • Building small new apps entirely in Vapor Mode.

Opting In to Vapor Mode

Vapor Mode supports template-only SFCs and SFCs using <script setup>; the Options API is not supported. The following forms are supported:

<script setup vapor>
// ...
</script>

<script vapor> is shorthand for <script setup vapor>:

<script vapor>
// ...
</script>

The vapor marker can also be placed on the template, enabling Vapor compilation for the entire SFC:

<template vapor>
  <!-- ... -->
</template>

Creating an App and Using VDOM Interop

Pure Vapor Applications

Applications composed entirely of Vapor components can use createVaporApp():

import { createVaporApp } from 'vue'
import App from './App.vue'

createVaporApp(App).mount('#app')

Apps created this way avoid pulling in the Virtual DOM runtime code and allow the baseline bundle size to be drastically reduced.

Enabling VDOM Interop

To use Vapor components in a VDOM app instance created via createApp(), the vaporInteropPlugin must be installed:

import { createApp, vaporInteropPlugin } from 'vue'
import App from './App.vue'

createApp(App).use(vaporInteropPlugin).mount('#app')

A Vapor app instance can also install vaporInteropPlugin to allow VDOM components to be used inside, but this pulls in the VDOM runtime and offsets the benefits of a smaller bundle.

Components authored with render functions or JSX remain VDOM components and also require interop when used in a Vapor application.

When the interop plugin is installed, Vapor and non-Vapor components can be nested inside each other. This currently covers standard props, events, and slots usage, but does not yet account for all possible edge cases. For example, there may still be rough edges when using a VDOM-based component library in Vapor Mode.

In general, we recommend having distinct regions in an app where one rendering mode or the other is used, and avoiding mixed nesting as much as possible.

Feature Compatibility

By design, Vapor Mode supports a subset of existing Vue features. For the supported subset, we aim to deliver the same behavior according to the API specifications. The following features are currently unsupported or do not apply to Vapor Mode:

  • Options API
  • app.config.globalProperties
  • getCurrentInstance() returns null in Vapor components
  • @vue:xxx per-element lifecycle events
  • v-memo
  • Component template refs do not expose properties such as $el, $props, $attrs, $slots, and $refs

Important Usage Considerations

Event Delegation and stopPropagation()

Vapor delegates eligible events to document. Each element stores its own handler, and a single document listener walks the event path and invokes matching handlers.

If any ancestor calls stopPropagation(), the event never reaches document, and the delegated handler will not run.

The following forms bypass delegation and attach the listener directly to the element:

<button @[event]="onClick" />
<button v-bind="{ onClick }" />
<button v-on="{ click: onClick }" />

slots.default() Is Not a Safe Dry Run

In Vapor, slots.default() is not a side-effect-free inspection API. Calling it executes the slot's rendering logic, which may create Blocks and DOM nodes, register reactive effects, and claim existing SSR DOM during hydration.

Do not call a slot to inspect its output before deciding what else to render:

<script setup vapor>
import { useSlots } from 'vue'

const slots = useSlots()
const content = slots.default?.()
const showFallback = !content
</script>

<template>
  <div v-if="showFallback">Fallback</div>
</template>

Instead, leave slot rendering to the template:

<template>
  <slot />
</template>

Custom Directives Use a Different Interface

Custom directives in Vapor also have a different interface:

type VaporDirective = (
  node: Element | VaporComponentInstance,
  value?: () => any,
  argument?: string,
  modifiers?: DirectiveModifiers,
) => (() => void) | void

value is a reactive getter that returns the binding value. Reactive effects can be set up using watchEffect() and are automatically released when the component unmounts. A directive may also return a cleanup function:

const MyDirective = (el, source) => {
  watchEffect(() => {
    el.textContent = source()
  })
  return () => console.log('cleanup')
}

Behavior Consistency

Vapor Mode attempts to match VDOM Mode behavior as much as possible, but minor inconsistencies may still exist in edge cases because the two rendering modes are fundamentally different. In general, a minor inconsistency is not considered a breaking change unless the behavior has previously been documented.

For stable releases, please refer to CHANGELOG.md for details.
For pre-releases, please refer to CHANGELOG.md of the minor branch.

]]> <![CDATA[Google Workspace Weekly Recap - July 17, 2026]]> https://tsecurity.de/de/3677046/web-tipps/google-workspace-weekly-recap-july-17-2026/ https://tsecurity.de/de/3677046/web-tipps/google-workspace-weekly-recap-july-17-2026/ Fri, 17 Jul 2026 23:11:52 +0200 Web Tipps tsecurity.de Google Credential Provider for Windows (GCPW) now supports FIDO2-compliant physical security keys as a second factor for authentication

Google Credential Provider for Windows (GCPW) has been updated to support FIDO2-compliant physical security keys as a second factor for authentication. This update helps organizations improve their security posture by enabling administrators to enforce 2-Step Verification (2SV) using hardware security keys at the Windows login screen. | Learn more.

Improvement to in-room problem reporting for Google Meet hardware

Maintaining an enterprise-grade video conferencing environment requires visibility into the health of its devices. We're introducing new ways to see Google Meet hardware user-reported feedback directly in the Admin console. | Learn more.

New refinement capabilities allow custom editing with Help me write in Gmail

Users can now edit and revise their email drafts in Gmail via the prompt bar, using custom refine instructions in Help me write. Previously the refines were limited to preset options like Polish, Formalize, and Shorten. | Learn more.

Now available: group conversations with external collaborators in Google Chat

For many teams, it’s essential to be able to work in real-time with partners from outside your organization. We’re improving external collaboration in Google Chat by making it possible to create group conversations that include external users. | Learn more.

NotebookLM is now Gemini Notebook

We’re renaming NotebookLM to Gemini Notebook. While it remains a standalone product focused on being your premier research tool, the new name reflects how it will evolve to do more across the Google ecosystem. | Learn more.

Easily control the emotions and pacing of AI avatars and AI voiceovers in Google Vids

Users can now easily steer voiceover and avatar speaking in Google Vids by typing content within brackets like “[excitedly]”. | Learn more.

Expanded language support for Gemini in Google Docs

We are now expanding support for these features to 11 more languages, including Mandarin, Dutch, Malay, Hebrew, Polish, Turkish, Czech, Indonesian, Swedish, Danish, and Norwegian. These new additions join our previously supported languages: English, Spanish, Portuguese, Japanese, French, Korean, German, and Italian. | Learn more.

Generate higher quality AI video clips and edit any video with Gemini Omni in Vids

Users now have access to Gemini Omni directly within Google Vids. Omni provides higher quality video generation with significant improvements over previous models. Additionally, Omni’s world understanding unlocks simple video edits so you can ask Omni to tweak the video you have to get the video you need. | Learn more.

Cast yourself in AI video clips using your personal avatar with Gemini Omni in Vids

Users now have access to Gemini Omni directly within Google Vids. With Gemini Omni, you can create videos using your personal avatar to scale your presence without the studio time. Use a secure verification process to capture your likeness and then select it as a character in Omni generations within Vids. | Learn more.

New Google Meet 'Take notes for me' settings for admins and end users

To help users remember to capture notes for meetings when it’s most valuable, we’re updating the admin and end user settings that let them pre-configure AI note-taking for Google Meet. | Learn more.

The announcements above were published on the Workspace Updates blog over the last week. Please refer to the original blog posts for complete details.

]]> <![CDATA[The Hassle Hurdle: a philosophy to hack ADHD (emf2026)]]> https://tsecurity.de/de/3676646/it-security-video/the-hassle-hurdle-a-philosophy-to-hack-adhd-emf2026/ https://tsecurity.de/de/3676646/it-security-video/the-hassle-hurdle-a-philosophy-to-hack-adhd-emf2026/ Fri, 17 Jul 2026 19:19:22 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[AI workloads shake up observability market]]> https://tsecurity.de/de/3676598/it-security-nachrichten/ai-workloads-shake-up-observability-market/ https://tsecurity.de/de/3676598/it-security-nachrichten/ai-workloads-shake-up-observability-market/ Fri, 17 Jul 2026 18:28:45 +0200 📰 IT Security Nachrichten tsecurity.de

Observability platforms are evolving beyond traditional monitoring as vendors add AI capabilities and cost-management features aimed at helping enterprise organizations better manage increasingly complex IT environments.

Vendors are investing heavily in AI observability, autonomous investigations, cost optimization, and operational intelligence as they try to evolve their platforms into systems that help IT teams understand problems, identify root causes, and determine the best course of action, according to Gartner, which just published its latest Magic Quadrant for Observability Platforms.

Gartner defines the observability category as technologies that help organizations understand and optimize the health, performance, and behavior of applications, infrastructure, services, AI agents, and user experiences by collecting and analyzing telemetry data, such as logs, metrics, events, and traces.

There are 19 vendors that made the cut for Gartner’s new report. Its Leaders quadrant includes (alphabetically) Chronosphere, Coralogix, Datadog, Dynatrace, Elastic, Grafana Labs, IBM, and New Relic. The Challengers are Alibaba Cloud, Amazon Web Services, LogicMonitor, Microsoft, and Splunk. The two Visionaries are BMC Helix and Honeycomb. Those dubbed Niche Players are Apica, HPE, ScienceLogic, and SolarWinds. (For specific vendor strengths and cautions, check out the full Gartner report. Some vendors offer free versions of the report with registration.)

Looking beyond quadrant placement, Gartner advises organizations to evaluate vendors based on their ability to deliver full-stack observability and their “roadmap credibility” in key areas such as AI observability, OpenTelemetry interoperability, and the ability to observe and govern AI agents.

AI observability emerges as a key differentiator

Organizations are increasingly looking for visibility into AI workloads, including token consumption, model latency, response quality, hallucination rates, and other AI-specific performance metrics, according to the report. Gartner identifies AI observability as an emerging requirement, driven by growing enterprise interest in large language models (LLMs), genAI applications, and agentic AI systems.

The report recognizes a growing number of vendors introducing AI-focused monitoring, autonomous investigations, AI agents, and specialized observability capabilities designed to help organizations monitor and govern AI-powered applications and workflows. At the same time, Gartner clarifies that many claims surrounding autonomous operations remain ahead of reality.

“The transition from generative AI assistants to autonomous agents is more complex than vendor marketing suggests,” the report states.

Cost management becomes a top priority

While AI may dominate vendor messaging, Gartner states that telemetry cost management remains one of the top concerns for enterprise buyers.

As organizations collect larger amounts of logs, traces, metrics, and events, observability spending is increasingly attracting attention from finance and procurement teams. Gartner notes that 5% of its clients now spend more than $10 million annually with a single observability provider.

Gartner describes pipeline management as a strategic layer that is becoming central to observability deployments. Vendors that fail to address these cost concerns risk losing customers to vendor-agnostic alternatives focused on telemetry optimization. Organizations increasingly want platforms that can provide cost attribution, utilization insights, and financial metrics that help justify observability investments, according to Gartner.

Gartner projects the observability market will reach $14.3 billion by 2028, driven increasingly by organizations’ need to manage growing telemetry volumes.

OpenTelemetry is table stakes as consolidation continues

The growing impact of open standards is a major shift for observability, Gartner notes.

The widespread adoption of OpenTelemetry and eBPF-based instrumentation has lowered barriers to switching observability providers and made telemetry collection increasingly commoditized, the research firm explains. Gartner says many enterprise buyers now consider OpenTelemetry support a baseline requirement rather than a differentiator.

As a result, vendors are now trying to differentiate themselves through analytics, automation, AI capabilities, and user experience rather than proprietary data collection approaches. That shift is forcing vendors to demonstrate value beyond monitoring and visibility, as buyers seek platforms capable of accelerating troubleshooting, automating investigations, and improving operational outcomes, according to Gartner.

Gartner says market consolidation continues to favor platform-oriented vendors that combine full-stack observability with integrated AI capabilities. Organizations are increasingly looking for unified platforms that can monitor applications, infrastructure, digital experiences, and AI workloads from a single environment.

The rise of operational intelligence

As enterprises modernize applications and expand AI initiatives, organizations want platforms that can not only identify problems but also explain causes, prioritize actions, and potentially automate remediation. Vendors are expanding observability platforms with AI-driven analytics, automation, and governance capabilities that span applications, infrastructure, cloud services, and AI workloads.

For enterprise buyers, the next phase of observability may be defined less by telemetry collection and more by how effectively vendors can transform data into intelligence, automation, and measurable business outcomes.

]]> <![CDATA[How to add XLAs to your outsourcing contract]]> https://tsecurity.de/de/3675704/it-nachrichten/how-to-add-xlas-to-your-outsourcing-contract/ https://tsecurity.de/de/3675704/it-nachrichten/how-to-add-xlas-to-your-outsourcing-contract/ Fri, 17 Jul 2026 12:17:06 +0200 📰 IT Nachrichten tsecurity.de

Organizations usually face the same questions concerning XLAs: What should we measure, who owns the data, how should incentives work, and how will this change provider behavior after signature.

There are no easy answers either, but after advising clients in MSP relationships with major providers, I’ve seen what works and what doesn’t. Successful XLA programs rarely start with massive transformation, nor rely on perfection before adding experience accountability to the contract.

Start with the right metrics

The first concern I hear is what to measure. MSPs often steer that discussion toward metrics already in their reporting stack. That’s a trap.

Unlike SLAs, which measure operational outputs, XLAs should focus on employee experience and business outcomes. The strongest programs start with three to five high-signal metrics tied to the employee journeys creating the most friction. More than that and the program loses focus before it gains traction.

I typically recommend starting with employee satisfaction scores, perceived lost productivity time, repeat incident rates, task completion success, and ease of getting support. Then focus early measurement on common employee experiences like service desk interactions, employee onboarding, application reliability, and device performance.

Trying to measure everything is understandable, but it’s also one of the fastest ways to stall an XLA program.

Precisely define roles and responsibilities

This is the part of XLA contract design where I spend the most time with clients, and it’s the part that major MSPs are most likely to leave vague if you let them. Accenture and TCS both have mature commercial teams skilled at agreeing to things in principle while avoiding specific accountability in writing. Don’t let that happen here.

Employee experience isn’t solely the vendor’s responsibility. It’s genuinely shared, which is a more productive framing than pure vendor accountability, but only if the split is clearly spelled out. This is what I’ve found works in practice.

Customer responsibilities

  • Selecting tools and platforms
  • Managing data infrastructure
  • Sharing experience data openly with the provider
  • Supporting internal improvement initiatives that the provider flags

Vendor responsibilities

  • Running the measurement cadence
  • Delivering monthly experience reporting
  • Identifying and surfacing improvement opportunities from the data
  • Executing operational improvements within agreed timelines

Without this level of specificity, XLA programs almost always become reporting exercises. The data gets collected, the scorecard gets presented, and nothing actually changes.

Build flexible targets

One of the biggest mistakes in XLA design is treating experience targets like traditional SLAs,  setting once at contract signing and left unchanged for years. Employee expectations, workforce patterns, and technology environments, after all, evolve constantly. A target that feels ambitious in year one may become meaningless by year three.

The strongest XLA contracts include formal reviews every three to six months to recalibrate targets, align with business priorities, and raise expectations as experience improves. This prevents providers from locking in easy wins and coasting. When providers resist review cycles, it’s often a sign they believe the targets can be met on autopilot, a red flag in any XLA program.

Use the right scoring method

One overlooked XLA best practice is how experience scores are calculated. Point-in-time scores can be distorted by outages, isolated incidents, or low survey participation, and providers sometimes exploit that volatility.

I advise clients to calculate official XLA scores using rolling two-month averages instead of snapshots. It creates a more stable and accurate view of experience trends, and makes operational timing games much harder. Most importantly, define the scoring methodology explicitly in the contract. Don’t leave it to be worked out operationally after signing.

Structure incentives carefully

Relying on penalty-only incentives is one of the most expensive XLA mistakes. On paper, the model is simple: miss the target, pay the penalty. In practice, it drives the wrong behavior. Providers focus on protecting themselves instead of improving employee experience, optimizing survey timing, and managing averages rather than solving problems collaboratively.

I’ve seen this repeatedly in Infosys, HCL, and TCS relationships. The strongest XLA structures combine risk and reward where providers earn meaningful upside for exceeding targets, innovating, and improving outcomes. Penalties still matter, especially in mature programs, but they can’t be the only lever otherwise the contract becomes another SLA model with better branding.

Define escalation processes

When experience scores fall below threshold, the contract needs to specify what happens next. This sounds obvious, but I’ve reviewed many service delivery measurement frameworks in clients’ incumbent MPS contracts that specify financial consequences without defining any collaborative process to address the underlying problem.

The escalation language I push clients to include specifies:

  • a joint review process triggered when scores fall below threshold.
  • root cause analysis expectations and timelines.
  • remediation planning requirements with named owners on both sides.
  • timelines for corrective action and progress reporting.

The framing matters as much as the mechanics. Escalation should be positioned as collaborative problem-solving, not blame assignment. Contracts that turn every missed score into a commercial dispute damage the relationship when provider engagement matters most. The best MSPs treat escalation as a shared diagnostic exercise, not a contractual confrontation.

Establish an operating rhythm

Signing the contract is the beginning, not the end. In my experience, the organizations that get the most out of XLA programs are those that build a disciplined operating cadence and stick to it. The ones that treat XLAs as a reporting exercise almost never see meaningful improvement.

This is the cadence I recommend:

Daily: Both parties maintain live dashboards showing experience trends, application performance, regional issues, and persona-specific insights to catch emerging issues.

Weekly: Customer and vendor teams hold focused working sessions to determine what improved experience this week, what hurt it, which remediation actions were completed, and what’s the priority for next week.

Monthly: Formal governance meetings to review experience scores, improvement actions, root cause discussions, and cross-functional issues that need escalation.

Biannually: Leadership steering meetings to assess overall experience performance, recalibrate targets, and align the XLA program with evolving business priorities to honestly evaluate whether or not the program is driving the outcomes the organization actually cares about.

Common mistakes organizations make

After working through XLA design and implementation with clients across their MSP relationships, the failure modes are predictable. Here’s what to watch for.

Setting targets before establishing a baseline
Rushing into targets before understanding your current state is one of the fastest ways to create disputes. Spend the first three to six months gathering baseline data, then negotiate targets based on evidence rather than guesswork.

Measuring too much
More metrics don’t create more insight. Frameworks with 20 data points rarely survive operational reality. Start focused and expand gradually.

Hiding the data
Transparency is foundational to XLAs. Providers who obscure poor scores, especially when controlling the measurement platform, undermine the entire model. Clients who weaponize the data create the same problem. Build mutual transparency obligations into the contract.

Over-relying on penalties
Penalty-only structures recreate legacy SLA behaviors. Balanced incentives drive better long-term outcomes.

Treating XLAs as static
Employee expectations, technology, and business priorities evolve constantly. Without formal review cycles, XLA programs quickly become irrelevant.

Start smaller than you think you need to

The organizations that get XLAs right are rarely the ones with the most sophisticated tooling. They’re the ones that stopped waiting for a perfect program and introduced real accountability into the contract with what they had.

The most effective starting points are often simple: agree on a focused set of experience metrics, establish a six-month review cycle, commit to shared visibility and data transparency, and create joint accountability for continuous improvement.

From there, maturity develops over time. Governance builds trust, data becomes more actionable, and targets evolve alongside business priorities. The relationship shifts from compliance management to outcome-driven partnership.

In my experience, the organizations that succeed are the ones that stopped accepting green scorecards at face value and demanded something more meaningful.

]]> <![CDATA[Rockwell Automation Arena]]> https://tsecurity.de/de/3674160/it-security-nachrichten/rockwell-automation-arena/ https://tsecurity.de/de/3674160/it-security-nachrichten/rockwell-automation-arena/ Thu, 16 Jul 2026 18:42:05 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation these vulnerabilities could allow an attacker to execute arbitrary code in the context of the current process.

The following versions of Rockwell Automation Arena are affected:

  • Arena <=V17.00.00 (CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, CVE-2026-8314)
CVSS Vendor Equipment Vulnerabilities
v3 7.8 Rockwell Automation Rockwell Automation Arena Out-of-bounds Write

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-8085

A security issue exists within Arena Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

View CVE Details

Affected Products

Rockwell Automation Arena
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation Arena: <=V17.00.00
Product Status:
known_affected
Remediations

Mitigation
Rockwell Automation recommends users to update to V17.00.01

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 7 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-8312

A security issue exists within Arena Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

View CVE Details

Affected Products

Rockwell Automation Arena
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation Arena: <=V17.00.00
Product Status:
known_affected
Remediations

Mitigation
Rockwell Automation recommends users to update to V17.00.01

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 7 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-8313

A security issue exists within Arena Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

View CVE Details

Affected Products

Rockwell Automation Arena
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation Arena: <=V17.00.00
Product Status:
known_affected
Remediations

Mitigation
Rockwell Automation recommends users to update to V17.00.01

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 7 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-8314

A security issue exists within Arena Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

View CVE Details

Affected Products

Rockwell Automation Arena
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation Arena: <=V17.00.00
Product Status:
known_affected
Remediations

Mitigation
Rockwell Automation recommends users to update to V17.00.01

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 7 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Michael Heinzl reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-16
Date Revision Summary
2026-07-16 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Siemens SICAM 8]]> https://tsecurity.de/de/3674159/it-security-nachrichten/siemens-sicam-8/ https://tsecurity.de/de/3674159/it-security-nachrichten/siemens-sicam-8/ Thu, 16 Jul 2026 18:42:03 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - SICAM EGS Device firmware - CPCI85 - SICAM S8000 - SICORE Siemens has released new versions for the affected products and recommends to update to the latest versions.

The following versions of Siemens SICAM 8 are affected:

  • CPCI85 Central Processing/Communication vers:intdot/<26.20 (CVE-2026-54798, CVE-2026-54799, CVE-2026-54800, CVE-2026-54801)
  • SICORE Base system vers:intdot/<26.20.0 (CVE-2026-54798, CVE-2026-54799, CVE-2026-54800, CVE-2026-54801)
CVSS Vendor Equipment Vulnerabilities
v3 7.2 Siemens Siemens SICAM 8 Active Debug Code, Initialization of a Resource with an Insecure Default, Unverified Password Change

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Energy
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2026-54798

The affected application includes a debugging interface that is accessible through HTTP endpoints. This could allow an authenticated attacker to disrupt the system by crashing the web process causing denial of service conditions.

View CVE Details

Affected Products

Siemens SICAM 8
Vendor:
Siemens
Product Version:
CPCI85 Central Processing/Communication < V26.20, SICORE Base system < V26.20.0
Product Status:
known_affected
Remediations

Vendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within “CP-8031/CP-8050 Package” V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within “SICAM EGS Package” V26.20 https://support.industry.siemens.com/cs/document/109972536/

Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within “CP-8010/CP-8012 Package” V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within “SICAM S8000 Package” V26.20 https://support.industry.siemens.com/cs/document/109818240

Relevant CWE: CWE-489 Active Debug Code

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-54799

The affected application contains a vulnerability in its firmware update mechanism's signature validation process. This could allow an attacker to install malicious firmware, leading to persistent code execution and system compromise.

View CVE Details

Affected Products

Siemens SICAM 8
Vendor:
Siemens
Product Version:
CPCI85 Central Processing/Communication < V26.20, SICORE Base system < V26.20.0
Product Status:
known_affected
Remediations

Vendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within “CP-8031/CP-8050 Package” V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within “SICAM EGS Package” V26.20 https://support.industry.siemens.com/cs/document/109972536/

Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within “CP-8010/CP-8012 Package” V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within “SICAM S8000 Package” V26.20 https://support.industry.siemens.com/cs/document/109818240

Relevant CWE: CWE-489 Active Debug Code

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.7 MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVE-2026-54800

The affected application ships with a default configuration that disables all OPC UA security mechanisms. This could allow an attacker to gain unauthorized access and control over critical system functions.

View CVE Details

Affected Products

Siemens SICAM 8
Vendor:
Siemens
Product Version:
CPCI85 Central Processing/Communication < V26.20, SICORE Base system < V26.20.0
Product Status:
known_affected
Remediations

Vendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within “CP-8031/CP-8050 Package” V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within “SICAM EGS Package” V26.20 https://support.industry.siemens.com/cs/document/109972536/

Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within “CP-8010/CP-8012 Package” V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within “SICAM S8000 Package” V26.20 https://support.industry.siemens.com/cs/document/109818240

Relevant CWE: CWE-1188 Initialization of a Resource with an Insecure Default

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 4.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CVE-2026-54801

The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the web API. This could allow an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.

View CVE Details

Affected Products

Siemens SICAM 8
Vendor:
Siemens
Product Version:
CPCI85 Central Processing/Communication < V26.20, SICORE Base system < V26.20.0
Product Status:
known_affected
Remediations

Vendor fix
Update to V26.20 or later version The firmware CPCI85 V26.20 is present within “CP-8031/CP-8050 Package” V26.20 https://support.industry.siemens.com/cs/ww/en/view/109804985/ and also within “SICAM EGS Package” V26.20 https://support.industry.siemens.com/cs/document/109972536/

Vendor fix
Update to V26.20.0 or later version The firmware SICORE V26.20.0 is present within “CP-8010/CP-8012 Package” V26.20 https://support.industry.siemens.com/cs/ww/en/view/109972894/ and also within “SICAM S8000 Package” V26.20 https://support.industry.siemens.com/cs/document/109818240

Relevant CWE: CWE-620 Unverified Password Change

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Acknowledgments

  • Siemens reported these vulnerabilities to CISA.

General Recommendations

Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design. Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment. Recommended security guidelines can be found at: https://www.siemens.com/gridsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact Siemens: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability. Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens SSA-229470 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-07-09
Date Revision Summary
2026-07-09 1 Publication Date
2026-07-16 2 Initial CISA Republication of Siemens SSA-229470 advisory

Legal Notice and Terms of Use

]]> <![CDATA[Rockwell Automation Flex 5000 Adapter]]> https://tsecurity.de/de/3674158/it-security-nachrichten/rockwell-automation-flex-5000-adapter/ https://tsecurity.de/de/3674158/it-security-nachrichten/rockwell-automation-flex-5000-adapter/ Thu, 16 Jul 2026 18:42:02 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition on the affected product.

The following versions of Rockwell Automation Flex 5000 Adapter are affected:

  • Flex 5000 Adapter 6.011 (CVE-2026-12659)
CVSS Vendor Equipment Vulnerabilities
v3 7.5 Rockwell Automation Rockwell Automation Flex 5000 Adapter Double Free

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Information Technology
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-12659

A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.

View CVE Details

Affected Products

Rockwell Automation Flex 5000 Adapter
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation Flex 5000 Adapter: 6.011
Product Status:
known_affected
Remediations

Vendor fix
Rockwell Automation recommends users to upgrade to the following: Flex 5000 Adapter version 6.012.

Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

Mitigation
For more information, see Rockwell Automation Security Advisory SD1789 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1789.html).
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1789.html

Relevant CWE: CWE-415 Double Free

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-16
Date Revision Summary
2026-07-16 1 Initial Republication of Rockwell Automation Security Advisory SD1789

Legal Notice and Terms of Use

]]> <![CDATA[AutomationDirect Productivity Suite]]> https://tsecurity.de/de/3674157/it-security-nachrichten/automationdirect-productivity-suite/ https://tsecurity.de/de/3674157/it-security-nachrichten/automationdirect-productivity-suite/ Thu, 16 Jul 2026 18:42:01 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker with local or physical access to cause memory corruption, unintended information disclosure, application instability, or a denial-of-service condition in the affected product.

The following versions of AutomationDirect Productivity Suite are affected:

  • Productivity Suite <=v4.6.2.2 (CVE-2026-60063, CVE-2026-61389, CVE-2026-60140, CVE-2026-57896, CVE-2026-60073, CVE-2026-61378)
CVSS Vendor Equipment Vulnerabilities
v3 7 AutomationDirect AutomationDirect Productivity Suite Out-of-bounds Write, Out-of-bounds Read, Divide By Zero

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-60063

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.

View CVE Details

Affected Products

AutomationDirect Productivity Suite
Vendor:
AutomationDirect
Product Version:
AutomationDirect Productivity Suite: <=v4.6.2.2
Product Status:
known_affected
Remediations

Mitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads

Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.

Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.

Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.

Mitigation
Restrict both physical and logical access to authorized personnel only.

Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.

Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.

Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.

Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.

Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 7.3 HIGH CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-61389

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.

View CVE Details

Affected Products

AutomationDirect Productivity Suite
Vendor:
AutomationDirect
Product Version:
AutomationDirect Productivity Suite: <=v4.6.2.2
Product Status:
known_affected
Remediations

Mitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads

Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.

Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.

Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.

Mitigation
Restrict both physical and logical access to authorized personnel only.

Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.

Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.

Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.

Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.

Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 7.3 HIGH CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-60140

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable.

View CVE Details

Affected Products

AutomationDirect Productivity Suite
Vendor:
AutomationDirect
Product Version:
AutomationDirect Productivity Suite: <=v4.6.2.2
Product Status:
known_affected
Remediations

Mitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads

Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.

Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.

Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.

Mitigation
Restrict both physical and logical access to authorized personnel only.

Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.

Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.

Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.

Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.

Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.1 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 6.9 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

CVE-2026-57896

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.

View CVE Details

Affected Products

AutomationDirect Productivity Suite
Vendor:
AutomationDirect
Product Version:
AutomationDirect Productivity Suite: <=v4.6.2.2
Product Status:
known_affected
Remediations

Mitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads

Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.

Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.

Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.

Mitigation
Restrict both physical and logical access to authorized personnel only.

Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.

Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.

Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.

Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.

Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.1 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 6.9 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

CVE-2026-60073

An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory.

View CVE Details

Affected Products

AutomationDirect Productivity Suite
Vendor:
AutomationDirect
Product Version:
AutomationDirect Productivity Suite: <=v4.6.2.2
Product Status:
known_affected
Remediations

Mitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads

Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.

Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.

Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.

Mitigation
Restrict both physical and logical access to authorized personnel only.

Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.

Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.

Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.

Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.

Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.9 MEDIUM CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 5.2 MEDIUM CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

CVE-2026-61378

A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.

View CVE Details

Affected Products

AutomationDirect Productivity Suite
Vendor:
AutomationDirect
Product Version:
AutomationDirect Productivity Suite: <=v4.6.2.2
Product Status:
known_affected
Remediations

Mitigation
AutomationDirect recommends that users update Productivity suite to v4.7.0.47 and above https://www.automationdirect.com/support/software-downloads.
https://www.automationdirect.com/support/software-downloads

Mitigation
If the update cannot be applied right away, the following compensating controls are recommended until the upgrade can be performed.

Mitigation
Disconnect the engineering workstation from external networks (e.g., the internet or corporate LAN) to reduce exposure.

Mitigation
Use only trusted, dedicated internal networks or air-gapped systems for device communication.

Mitigation
Restrict both physical and logical access to authorized personnel only.

Mitigation
Configure whitelisting so that only trusted, pre-approved applications are allowed to run. Block any unauthorized software.

Mitigation
Use antivirus or EDR tools and configure host-based firewalls to block unauthorized access attempts.

Mitigation
Enable and regularly review system logs to detect suspicious or unauthorized activity.

Mitigation
Maintain secure, tested backups of the PLC and its configurations to minimize downtime in case of an incident.

Mitigation
Continuously evaluate risks associated with running outdated firmware and adjust compensating measures accordingly.

Relevant CWE: CWE-369 Divide By Zero

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 6.8 MEDIUM CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Luca Borzacchiello of Nozomi Networks reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

Revision History

  • Initial Release Date: 2026-07-16
Date Revision Summary
2026-07-16 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix]]> https://tsecurity.de/de/3674156/it-security-nachrichten/rockwell-automation-compactlogix-controllogix-compact-guardlogix-and-guardlogix/ https://tsecurity.de/de/3674156/it-security-nachrichten/rockwell-automation-compactlogix-controllogix-compact-guardlogix-and-guardlogix/ Thu, 16 Jul 2026 18:41:59 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.

The following versions of Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix are affected:

  • CompactLogix 5370 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • Compact GuardLogix 5370 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • ControlLogix 5570 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • GuardLogix 5570 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • CompactLogix 5380 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • CompactLogix 5380 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • Compact GuardLogix 5380 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • Compact GuardLogix 5380 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • CompactLogix 5480 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • CompactLogix 5480 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • ControlLogix 5580 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • ControlLogix 5580 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • GuardLogix 5580 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • GuardLogix 5580 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • CompactLogix 5380 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • Compact GuardLogix 5380 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • CompactLogix 5480 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • ControlLogix 5580 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
  • GuardLogix 5580 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CVSS Vendor Equipment Vulnerabilities
v3 8.6 Rockwell Automation Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2025-12011

A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).

View CVE Details

Affected Products

Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation CompactLogix 5370: <=V35.015, Rockwell Automation Compact GuardLogix 5370: <=V35.015, Rockwell Automation ControlLogix 5570: <=V35.015, Rockwell Automation GuardLogix 5570: <=V35.015, Rockwell Automation CompactLogix 5380: <=V34.012, Rockwell Automation CompactLogix 5380: <=V35.011, Rockwell Automation Compact GuardLogix 5380: <=V34.012, Rockwell Automation Compact GuardLogix 5380: <=V35.011, Rockwell Automation CompactLogix 5480: <=V34.012, Rockwell Automation CompactLogix 5480: <=V35.011, Rockwell Automation ControlLogix 5580: <=V34.012, Rockwell Automation ControlLogix 5580: <=V35.011, Rockwell Automation GuardLogix 5580: <=V34.012, Rockwell Automation GuardLogix 5580: <=V35.011, Rockwell Automation CompactLogix 5380 Recovery Image: <=1.072, Rockwell Automation Compact GuardLogix 5380 Recovery Image: <=1.072, Rockwell Automation CompactLogix 5480 Recovery Image: <=1.072, Rockwell Automation ControlLogix 5580 Recovery Image: <=1.072, Rockwell Automation GuardLogix 5580 Recovery Image: <=1.072
Product Status:
known_affected
Remediations

Vendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later

Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later

Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later

Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later

Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later

Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later

Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later

Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later

Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later

Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CVE-2025-12012

A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major nonrecoverable fault (MNRF).

View CVE Details

Affected Products

Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation CompactLogix 5370: <=V35.015, Rockwell Automation Compact GuardLogix 5370: <=V35.015, Rockwell Automation ControlLogix 5570: <=V35.015, Rockwell Automation GuardLogix 5570: <=V35.015, Rockwell Automation CompactLogix 5380: <=V34.012, Rockwell Automation CompactLogix 5380: <=V35.011, Rockwell Automation Compact GuardLogix 5380: <=V34.012, Rockwell Automation Compact GuardLogix 5380: <=V35.011, Rockwell Automation CompactLogix 5480: <=V34.012, Rockwell Automation CompactLogix 5480: <=V35.011, Rockwell Automation ControlLogix 5580: <=V34.012, Rockwell Automation ControlLogix 5580: <=V35.011, Rockwell Automation GuardLogix 5580: <=V34.012, Rockwell Automation GuardLogix 5580: <=V35.011, Rockwell Automation CompactLogix 5380 Recovery Image: <=1.072, Rockwell Automation Compact GuardLogix 5380 Recovery Image: <=1.072, Rockwell Automation CompactLogix 5480 Recovery Image: <=1.072, Rockwell Automation ControlLogix 5580 Recovery Image: <=1.072, Rockwell Automation GuardLogix 5580 Recovery Image: <=1.072
Product Status:
known_affected
Remediations

Vendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later

Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later

Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later

Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later

Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later

Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later

Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later

Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later

Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later

Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CVE-2025-11698

A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).

View CVE Details

Affected Products

Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation CompactLogix 5370: <=V35.015, Rockwell Automation Compact GuardLogix 5370: <=V35.015, Rockwell Automation ControlLogix 5570: <=V35.015, Rockwell Automation GuardLogix 5570: <=V35.015, Rockwell Automation CompactLogix 5380: <=V34.012, Rockwell Automation CompactLogix 5380: <=V35.011, Rockwell Automation Compact GuardLogix 5380: <=V34.012, Rockwell Automation Compact GuardLogix 5380: <=V35.011, Rockwell Automation CompactLogix 5480: <=V34.012, Rockwell Automation CompactLogix 5480: <=V35.011, Rockwell Automation ControlLogix 5580: <=V34.012, Rockwell Automation ControlLogix 5580: <=V35.011, Rockwell Automation GuardLogix 5580: <=V34.012, Rockwell Automation GuardLogix 5580: <=V35.011, Rockwell Automation CompactLogix 5380 Recovery Image: <=1.072, Rockwell Automation Compact GuardLogix 5380 Recovery Image: <=1.072, Rockwell Automation CompactLogix 5480 Recovery Image: <=1.072, Rockwell Automation ControlLogix 5580 Recovery Image: <=1.072, Rockwell Automation GuardLogix 5580 Recovery Image: <=1.072
Product Status:
known_affected
Remediations

Vendor fix
Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later

Vendor fix
Compact GuardLogix 5370: Update to V35.016, V36.011 and later

Vendor fix
ControlLogix 5570: Update to V35.016, V36.011 and later

Vendor fix
GuardLogix 5570: Update to V35.016, V36.011 and later

Vendor fix
CompactLogix 5380: Update to V34.014, V35.013, V36.011 and later

Vendor fix
Compact GuardLogix 5380: Update to V34.014, V35.013, V36.011 and later

Vendor fix
CompactLogix 5480: Update to V34.014, V35.013, V36.011 and later

Vendor fix
ControlLogix 5580: Update to V34.014, V35.013, V36.011 and later

Vendor fix
GuardLogix 5580: Update to V34.014, V35.013, V36.011 and later

Vendor fix
CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Vendor fix
GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

Relevant CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Acknowledgments

  • Rockwell Automation reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-16
Date Revision Summary
2026-07-16 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT]]> https://tsecurity.de/de/3674155/it-security-nachrichten/rockwell-automation-1756-en2-1756-en3-and-1756-enbt/ https://tsecurity.de/de/3674155/it-security-nachrichten/rockwell-automation-1756-en2-1756-en3-and-1756-enbt/ Thu, 16 Jul 2026 18:41:58 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.

The following versions of Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT are affected:

  • 1756-EN3 <=V12.001 (CVE-2026-9653)
  • 1756-EN2 <=V12.001 (CVE-2026-9653)
  • 1756-ENBT V6.006 (CVE-2026-9653)
CVSS Vendor Equipment Vulnerabilities
v3 7.5 Rockwell Automation Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT Improper Validation of Integrity Check Value

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-9653

A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.

View CVE Details

Affected Products

Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation 1756-EN3: <=V12.001, Rockwell Automation 1756-EN2: <=V12.001, Rockwell Automation 1756-ENBT: V6.006
Product Status:
known_affected
Remediations

Vendor fix
Rockwell Automation recommends users take the following actions: 1756-EN3: Update to V12.002

Vendor fix
1756-EN2: Update to V12.002

Vendor fix
1756-ENBT: Product is discontinued, fix is unavailable

Relevant CWE: CWE-354 Improper Validation of Integrity Check Value

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Tyler Lentz of Idaho National Laboratory reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-16
Date Revision Summary
2026-07-16 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[NASA Core Flight System (cFS) Health & Safety (HS) Application]]> https://tsecurity.de/de/3674154/it-security-nachrichten/nasa-core-flight-system-cfs-health-safety-hs-application/ https://tsecurity.de/de/3674154/it-security-nachrichten/nasa-core-flight-system-cfs-health-safety-hs-application/ Thu, 16 Jul 2026 18:41:57 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.

The following versions of NASA Core Flight System (cFS) Health & Safety (HS) Application are affected:

  • Core Flight System (cFS) Health & Safety (HS) Application
CVSS Vendor Equipment Vulnerabilities
v3 7.5 NASA NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference

Background

  • Critical Infrastructure Sectors: Transportation Systems
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-15352

A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial of service.

View CVE Details

Affected Products

NASA Core Flight System (cFS) Health & Safety (HS) Application
Vendor:
NASA
Product Version:
NASA Core Flight System (cFS) Health & Safety (HS) Application: <v7.0.1
Product Status:
known_affected
Remediations

Mitigation
NASA recommends users update to v7.0.1 (https://github.com/nasa/HS/releases/tag/v7.0.1)
https://github.com/nasa/HS/releases/tag/v7.0.1

Relevant CWE: CWE-476 NULL Pointer Dereference

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 8.2 HIGH CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Grady DeRosa reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-16
Date Revision Summary
2026-07-16 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Rockwell Automation FactoryTalk DataMosaix]]> https://tsecurity.de/de/3674153/it-security-nachrichten/rockwell-automation-factorytalk-datamosaix/ https://tsecurity.de/de/3674153/it-security-nachrichten/rockwell-automation-factorytalk-datamosaix/ Thu, 16 Jul 2026 18:41:55 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious scripts on the server.

The following versions of Rockwell Automation FactoryTalk DataMosaix are affected:

  • DataMosaix Private Cloud <=8.02 (CVE-2026-9292)
CVSS Vendor Equipment Vulnerabilities
v3 6.1 Rockwell Automation Rockwell Automation FactoryTalk DataMosaix Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Information Technology
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-9292

A Stored Cross-Site Scripting security issue exists within FactoryTalk DataMosaix Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website.

View CVE Details

Affected Products

Rockwell Automation FactoryTalk DataMosaix
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation DataMosaix Private Cloud: <=8.02
Product Status:
known_affected
Remediations

Vendor fix
Rockwell Automation recommends users to upgrade to the following: DataMosaix Private Cloud versions 8.03 or later.

Mitigation
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight).
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

Mitigation
For more information, see Rockwell Automation Security Advisory SD1787 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html).
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1787.html

Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
4.0 8.4 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Acknowledgments

  • Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-16
Date Revision Summary
2026-07-16 1 Initial Republication of Rockwell Automation Security Advisory SD1787

Legal Notice and Terms of Use

]]> <![CDATA[SALTO ProAccess Space]]> https://tsecurity.de/de/3674152/it-security-nachrichten/salto-proaccess-space/ https://tsecurity.de/de/3674152/it-security-nachrichten/salto-proaccess-space/ Thu, 16 Jul 2026 18:41:54 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability allows an authenticated attacker to escalate privileges and access spaces outside their assigned partition, within the same Salto ProAccess Space installation or system. Exploitation requires valid authenticated operator credentials and the partition feature to be enabled; installations without partitioning are not affected.

The following versions of SALTO ProAccess Space are affected:

  • ProAccess Space <6.13 (CVE-2026-11889)
CVSS Vendor Equipment Vulnerabilities
v3 6.5 SALTO SALTO ProAccess Space Authorization Bypass Through User-Controlled Key

Background

  • Critical Infrastructure Sectors: Commercial Facilities, Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Spain

Vulnerabilities

Expand All +

CVE-2026-11889

SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized attacker to access any space managed by the affected product.

View CVE Details

Affected Products

SALTO ProAccess Space
Vendor:
SALTO
Product Version:
SALTO ProAccess Space: <6.13
Product Status:
known_affected
Remediations

Mitigation
Users of SALTO ProAccess using the tenancy feature should upgrade to version 6.13.

Vendor fix
To further enhance security after applying the update: 1. Operate ProAccess Space on a protected internal network and avoid exposing it directly to the Internet. 2. Restrict operator-level accounts to the minimum required and apply least-privilege principles. 3. If feasible, disable the partitioning feature and operate under a single partition. 4. When strong tenant separation is required, consider running separate Space instances (isolated environments) rather than relying solely on logical partitioning.

Relevant CWE: CWE-639 Authorization Bypass Through User-Controlled Key

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
4.0 7.1 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Acknowledgments

  • Bernhard Lorenz of Limes Security reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-16
Date Revision Summary
2026-07-16 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Amazon AGI director says AI agent reliability, not capability, is blocking enterprise deployment at VB Transform 2026]]> https://tsecurity.de/de/3674071/it-nachrichten/amazon-agi-director-says-ai-agent-reliability-not-capability-is-blocking-enterprise-deployment-at-vb-transform-2026/ https://tsecurity.de/de/3674071/it-nachrichten/amazon-agi-director-says-ai-agent-reliability-not-capability-is-blocking-enterprise-deployment-at-vb-transform-2026/ Thu, 16 Jul 2026 18:19:10 +0200 📰 IT Nachrichten tsecurity.de The enterprise AI industry has a math problem. Cisco data shows 85% of enterprises are piloting AI agents, but only 5% have shipped them to production. At VB Transform 2026 on Tuesday, Bryan Silverthorn, Director of AGI Autonomy at Amazon, explained why that gap persists — and why the answer isn't better benchmarks.

Silverthorn, who joined Amazon through its acquisition of Adept AI and now leads multimodal agent training inside the company's AGI lab, argued that reliability must be broken into four distinct dimensions: consistency, robustness, predictability, and safety — a framework he credits to research from Princeton.

"It unpacks different factors that I see tangled together in almost every eval I've ever seen," he said.

Why AI agents pass internal evals but fail real customers in production

The framework matters because agents routinely ace internal evaluations and then collapse in the wild. Silverthorn described a customer that deployed an agent for software QA involving serial number extraction from screens. It worked flawlessly for two months — then began intermittently reading wrong numbers. The culprit: the underlying vision encoder behaved differently depending on where the serial number appeared on screen, and a software change imperceptible to humans triggered the failure.

The lesson, Silverthorn said, is about measurement, not just models. "The models have to be better. Obviously, we're working hard on making the models better," he said. But the deeper takeaway, he added, is that teams need to identify their dimensions of variability and match measurement rigor to the stakes of the application. VentureBeat's own proprietary research, presented before the session, reinforces the point: half of surveyed companies shipped agents that passed internal evals but failed real customers, and enterprises overwhelmingly track uptime while ignoring accuracy — checking the pulse without checking the diagnosis. A related finding underscored how few guardrails exist: most enterprises default to the model makers' own evaluations and little else, leaving their testing strategy, as I described it on stage, a coin flip between trusting the vendor and trusting nothing.

Inside Amazon's 'intern' framework for managing autonomous AI agents

Silverthorn's most memorable prescription was cultural, not technical. Inside Amazon's AGI lab, researchers literally call their agents "interns" — as in, "I'll have my intern talk to your intern." The joke carries a serious operational philosophy. Agents, like interns, are powerful but occasionally clueless, capable of amazing work and spectacular derailment.

Managing them, he argued, requires management skills rather than software skills: asking what could go wrong, adding backups and undo capabilities, and consciously deciding what risk you can accept. "You can ask the intern, 'Hey, what might you do wrong here? How might you mitigate your negative outcomes?'" he said. Amazon's lab has embraced that trade-off, accepting agents occasionally running the wrong experiment in exchange for research velocity — including one agent running experiments around the clock on its own high-level research plan.

What enterprise leaders should do before deploying agents at scale

Silverthorn was candid about the limits of today's technology. Self-improving AI remains "a loaded term," he said — Amazon uses AI to improve its models constantly, but fully autonomous self-improvement is distant. Computer use remains a core focus of his lab, with a commercial trucking customer already using browser automation to stitch together warranty claims across fragmented systems**, though he stressed that no future agent will rely on computer use alone — it will work alongside MCP, APIs, and other tools to complete end-to-end workflows**. And LLM-as-judge techniques, while promising, are just one of several strategies for aligning agent capability with acceptable risk.

For enterprises stuck in pilot purgatory, the path forward starts with a mindset shift: stop asking whether your agent can do something impressive once, and start asking whether it can do it correctly a thousand times in a row.

In other words, the enterprises that escape the 85% ceiling won't be the ones with the smartest agents. They'll be the ones with the best managers.

]]> <![CDATA[Dragon's Dogma 2 producer says Capcom is improving performance on PS5 and Xbox ahead of Dark Arisen's launch and that the Switch 2 version is 'exceeding' expectations]]> https://tsecurity.de/de/3673987/it-nachrichten/dragons-dogma-2-producer-says-capcom-is-improving-performance-on-ps5-and-xbox-ahead-of-dark-arisens-launch-and-that-the-switch-2-version-is-exceeding-expectations/ https://tsecurity.de/de/3673987/it-nachrichten/dragons-dogma-2-producer-says-capcom-is-improving-performance-on-ps5-and-xbox-ahead-of-dark-arisens-launch-and-that-the-switch-2-version-is-exceeding-expectations/ Thu, 16 Jul 2026 17:33:23 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[19 AgentOps tools for monitoring AI activity, issues, and costs]]> https://tsecurity.de/de/3673038/it-security-nachrichten/19-agentops-tools-for-monitoring-ai-activity-issues-and-costs/ https://tsecurity.de/de/3673038/it-security-nachrichten/19-agentops-tools-for-monitoring-ai-activity-issues-and-costs/ Thu, 16 Jul 2026 12:09:36 +0200 📰 IT Security Nachrichten tsecurity.de

With AI increasingly tucked into every cranny of the enterprise, someone has had to step up and provide the tools necessary to discover, track, and monitor all the agents and LLMs and keep them humming along in their various workflows. Thankfully, the DevOps world answered the call, building the tools to support our new overlords in an emerging subdiscipline interchangeably called “AIOps,” “AgentOps,” and sometimes “agent observability.”

Many of the challenges involved in AgentOps are similar to those tackled by traditional DevOps tools and processes. After all, at their foundation, LLMs are just software running on hardware somewhere. Typical issues involving RAM and disk space are just as important in the agent world, maybe more so because AI operations are even more greedy about consuming storage than regular software is.

Many of the companies supporting agent observability are big names in DevOps circles, having adapted their stacks to address the idiosyncrasies of modern LLMs. IT teams maintaining enterprise agents can treat the LLMs as just one node in a big graph filled with services that are constantly swapping packets and triggering software jobs. Latency and resource constraints must be managed because end-users don’t care whether it’s an LLM, a database, or a plain-old Python script that’s failing, bringing their work to a grinding halt.

But new AI-specific challenges are opening the door to newcomers that are building tools with the peculiarities of LLMs in mind — for example, keeping deeper logs filled with records of prompts. LLMs are also often very non-deterministic by design, making it trickier to pinpoint failure modes. And then there’s the fact that an agent will give a perfectly intelligent answer one minute and hallucinate the next.

Relying on many of the same approaches that DevOps tools do, AgentOps tools watch for misbehavior and flag anything out of the ordinary for deeper analysis. This may be as simple as fixing slow responses, but it can also include AI hallucinations and other issues born of LLMs’ non-determanism.

Teams trying to choose which agent observability tools is best for their use case should look at the size and nature of their agentic systems and projects. Are they adding AI agent features to an existing product or application, or are they building agentic systems from scratch? Are they more focused on maintaining a stable LLM operation or iterating on new approaches? Is AI the center of attention or just an add-on that’s meant to improve an existing stack?

The AgentOps and agent observability options listed below share many of the same features but differ in their focus and their attention to the challenges organizations will encounter when incorporating agents into their stacks. Each tool offers a worthwhile place to start understanding how to care for the growing presence of AI in the production world.

AgentOps.ai

When teams of agents work together, tracking the conversations are essential for understanding and debugging what’s happening. The SDK from AgentOps.ai records events so that the creators can replay past behavior to track details such as token counts, spending, latency, and more. Available as a service and on-premises.

Pricing: Starts at $40 per month plus usage costs at $0.20 per 1M tokens

Standout feature: Replay analytics with “time-travel debugging”

Best suited for: Complex agent debugging

Arize Phoenix

Debugging prompts and LLM responses requires a nuanced understanding of just what’s happening, in part because of the non-determinism that often enters the process. Phoenix from Arize supports this process with robust tracing and the ability to score the results for more precise iteration. Their system can track the results and tool calls from a variety of major platforms (Anthropic, AWS, OpenAI, etc.) that are initiated by the major frameworks (LangChain, LlamaIndex, DSPy, etc.). The result is insight into what data is triggering what chain of responses.

Pricing: Small free tier; Pro plan starts at $50 per month plus costs tied to events

Standout feature: LLM-as-a-Judge metrics for tracking quality

Best suited for: Teams focusing on iterating for accuracy and quality

BigPanda

BigPanda has always offered solutions for tracking performance of complex systems. Now the company is drilling deeper into the challenge of detecting and ending the problems that come from models that go awry. BigPanda’s main system relies on historical data and machine learning algorithms to flag issues. Its own agent layer connects the problematic nodes and errant models while dispatching alerts to the right team members.

Pricing: “Value-based” table on request

Standout feature: Automated triage for faster response

Best suited for: Large teams seeking to reduce alert fatigue from large customer base

Braintrust

Setting up an effective improvement cycle for an AI agent requires a strong feedback loop from production data to the agent’s next generation. Braintrust watches the production workload and creates test vectors that expose how an agent may be drifting, regressing, or departing from its path. The tool automates much of the testing and scoring feedback loop so problematic patterns can be discovered and addressed. A core part of the offering is a specialized data store that can track large and sometimes deeply nested collections of tests and their results. Their approach may be summarized by one of their tag lines: “trace everything.”

Pricing: Free starter tier; Pro plan starts at $249 with some usage-based costs covered

Standout feature: Highly scalable trace ingestion

Best for: Teams developing strong guardrails through continuous testing

Chronicle Labs

When it’s time to release a new version of an agent into the wild, the platform from Chronicle Labs specializes in staging it and testing it with a collection of use tests and regression cases. The tools are also helpful during development cycles. “Backtest your agent against reality,” their sales material promises, with a set of tools that mines the production telemetry for solid test vectors that stress every part of the agent with prompts and challenges that the agent will encounter after leaving the safety of the lab.

Pricing: On request

Standout feature: Back-testing options for complex testing regimes

Best for: Teams chasing strong models with good fidelity to reality

Comet Opik

Building a dashboard for tracking every in-flow and out-flow to agents is one way to be ready to watch for and solve problems. Opik from Comet is just such a tool. The DevOps teams can track each call and add its own automated routines to examine the results, score them based on 30-plus metrics, and if desired, send it off to another LLM to evaluate the results. Agents that are constantly failing stand out. DevOps teams can also ask questions like, “Who is using this model and racking up all of the bills?” The same goes for MCP skills and other cogs in the machine.

Pricing: Free tiers for open source and small projects; Pro plan starts at $19 per month with usage limits

Standout feature: Auto-scoring with 30-plus metrics for evaluating traces

Best for: Teams focusing on RAG and agentic workflows

Datadog

DevOps teams that rely on Datadog to track logs across collections of services can also use it to track LLM operations, which are, of course, just another source and sink for data. It will track performance such as time to first token and offer insight into what might be causing an issue, such as lack of memory. Results then get plugged into the same cost-tracking mechanism so the bean counters can predict when the budget will run out. After all, the CFO likely doesn’t care whether the bill comes from an LLM or an old-school S3 storage bucket. Datadog integrates AI into their tools by treating these models as just another source of data.

Pricing: Small free tier with multiple paid tiers for various levels of enterprise monitoring

Standout feature: Large installed base with broad focus on more than LLMs

Best for: Large enterprise teams working with established infrastructure

Dynatrace

For more than 20 years, Dynatrace has been delivering tools that track dataflows across the full stack. Now that AIs are finding roles in many of the nodes in this complex graph, they’re expanding to track how various AI agents can interact. They want to build one platform that helps track the root cause and, often now, deploy solutions autonomously. They want to focus on being ready to support complex networks of agents that detect problems in either performance or security and then work within defined guardrails to fix them. Determining the right role for their own AI-powered agents is a key part of the product.

Pricing: Plans start at $7 per month with larger plans designed for full enterprise monitoring

Standout feature: High level of autonomous monitoring designed for large installations

Best for: Complex, hybrid environments mixing LLMs with traditional services

Galileo

Placing some AI systems into production is often a harrowing experience because the actual performance is impossible to predict, even with the most rigorous tests. Galileo offers guardrails that track performance and watch for any behavior that deviates from the ground truth. Their “LLM-as-judge” systems are distilled into compact models that can be run locally for lower costs and faster performance.

Pricing: Small free tier; Pro plans start at $50 per month with usage-based limits and costs

Standout feature: Real-time guardrails for deployed agents

Best for: Security-conscious installations that need to defend against hallucination and data leakage

Grafana Labs

Long the go-to source for open source telemetry, Grafana Labs now tracks performance of AI models in constellations of services. Grafana tracks the evolution of answers across the agentic network to recognize how small changes or hallucinations can spin out of control. It bills its system as “actually useful AI” and has even trademarked it. Its cloud assistant can configure and reconfigure the Grafana dash to offer the right level of observability. Its system includes AI-level analysis that can flag models that are responding quickly but offering bad answers because of problems such as model drift or context degradation.

Pricing: Basic free tier; Pro plan begins at $19 per month, includes better retention and some usage-based fees 

Standout feature: Full-stack tool with fully integrated LLM tools

Best for: Large, enterprise-scale system adding AI

Helicone

Sometimes shoehorning in another tool into the chain can be tricky. Helicone is designed as a smart network proxy that will route all model requests while keeping solid debugging records from the data as it goes by. The data it captures can be turned into nice charts that make it easy to spot latency issues or model failures. Naturally, tracking AI spend is also a feature in much demand as bills continue to climb.

Pricing: Small free tier; Pro plan starts at $79 per month, includes features such as team collaboration and improved querying

Standout feature: Proxy-based integration

Best for: Development teams who want to add better monitoring features quickly

Laminar

Tracking agents in development and production means building strong storehouses of data enumerating what happened. Laminar works closely with OpenTelemetry to follow agents operating in production so that flaws and failure modes can be understood from log files stored efficiently with their own compression scheme. Developers can search through traces with an SQL-ish language and Laminar’s transcript view illuminates what happened. When necessary, the traces can enable developers to scroll back in time and replay the same inputs for debugging. The goal is to offer deep insights with high-level visibility of how well the agents are meeting business objectives.

Pricing: Small free tier; “Hobby” tier that adds more features at $30; Pro level starts at $150 per month

Standout feature: Open-source license makes self-hosting a viable option

Best for: Teams fully able to leverage open-source responsibilities

LangChain LangSmith

Real-time data from agents is essential for managing any mutli-agent system in production. LangSmith from LangChain traces costs, tools, and progress toward solutions for a wide collection of agents using SDKs for Python, TypeScript, Go, and Java. The OpenTelemetry-based solution watches for anomalies, issuing warnings and alerts through dashboards and communication channels such as PagerDuty. Deeper analysis can reveal issues such as topic clustering or odd patterns of failure. Coordination with agent deployment platforms such as LangGraph and deepagents ensures greater focus on successful resolution of assignments.

Pricing: Free for solo developers; Pro teams start at $39 per person per month 

Standout feature: Systematic approach to regression testing of prompts

Best for: Teams relying on LangChain and LangGraph frameworks for supporting complex agentic behavior

Lunary

Watching the user experience is essential for building AI applications such as chatbots and assistants. Lunary offers a proxy that traces all interactions and then builds analytical dashboards for measuring metrics such as user satisfaction or model costs. One common usage is finding frequent topics and looking at the responses to ensure they deliver. When prompts aren’t perfect, Lunary lets teams iterate on the prompt text until the right answers are coming out. Its proxy structure and common API format enables Lunary to promise to work with “any LLM, any framework.”

Pricing: Free tier; Pro plan starts at $20 per month

Standout feature: Deep integration with humans for reviewing and optimizing results

Best for: Startups focused on rapid prompt innovation

NewRelic

The platform that began tracking performance of some web applications is now powerful enough to track the flows of data through complex agentic ecologies. NewRelic’s AI-driven monitoring watches for golden signals that can indicate misbehavior or worse throughout the entire lifecycle. It tracks every detail of the interactions through protocols such as MCP and then makes this available to the AI engineers responsible for performance. The dashboard provides the insights necessary to watch for toxic behavior, overt bias, drift, and overblown hallucinations. Predicting and maybe even controlling the cost is also a growing role as tokenomics becomes as important as response time.

Pricing: Free tier; Pro plan fees available through website

Standout feature: Full-stack support with hundreds of integrations with other tools

Best for: Established enterprise teams mixing in AI

Nova AI Ops

The goal of Nova AI Ops is to deliver a team of agents that watch over a cloud and make it, at least partially, self-healing. Each agent uses a mixture of predictive AI and machine learning to watch cloud telemetry reports for anomalies. Then they calculate the “blast radius” and decide whether this is a problem that can be fixed automatically “while you sleep” or saved for the human supervisors. These tools are aimed not just on LLM operations but on the stack as a whole.

Pricing: Small free tier; Standard pricing  begins at $40 per user per month with usage billing

Standout feature: Focus on software reliability engineering helps teams deliver stable stacks

Best for: Teams that want to integrate LLMs into incident response and stability management

Splunk

The platform that began delivering smart logging is now fully AI capable, offering solutions that can watch over agents with much the same way that it continues to track microservices. Splunk now includes a fairly large amount of predictive AI for learning from the information in the logs and then turning this learning into fast solutions. This AI assistant can track deployed AI models connected by protocols such as MCP and watch over behavior while delivering the ability for users to drill down and explore what’s working and what’s failing. Their AI Canvas is meant to offer a central hub where the AI scientists can track both the local behavior of the models as well as their role in a larger data ecosystem.

Pricing: Activity-based pricing tracks usage of LLM backends and storage

Standout feature: Ready to scale to large enterprise stacks

Best for: Teams with legacy systems that are folding in agentic options

SuperPenguin

One of the most important parts of an AI service is the bill. SuperPenguin is a product designed to track consumption and make predictions so that the CFO won’t be surprised. The goal is to provide solid estimates about the total cost of each product by allocating costs to customers, features, and teams. If there’s a sudden shift, a “spike detector” will raise an alarm so that dev teams can ensure that the AI spend is worth it.

Pricing: Small free tier for experimentation; Growth tier for teams, starting at $30 per month; Pro tier offers deeper options starting at $200 per month

Standout feature: Strong accounting with invoice reconciliation and PR-level usage tracking

Best for: Teams that need precise cost accounting

Vellum

Prompt engineers spend time fussing over the details of tweaking, improving, and enhancing the words that guide the LLM. Vellum started as a company that would provide the pipeline so that you could manage and improve the prompts that ran again and again. Now the system is growing more powerful, offering a higher level of automation that lets you meta-manage the prompt chain. They’ve also begun marketing it as a form of personal assistant with pre-built connections to many of the major services such as Gmail. Its llm-cost-optimizer can juggle multiple options while finding a cheaper way to execute a prompt, a process the company suggests can save 60% or more.

Pricing: Open-source free tier; Pro plan starts at $35 per month

Standout feature: Focus on multi-model pipelines for true agentic solutions

Best for: Product teams with complex prompt engineering workflows

]]> <![CDATA[New agentic compute patterns]]> https://tsecurity.de/de/3672922/ai-nachrichten/new-agentic-compute-patterns/ https://tsecurity.de/de/3672922/ai-nachrichten/new-agentic-compute-patterns/ Thu, 16 Jul 2026 11:19:03 +0200 🔧 AI Nachrichten tsecurity.de

For a decade, Kubernetes was the right answer. It organized containers, scaled services horizontally and gave platform teams a shared vocabulary for running software in production. It abstracted away enough of the underlying complexity that engineers could stop thinking about servers and start thinking about services. Most cloud-native infrastructure today is built on top of it, directly or in spirit, and EKS made that model the default for the majority of enterprise teams running workloads on AWS.

The workload that defined that era was the stateless HTTP request, fast in, fast out, disposable. A user action triggers a request, the request hits a service, the service returns a response and the container is done. Kubernetes was optimized for that pattern down to the scheduler internals: Bin-pack containers onto nodes, autoscale on CPU and memory, evict and reschedule when something goes wrong. The whole system is tuned around the assumption that individual units of work are short, stateless and interchangeable.

That assumption no longer holds for the workloads that matter most right now.

The agent workload is structurally different

Agents are long-running, stateful processes. They reason across time, call external tools, spawn subprocesses, write and execute code, and make decisions that depend on what happened five steps earlier in the same task. A single-agent workflow might run for minutes or hours, touching a dozen external systems and generating intermediate outputs that subsequent steps depend on. The compute layer for that kind of work needs to do things the old model was never asked to do. That is the new pattern: Execution infrastructure designed around agent semantics rather than request semantics.

The Kubernetes community itself has acknowledged this mismatch. In March 2026, Kubernetes SIG Apps published an introduction to Agent Sandbox, a new CRD-based abstraction designed specifically for singleton, stateful agent workloads. The framing is direct: The ecosystem is moving from short-lived, isolated tasks to deploying multiple, coordinated AI agents that run continuously, and mapping those workloads to traditional Kubernetes primitives requires an entirely new abstraction. The fact that the Kubernetes maintainers built a dedicated primitive for this, rather than recommending teams compose one from existing resources, is itself the clearest signal that agent execution does not fit the old model.

What agent execution actually requires

Concretely, it requires four things. First, isolated execution environments that provision in milliseconds, not minutes, so each agent task gets its own sandbox for code execution and tool calls without blocking the reasoning loop. The difference between a two-second environment and a two-minute environment is not a performance optimization; it determines whether the architecture is viable at all. Second, durable state management across the full task lifecycle, so an agent can pause, hand off or resume without re-initializing from scratch and burning tokens to reconstruct context it already built. Third, coordination primitives for multi-agent work: The ability to spawn subagents, pass structured outputs between them and track task dependencies across a graph of concurrent processes. Production agent systems are rarely single agents; they are pipelines of specialized agents with handoffs that need to be reliable and inspectable. Fourth, credentials and secrets management that travel with the execution context, so agents can authenticate to external services securely without exposing credentials in the task definition, logs or the environment variables of a shared container.

The mismatch shows up fast in production

Kubernetes and EKS expose the mismatch quickly in practice. Pod eviction terminates an agent mid-task with no clean recovery path. Autoscaling reads CPU utilization as the load signal, but an agent holding a long inference connection looks idle to the scheduler even when it is doing the most consequential work in the pipeline. Provisioning a new environment takes 45 seconds to two minutes on a well-tuned cluster; agent workloads need that in under two seconds or the reasoning loop stalls and the user experience degrades visibly. These are not edge cases or misconfigurations. They are the normal operating conditions for production agent workloads running on infrastructure that was not designed for them.

The utilization data makes the broader cost picture even starker. The 2026 State of Kubernetes Optimization Report from CAST AI, drawn from analysis of over 23,000 production clusters across AWS, Azure and GCP, found average CPU utilization at 8 percent, down from 10 percent the year prior. Memory utilization fell from 23 to 20 percent. CPU overprovisioning jumped from 40 to 69 percent year over year. These numbers reflect clusters running traditional workloads, and the pattern is worsening, not improving, as environments scale. Agent workloads compound this problem further. An agent holding an open inference connection or waiting on a tool call registers as idle to a scheduler that reads CPU and memory as the only meaningful load signals. The infrastructure responds to the wrong metric, overprovisioning capacity for demand it cannot measure, while the actual bottleneck, environment provisioning latency and state continuity, goes unaddressed.

Security is not the same problem it was before

Agent workloads change the threat model at the infrastructure level. A compromised stateless service exposes a narrow surface defined by its API contracts. A compromised agent exposes every system it can reach, every credential it holds and every action it is authorized to take on behalf of the user. Agents generate and execute their own code, make non-deterministic tool-call decisions and accumulate context across long-running sessions. Standard container namespacing does not contain that kind of risk. Kernel-level isolation, default-deny network egress, scoped credentials per session and agent-aware observability are not optional hardening steps. They are baseline requirements for running agents in production.

What teams that ship agents have already figured out

Some of the clearest evidence for this shift comes not from infrastructure vendors but from product engineering teams running agents at scale on their own code. In late 2025, Ramp’s engineering team published a detailed account of building Inspect, their internal background coding agent. Each Inspect session runs in a sandboxed VM with a full-stack development environment and deep integrations across their observability, CI, and deployment tooling. The architecture requirements map almost exactly to the four primitives above. Filesystem snapshots keep sessions starting in seconds rather than minutes. Sessions are isolated and stateful. The agent can run tests, review telemetry, query feature flags and visually verify frontend changes in a real browser. And the whole system supports unlimited concurrency, so engineers can spin up ten parallel sessions exploring different approaches to the same problem without contention.

The results speak for themselves. Within months of launch, roughly 30 percent of all pull requests merged to Ramp’s frontend and backend repositories were written by Inspect. That level of adoption was not mandated. It happened because the execution environment was fast enough, capable enough and well-integrated enough that the agent was strictly better than a local workflow for a meaningful share of tasks. The key insight from the Ramp case is not about the model. It is about the execution layer. As their team put it, session speed should only be limited by model-provider time-to-first-token; everything else, like cloning and installing, needs to be done before the session starts. That is a statement about infrastructure, not intelligence.

The ecosystem is catching up, but defaults are sticky

None of that is a criticism of the tools. Kubernetes solved exactly the problem it was designed for, and it solved it well. The issue is that infrastructure defaults are sticky. Teams inherit them, build on top of them and optimize within their constraints long after the underlying workload has changed. The Kubernetes community’s own response, the Agent Sandbox project under SIG Apps, validates the thesis that a new abstraction is necessary. The new primitives the community is building include warm pools for near-zero cold starts, lifecycle management for suspending and resuming idle agents without losing state, and pluggable kernel isolation for secure execution of untrusted code. These are not incremental improvements to existing resources. They are net-new abstractions that acknowledge the old model does not stretch to fit.

But adoption of purpose-built agent infrastructure remains early. Enterprises building agent pipelines today are largely running a request-oriented orchestration model against an execution-oriented workload, and the mismatch shows up in task failure rates, runaway costs and debugging cycles that have no good tooling because the observability layer was also designed for stateless services.

The structural advantage is available now

The infrastructure to close that gap exists now. The prerequisite is recognizing that agent execution is a first-class compute pattern with its own primitives and its own requirements, not a variant of the stateless service model that defined the last decade. Teams that make that shift early will have a meaningful structural advantage. The ones that do not will spend the next two years wondering why their agent systems are unreliable at a scale that should be tractable.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Amazon AGI director says AI agent reliability, not capability, is blocking enterprise deployment at VB Transform 2026]]> https://tsecurity.de/de/3672035/it-nachrichten/amazon-agi-director-says-ai-agent-reliability-not-capability-is-blocking-enterprise-deployment-at-vb-transform-2026/ https://tsecurity.de/de/3672035/it-nachrichten/amazon-agi-director-says-ai-agent-reliability-not-capability-is-blocking-enterprise-deployment-at-vb-transform-2026/ Thu, 16 Jul 2026 00:46:38 +0200 📰 IT Nachrichten tsecurity.de The enterprise AI industry has a math problem. Cisco data shows 85% of enterprises are piloting AI agents, but only 5% have shipped them to production. At VB Transform 2026 on Tuesday, Bryan Silverthorn, Director of AGI Autonomy at Amazon, explained why that gap persists — and why the answer isn't better benchmarks.

Silverthorn, who joined Amazon through its acquisition of Adept AI and now leads multimodal agent training inside the company's AGI lab, argued that reliability must be broken into four distinct dimensions: consistency, robustness, predictability, and safety — a framework he credits to research from Princeton.

"It unpacks different factors that I see tangled together in almost every eval I've ever seen," he said.

Why AI agents pass internal evals but fail real customers in production

The framework matters because agents routinely ace internal evaluations and then collapse in the wild. Silverthorn described a customer that deployed an agent for software QA involving serial number extraction from screens. It worked flawlessly for two months — then began intermittently reading wrong numbers. The culprit: the underlying vision encoder behaved differently depending on where the serial number appeared on screen, and a software change imperceptible to humans triggered the failure.

The lesson, Silverthorn said, is about measurement, not just models. "The models have to be better. Obviously, we're working hard on making the models better," he said. But the deeper takeaway, he added, is that teams need to identify their dimensions of variability and match measurement rigor to the stakes of the application. VentureBeat's own proprietary research, presented before the session, reinforces the point: half of surveyed companies shipped agents that passed internal evals but failed real customers, and enterprises overwhelmingly track uptime while ignoring accuracy — checking the pulse without checking the diagnosis. A related finding underscored how few guardrails exist: most enterprises default to the model makers' own evaluations and little else, leaving their testing strategy, as I described it on stage, a coin flip between trusting the vendor and trusting nothing.

Inside Amazon's 'intern' framework for managing autonomous AI agents

Silverthorn's most memorable prescription was cultural, not technical. Inside Amazon's AGI lab, researchers literally call their agents "interns" — as in, "I'll have my intern talk to your intern." The joke carries a serious operational philosophy. Agents, like interns, are powerful but occasionally clueless, capable of amazing work and spectacular derailment.

Managing them, he argued, requires management skills rather than software skills: asking what could go wrong, adding backups and undo capabilities, and consciously deciding what risk you can accept. "You can ask the intern, 'Hey, what might you do wrong here? How might you mitigate your negative outcomes?'" he said. Amazon's lab has embraced that trade-off, accepting agents occasionally running the wrong experiment in exchange for research velocity — including one agent running experiments around the clock on its own high-level research plan.

What enterprise leaders should do before deploying agents at scale

Silverthorn was candid about the limits of today's technology. Self-improving AI remains "a loaded term," he said — Amazon uses AI to improve its models constantly, but fully autonomous self-improvement is distant. Computer use remains a core focus of his lab, with a commercial trucking customer already using browser automation to stitch together warranty claims across fragmented systems**, though he stressed that no future agent will rely on computer use alone — it will work alongside MCP, APIs, and other tools to complete end-to-end workflows**. And LLM-as-judge techniques, while promising, are just one of several strategies for aligning agent capability with acceptable risk.

For enterprises stuck in pilot purgatory, the path forward starts with a mindset shift: stop asking whether your agent can do something impressive once, and start asking whether it can do it correctly a thousand times in a row.

In other words, the enterprises that escape the 85% ceiling won't be the ones with the smartest agents. They'll be the ones with the best managers.

]]> <![CDATA[AI Hardware Shortages: How Enterprises Can Do More With Existing Infrastructure]]> https://tsecurity.de/de/3671767/unix-server/ai-hardware-shortages-how-enterprises-can-do-more-with-existing-infrastructure/ https://tsecurity.de/de/3671767/unix-server/ai-hardware-shortages-how-enterprises-can-do-more-with-existing-infrastructure/ Wed, 15 Jul 2026 22:01:07 +0200 🐧 Unix Server tsecurity.de Key takeaways AI hardware shortages are forcing enterprises to rethink how they plan, deploy and scale AI infrastructure. GPU shortages, procurement delays and rising infrastructure costs are delaying enterprise IT projects, not just AI initiatives. Organizations can reduce the impact of hardware constraints by improving utilization, increasing portability, optimizing existing infrastructure, and using MSP or [
]

The post AI Hardware Shortages: How Enterprises Can Do More With Existing Infrastructure appeared first on SUSE Communities.

]]> <![CDATA[Built Technologies builds an AI-powered document intelligence solution on AWS to power agents across real estate finance]]> https://tsecurity.de/de/3671598/ai-nachrichten/built-technologies-builds-an-ai-powered-document-intelligence-solution-on-aws-to-power-agents-across-real-estate-finance/ https://tsecurity.de/de/3671598/ai-nachrichten/built-technologies-builds-an-ai-powered-document-intelligence-solution-on-aws-to-power-agents-across-real-estate-finance/ Wed, 15 Jul 2026 20:18:41 +0200 🔧 AI Nachrichten tsecurity.de <![CDATA[Now available: group conversations with external collaborators in Google Chat]]> https://tsecurity.de/de/3671492/web-tipps/now-available-group-conversations-with-external-collaborators-in-google-chat/ https://tsecurity.de/de/3671492/web-tipps/now-available-group-conversations-with-external-collaborators-in-google-chat/ Wed, 15 Jul 2026 19:28:02 +0200 Web Tipps tsecurity.de For many teams, it’s essential to be able to work in real-time with partners from outside your organization. We’re improving external collaboration in Google Chat by making it possible to create group conversations that include external users.

Previously, teams using Google Chat could only create 1:1 conversations with external users, or create a space in Chat with external access enabled.

With this update, it’s now possible to create group conversations with multiple external users, reducing friction and streamlining external collaboration. No additional configuration is required, and access for external users is enabled once they accept an invitation through an email notification. Group conversations with external members are labeled with a visible badge to help ensure that users are aware of the context for all conversations in Chat.


Getting started

  • Admins: External group DMs share the same admin controls as external spaces. Ensure that the External spaces & group direct messages admin setting is enabled for your organization to allow users to create or join external group DMs.
  • End users: If allowed by their admin, end users can add external users when they create a new group DM. External users can’t be added to existing group DMs that only have internal users. External users who are added to group DMs will receive an email invitation and must accept the invitation to participate in the group conversation.

Rollout pace

Availability

  • Available to all Google Workspace customers and Workspace Individual subscribers

Resources

]]> <![CDATA[Which AI model should you bet your company on? None of them]]> https://tsecurity.de/de/3671165/ai-nachrichten/which-ai-model-should-you-bet-your-company-on-none-of-them/ https://tsecurity.de/de/3671165/ai-nachrichten/which-ai-model-should-you-bet-your-company-on-none-of-them/ Wed, 15 Jul 2026 17:19:39 +0200 🔧 AI Nachrichten tsecurity.de

Every day this past week I did something I suspect millions of other people also did: I stared at an LLM model picker and wondered which one I was supposed to want.

OpenAI just released ⁠GPT-5.6 Sol, Terra, and Luna. Sol is the flagship. Terra offers much of its intelligence for less money. Luna is cheaper still. Anthropic released ⁠Claude Sonnet 5 at the end of June and Opus 4.8 the month prior, with a little Fable 5 emerging in between. Meanwhile, Google, which seemed to be winning the model wars a few months ago, is now getting shade from Gergely Orosz, who ⁠argues that Gemini has slipped outside the top tier for software development and has been out of the major model release game for eons (May 19).

Perhaps Orosz is right. Perhaps he’ll be wrong again in six weeks. Honestly, it’s exhausting.

I use ChatGPT and Claude constantly and still have no principled idea which model to choose most of the time. I tend to click whatever looks like the biggest, most expensive option because I don’t know what I’m giving up by choosing something smaller. “Instant” sounds dangerously unserious. “Thinking” sounds expensive but powerful.

A quick survey of my LinkedIn crowd suggests others also feel my “WHICH MODEL???” pain. More importantly, I suspect most enterprises do, too.

A model doesn’t rot

Before getting carried away, however, it’s worth considering whether any of this model churn actually matters. After all, a model doesn’t rot. The model an enterprise put into production in March performs just as well in July as it did when the company selected it. “Obsolete” generally means that something better now exists, not that the deployed model suddenly stopped summarizing insurance claims or classifying support tickets. (In other words, once you have something working, the idea that “but maybe Opus 200.2 is better!” is really a FOMO problem, not a performance issue.)

Most enterprise workloads don’t live at the frontier anyway. Extraction, summarization, classification, document comparison, and customer-service assistance often work perfectly well with smaller, cheaper models. OpenAI’s own pitch for the trio of GPT-5.6 models isn’t simply that Sol is better. It’s that ⁠Terra and Luna deliver different combinations of intelligence, latency, and cost. Luna, the cheapest tier, nearly matches the previous generation’s peak performance at less than half the estimated cost, according to OpenAI.

The practical question, of course, is where to start. An enterprise can’t test every model, every reasoning setting, and every price tier before doing any work. So here’s my advice (which I don’t follow in my own work, but I’m not defining enterprise strategy and can be a little price-insensitive). Start with the cheapest credible model that appears capable of the task. Give it a representative set of real examples and, before you start testing, define what counts as good enough. If it passes, stop. If it fails, move up a tier or try a model with strengths better suited to the work.

That sounds almost offensively simple, but it reverses the way many people, including me, use these products. We start with the biggest model because we’re afraid of what we might lose. Enterprises should start lower and require evidence before paying for more intelligence.

There are exceptions, of course. For genuinely difficult work, such as autonomous coding, complex research, or high-stakes reasoning, beginning with a frontier model may save time. But even then, the goal should be to establish a quality ceiling, then test whether a cheaper model can meet it. It’s changing the question from “which model is best?” to “what is the least expensive model that reliably clears the bar for this job?”

For many workloads, that price improvement matters more than a few extra benchmark points. ⁠As I argued back in 2023, following AI hype doesn’t help anyone. If your model strategy depends on whichever benchmark screenshot is circulating on X this week, you don’t have a strategy. Not a viable one, anyway. Pick a model and ignore the noise.

Except, of course, when that noise suggests a serious signal.

Sometimes better really is better

Frontier improvements aren’t always incremental, making it advantageous to consider an upgrade. Coding is the obvious example. There’s a significant difference between a model that suggests the next few lines of code and one that can inspect a repository, plan a change, use tools, run tests, discover its own mistakes, and keep working for an extended period. That isn’t merely a nicer autocomplete experience. It can reorganize a development workflow.

This is why enterprises can’t simply standardize on an 18-month-old model and declare victory. In some areas, particularly software development and other agentic work, better models can unlock compounding productivity. A model that reliably completes 80% of a bounded task rather than 50% may justify an entirely different division of labor between humans and machines.

Still, that upgrade isn’t free.

Models differ in how they interpret instructions, call tools, manage context, refuse requests, and fail. Prompts and scaffolding tuned for one model can regress when moved to another. Or costs can explode. As one of my Oracle colleagues discovered just this week, running the same tasks in GPT 5.6 was orders of magnitude more expensive than 5.5. The API change may be trivial, but the revalidation and implications are not.

This leaves enterprises caught between two bad options. They can freeze and potentially miss out on meaningful improvements or chase every release and repeatedly test production systems on faith. What to do?

Stop making model bets

The answer is to stop making LLM bets and start making job-to-be-done bets. Stop asking which model is fastest. Instead, figure out what work you are trying to improve. What does a good result look like? How much latency and cost can the workflow tolerate? How wrong can it be before a human must intervene? Once those questions have answers, model selection becomes less opaque.

A difficult code migration may justify GPT-5.6 Sol or Claude Sonnet 5. A repetitive classification task may work just as well with Luna or another smaller model. A regulated workflow may require a model or deployment option that offers particular data controls. Sometimes the correct model is no LLM at all, like when I’m writing this post. Sorry, AI vendors! (At least you won’t get blamed for my mistakes.)

This is where evaluations become the center of enterprise AI strategy. ⁠As I’ve said before, most companies don’t have an AI quality problem so much as an AI measurement problem. Hence, a private evaluation suite built from real company work is the only leaderboard that matters. Does the new model materially improve quality? If so, use it! Does it reduce cost or latency? Again, that’s your free pass to adoption. Does the improvement justify the expense and effort of revalidation? If yes, continue.

Make model releases boring

As important as the model is, keep in mind that AI success always comes back to your company’s data, your company’s workflows, your company’s integrations, etc. That’s the ⁠dull reality behind sexy AI. Retrieval, memory, governance, data quality, observability, and feedback loops aren’t as exciting as a new model launch, but they’re what ultimately make AI truly work.

Again, when it’s time to consider something new, the principle should be to default to the least expensive model that reliably passes your evaluations. Only escalate harder tasks to more capable models when measurement shows that the premium pays. Tip: Make this invisible to employees so that the system routes to the best model for a particular prompt. As dbt Labs’ Jon Lewis expresses it, “The best model is ‘Auto’ and I won’t hear anyone say otherwise.” OpenAI’s own ⁠migration guidance recommends testing models on representative tasks, including trying a lower reasoning level rather than automatically cranking everything to the maximum.

As for me, I’ll probably keep clicking the shiniest option. I don’t have a formal evaluation suite for InfoWorld columns, and the marginal cost is a subscription I already pay. Enterprises don’t get that excuse.

]]> <![CDATA[From story points to tokenmaxxing: Why engineering keeps measuring the wrong things]]> https://tsecurity.de/de/3671158/ai-nachrichten/from-story-points-to-tokenmaxxing-why-engineering-keeps-measuring-the-wrong-things/ https://tsecurity.de/de/3671158/ai-nachrichten/from-story-points-to-tokenmaxxing-why-engineering-keeps-measuring-the-wrong-things/ Wed, 15 Jul 2026 17:19:30 +0200 🔧 AI Nachrichten tsecurity.de

For decades, software engineering has been plagued by “productivity theater.” Every few years, the industry aligns around a new vanity metric — usually one that latches onto whatever technology happens to be in vogue at the time. For a discipline rooted in creativity and problem-solving, this is a poor way to demonstrate progress. Yet, we find ourselves in this position once again. The pattern is often the same: reach for something we can easily count, and in doing so, lose sight of what we are actually trying to achieve.

Quantity over quality: the wrong measurement, every time

I recall when I was coming up as a software engineer in the 1990s, a small number of companies took up the practice of paying their engineers by each line of code. This may have been productivity theater at its worst, leading to negative incentives, inefficient processes, and just generally bad engineering. Developers were rewarded for writing far more code than the problems they were facing required — classic “quantity over quality” — and the result was bloated, brittle codebases that were all but impossible to maintain. The goal — to create reliable software that solved real user problems — got buried under the incentive to produce.

Then in the 2000s, the rise of Agile brought us story points, an abstract way to estimate task complexity, effort, and risk relative to other work. Rather than answering “How long will this take?,” story points were meant to answer, “How big is this compared to what we’ve done before?” This approach sounds good in theory, but in practice, some development teams learned to game the system by inflating estimates, over-engineering solutions to look productive, and losing sight of whether the work they produced actually created value. Once again, the metric became the goal, and the actual goal — delivering outcomes that mattered to the business — became secondary.

Every one of these metrics failed for the same reason: they measured effort instead of value.

Quantity in the age of AI

Today, “tokenmaxxing,” a trend in which developers and teams optimize for consuming as many AI model tokens as possible, treats raw consumption as an equivalent for output. As I see it, this is the latest flawed productivity metric to make its way into the world of software engineering. Tokenmaxxing is nothing more than another vanity metric, and is just as useless as using “lines of code” or inflated “story points” as a benchmark.

Tokenmaxxing is the result of a few different behaviors, including:

  • Prompt flooding: stuffing massive codebases, documentation, and context into every prompt, burning tokens on context the model doesn’t actually need.
  • Agent swarms: running multiple AI agents in parallel to maximize code output, regardless of whether the work is coordinated or coherent.
  • Background loops: keeping AI sessions or agents running continuously in the background, racking up token spend without clear ownership of what is being produced — or why.


Now, it is no secret that AI is reshaping how software is developed, and these behaviors are the result of that reshaping. Providing AI with codebases, running multiple agents at once, and even relying on coding assistants for help all have their uses. But when we lose control of the changes we are making and why we are making them, we find ourselves facing a new version of the same old problem: measuring engineering productivity with the wrong metrics.

A more useful question to ask isn’t, “How many tokens did we spend?” but rather, “What problem did we actually solve, and for whom?”

Spending resources without goals

Yes, AI is giving software engineers the ability to do more with less, to move quickly, and to experiment in ways that were previously out of reach. But leaning on AI to perform productivity, rather than deliver it, is a trap that will cost us in code quality, team capability, and business credibility.

As a CTO, I am all for experimenting with AI. I want to use it to make our programs better, stronger, and future-proof. What I don’t want is for it to drive us toward excess while leaving us with little to show for it.

The test I keep coming back to is simple: does this AI-generated output help us ship something that matters? Does it reduce friction for a user, close a gap in a workflow, or improve reliability for a customer? If the answer isn’t clear, then we are spending resources — both human and computational — without a defined goal. And that is not engineering. That is activity.

Spec-driven development: where value gets defined

It is time to adopt newer approaches like spec-driven development, a method where engineers write detailed specifications first and AI generates code against them. Rather than relying on prompt flooding and agent swarms and hoping AI produces the best result, we need to shift toward defining requirements, reviewing AI-generated output, and orchestrating systems with intent.

But spec-driven development is more than a methodology. It is the place where engineering intent and business value get defined together. The spec is where you answer, “Why does this matter, and what problem are we solving?” before a single token gets spent.

Software engineers have long taken pride in writing elegant code, and I would hate to see AI cheapen that pride rather than elevate it. In an AI-first world, the craft shouldn’t disappear; it should simply move upstream. The spec is where elegance lives now, and it deserves the same attention to detail we once reserved for the code itself.

At its core, software engineering is about defining, analyzing, and resolving technical challenges. If we are willingly giving all of that up to AI, we will lose the integrity of our discipline and the ability to prove our value. Using the maximum number of tokens to produce code isn’t impressive. Using a well-crafted, intentional prompt to solve a specific problem? That’s the work worth celebrating.

Stop performing productivity and start delivering it

We are at an inflection point. Many organizations are defaulting to activity-based metrics, measuring how much AI is being used rather than whether it is improving delivery, product quality, or business outcomes.

The question worth asking is not, “How much AI did we use this sprint?” It is “What value did we deliver for our users, our team, or our business?” Was it the ability to resolve a critical bug more quickly? Reduced cycle time on a high-value feature? A customer workflow that now takes minutes instead of hours? Those are outcomes. Those are the things worth measuring.

AI can help us deliver meaningful outcomes faster, but only if we use it with the same rigor and intent we expect from every other engineering or business decision. Don’t let it become another form of productivity theater. The most successful engineering organizations in the age of AI won’t be the ones that consumed the most tokens, they’ll be the organizations that never lost sight of why they were building in the first place.

—

New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.

]]> <![CDATA[The next challenge for coding agents]]> https://tsecurity.de/de/3671152/ai-nachrichten/the-next-challenge-for-coding-agents/ https://tsecurity.de/de/3671152/ai-nachrichten/the-next-challenge-for-coding-agents/ Wed, 15 Jul 2026 17:19:21 +0200 🔧 AI Nachrichten tsecurity.de

On the first day of Software Engineering 101, you learned about the SDLC — the software development life cycle. You learned that there is a whole lot more to producing quality software than writing some code and deploying it to production. We’ve studied the SDLC every which way, and we know where and how time is spent within it.

The coding is the most interesting part of the SDLC. It is one of a number of steps in the process, but it’s the part that takes up the biggest chunk of the SDLC schedule.

Agentic coding has changed all of that. I wrote earlier this year about the impacts upstream of coding when writing code is no longer the bottleneck. Here I want to think about the impacts for developers downstream — what we can expect to happen after the code gets written — when agents write the code.

Downstream from coding

Even before agentic coding, we developers spent far more time reading and maintaining code than we spent writing it. Maintaining the code and supporting the product has always been the major lifetime cost of the project as a whole. Now that the bottleneck has moved away from the coding process, we will look for ways to apply AI agents downstream of writing code. So, just as agentic AI has made writing code trivial, we can expect it to improve the remaining 60% to 70% of our job as well.

Maintenance of code can be a real challenge. We are all familiar with how it often goes. We get a vague customer report of a problem along with a copious log, and we have to dive in and make sense of a very complex situation. The application has hundreds of settings and options, making the potential code paths practically infinite. Maybe we have a copy of the customer’s database with their precise settings, or maybe we just know they have one specific setting inside the problem feature set. Maybe we can reproduce the problem. Maybe we can’t. It’s almost always vague and confusing.

Here’s where agents can really shine. Normally, a huge log is a problem. What mere mortal can sift through the thousands of entries that our powerful logging tools can produce? No human, but Claude Code will happily gobble up all of that data and quickly zero in on the problem. And by quickly, I mean frequently in a matter of minutes or seconds. 

The next choke point

Or as Spiros Xanthos, the CEO of Resolve AI — producer of a tool specifically designed for applying agents to production problems — says, “The real opportunity is purpose-built AI that can carry more of the cognitive load of production
 If we get that right, developers spend less time manually piecing together what happened and more time building and improving the systems they own.”

I’ll venture to say that dealing with production problems is more challenging than writing code, both for humans and agents. But agents have huge contexts and infinite patience, and we humans do not. Code is a bounded system, and agents can train on an enormous body of data illustrating a vast array of coding techniques. Production? As Xanthos put it to me, it’s effectively unbounded, enormously varying, and a living, breathing system different for every product and every company. 

We should always focus on the tightest bottleneck, and then move on to the next one. We’ve solved the coding choke point, and now we need to turn our attention to the next one — fixing production issues. That’s a non-trivial part of a developer’s job, and we shouldn’t be surprised that AI agents can do it better than we can.

]]> <![CDATA[Apple Tests AI Technology That Could Make iPhones Work Smarter]]> https://tsecurity.de/de/3671146/it-nachrichten/apple-tests-ai-technology-that-could-make-iphones-work-smarter/ https://tsecurity.de/de/3671146/it-nachrichten/apple-tests-ai-technology-that-could-make-iphones-work-smarter/ Wed, 15 Jul 2026 17:18:24 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers]]> https://tsecurity.de/de/3671055/it-security-nachrichten/establishing-a-coordinated-vulnerability-disclosure-program-to-work-with-security-researchers/ https://tsecurity.de/de/3671055/it-security-nachrichten/establishing-a-coordinated-vulnerability-disclosure-program-to-work-with-security-researchers/ Wed, 15 Jul 2026 16:55:56 +0200 📰 IT Security Nachrichten tsecurity.de Developed by CISA, the National Security Agency (NSA) and international partners, this joint guidance contains best practices for software manufacturers and online service providers to design and implement a coordinated vulnerability disclosure (CVD) program for working with external security researchers that includes a clear vulnerability disclosure policy (VDP) and process for triaging, remediating and assigning Common Vulnerabilities and Exposures (CVE) identifiers to reported vulnerabilities. The guidance also provides considerations for leveraging third-party intermediaries, like CISA or other national computer security incident response teams, to substitute or supplement a CVD program. By implementing a robust CVD program aligned with this guidance, organizations can work transparently and collaboratively with security researchers to remediate vulnerabilities, build constructive relationships, enhance product security while improving vulnerability management processes, and demonstrate their dedication to protecting customers.

]]> <![CDATA[How to unionize your tech workplace]]> https://tsecurity.de/de/3670454/it-nachrichten/how-to-unionize-your-tech-workplace/ https://tsecurity.de/de/3670454/it-nachrichten/how-to-unionize-your-tech-workplace/ Wed, 15 Jul 2026 13:18:09 +0200 📰 IT Nachrichten tsecurity.de

This is Part 2 of a series on tech worker unionization. See Part 1: “A brewing battle: More IT workers want unions. The industry doesn’t.”

The best time for tech workers to unionize was 20 years ago, when they had plenty of leverage. The second-best time is now, when they don’t.

Mass layoffs, AI-driven displacement, corporate surveillance, workplace disillusionment have created conditions that have made organizing compelling for tech professionals. But the federal labor board that has historically protected workers’ right to organize has been weakened, and the companies that once feared it are openly defying it.

Here’s how organizers and labor experts describe the pros and cons to organizing — and how you can get started.

What unions can — and can’t — do for you

The single biggest benefit of a union contract for most tech workers isn’t pay — it’s protection against arbitrary termination, especially in the wake of recent mass layoffs in tech. In the United States, nonunion “at-will” workers can be fired at any time without a stated reason, while unionized workers negotiate protections written into their contracts.

“That fear of the company letting you go for anything at any time
with a union they just can’t do that,” says Zak Thompson, a senior software engineer at Kickstarter and union steward at Kickstarter United. Now that Kickstarter employees are unionized, people are less worried that saying something negative will result in termination.

“I’ve been shocked at the willingness of my co-workers to speak up against what they see as poor or controversial business decisions,” Thompson says.

width="972" height="972" sizes="auto, (max-width: 972px) 100vw, 972px">

Zak Thompson from Kickstarter United


Fee Christoph

Beyond job security, unions can deliver concrete material gains. Kickstarter United was formed in 2020, although getting there wasn’t easy: two employees were fired during the organizing campaign — which itself became a galvanizing event. And while the union hasn’t been able to prevent layoffs, it did negotiate better terms: four months of severance pay and four to six months of continued health insurance, versus the two to three weeks per year of work that management had initially proposed.

Other benefits include a four-day work week; AI protections; a minimum pay floor; and standards for raises, promotions, and time off for the company’s 59 employees.

Unions can give tech workers a voice in decisions that affect their daily work — including how AI tools are deployed. “Nobody I’ve spoken to is against new technology or getting trained in it,” says Max Belasco, a business systems analyst at the University of California Los Angeles School of Law and co-chair of the UCLA chapter of the University Professional and Technical Employees/Communications Workers of America (UPTE-CWA) Local 9119.

“But when new technology is being implemented, we want to know: what’s the five-year vision, the 10-year vision? Are we implementing this in a way that betters staffing, increases efficiency, or eases the lives of people already working? Or are we trying to take away jobs, automate people out of their pension or paycheck?” Belasco says.

The challenges are real. Tech professionals are less inclined to leave their jobs in the current market because wages haven’t been increasing as fast as they once were, and it can take longer to land another job.

“Tech moved from a very tight labor market in 2022 (1.85% unemployment rate) to a noticeably weaker one in 2024–2026 (3.49%),” although that’s still better than the national unemployment rate of 4.36% through May of this year, says Liya Palagashvili, senior research fellow and director of the Labor Policy Project at the Mercatus Center at George Mason University.

width="960" height="640" sizes="auto, (max-width: 960px) 100vw, 960px">

Liya Palagashvili of the Mercatus Center at George Mason University

Mercatus Center at George Mason University

Flexibility is a concern. The more substantive challenge, raised by economists including Palagashvili, is that traditional union contracts impose uniform terms across an entire bargaining unit, limiting the flexibility that many tech workers — and their employers —currently enjoy. Tech firms need to move fast, adjusting teams, products, and roles on the fly.

“Collective bargaining agreements can make those adjustments much more difficult, whether by making them slower, costlier, or inconsistent with the contract,” she says.

Workers skeptical of unions in a survey of 1,900 tech professionals conducted by the career site Blind cited specific concerns: that unions are “not meritocratic,” “prevent innovation,” and “hold back earnings of top performers.”

Thompson from Kickstarter United pushes back: “We have nothing in our contract about ‘you can’t bend down and pick up a piece of trash because that’s someone else’s job.’ The company is free to give bonuses and individual raises as much as they like. This is all just up to the people who are bargaining the contract from the union side.”

Organizing carries potentially serious personal risks. During negotiations for a second three-year contract in 2025, Kickstarter United went on strike for 42 days. A few months later, the company announced layoffs.

“They let go strong union leaders, including a person who had bargained our last contract,” Thompson says. The union appealed, and the issue is now going to arbitration.

If you form a union, don’t expect much support from the National Labor Relations Board, the agency that certifies US labor unions and protects workers’ right to organize, in terms of prosecuting complaints of unfair labor practices, Thompson warns. “We’re in a political moment in this country with a pretty weakened NLRB. You have to be ready to organize and withhold worker power without any guarantee of safety.”

Organizers are up against an enormous union avoidance industry. Organizers can expect fierce pushback as soon as the business discovers that organizing is underway.

“There’s a multi-billion-dollar industry in union avoidance,” says Alan McAvinney, a Google software engineer and organizing chair, Alphabet Workers Union-CWA, a 1,400-member minority union of Alphabet employees. (Google is a subsidiary of Alphabet.)

US employers spend roughly $1.7 billion a year on union avoidance consultants and law firms, according to a May 2026 report by the Economic Policy Institute and LaborLab.

Expect hardball tactics. Management may play hardball during the time between when organizers announce their intention to unionize and the actual vote. For example, management can threaten to fire foreign-born workers in the US on H-1B visas if they support the union. Those workers would then have just 60 days to find a new sponsoring employer or lose their H-1B status, according to a recent Tech Workers Coalition blog post.

And at venture capital-backed startups, investment agreements sometimes require management to attest there is no union activity — meaning a public organizing drive can trigger funding withdrawal. Or, if a unionized company is acquired, the new management can dissolve the union overnight by reclassifying unionized workers as new hires.

With these sobering facts in mind, here is how organizers who have done it describe the process of creating a union.

Step 1: Start a conversation with your co-workers

At the University of California, a two-tier system had evolved where some tech workers were unionized and some weren’t, Belasco says. Management created new titles that fell outside the union even though they had similar job descriptions and responsibilities to those in the union. Those nonunion employees received lower pay and benefits than their unionized peers, which created resentment and instability.

width="1024" height="683" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Max Belasco from the UCLA chapter of UPTE-CWA

Zac Goldstein

Belasco and other organizers wanted to eliminate that division by bringing everyone under the same contract. But when they began their unionization drive, “the biggest barrier we faced wasn’t management opposition — it was that people felt this was just the best-case scenario realistically available: ‘We have this job at the university, we have concerns about automation and layoffs, but what can we really do about it?'” he says.

The antidote to that fatalism, organizers say, is simple: “Just start talking to your immediate co-workers. Are they experiencing the same challenges you are experiencing?” says McAvinney. “There’s no need to start talking about a union at this point.”

Just get a consensus and start building a group of like-minded individuals, Thompson advises. “Always start with one-on-one conversations, and that’s what you should do the whole time. That’s the key to organizing,” he says.

Tech workers often think they’re a special case, says Thompson, and therefore that unionization isn’t a good fit. “You’re not special. You are a company of workers, you are organizing, and there is a playbook for that. Trust the process, because it tends to work pretty well,” he says.

Step 2: Who’s on board, and who’s not? Map your workplace, but keep it quiet

Once there’s a consensus, continue to grow your network. Keep a list of everyone you’ve spoken with and note their disposition: “Is this person union-friendly or anti-union? Would they be a strong organizer?” Thompson says.

Maintaining secrecy early on is essential, because anti-union tactics will start immediately, and that can stop union organizing before it can gain momentum.

“Generally, employers do not want to share power with their workforce,” McAvinney says. Employers will deploy every means at their disposal to stop organizing efforts and peel away potential yes votes.

width="1024" height="839" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Alan McAvinney from Alphabet Workers Union-CWA


Aran Per Ink

“If you look at historical examples, having 70% approval before the employer finds out about you results in a high percentage of wins when you actually cast the vote. Historically, that’s an effective buffer,” he says.

There’s a real threat of firing and layoffs. The traditional tech worker belief that job mobility makes collective action unnecessary is now being tested by a tighter job market, McAvinney says, noting that workers who many believe were fired for speaking out back in 2019 were a galvanizing factor in his union’s formation.

“You generally don’t want to be in a situation where the employer feels comfortable firing everyone. Part of that is thinking from a cynical standpoint about what the consequences would be to the employer if they did fire everyone,” he says.

One-on-one conversations that include personally asking co-workers to keep conversations confidential are key to keeping things quiet, Belasco says. When 2,100 UC tech workers voted to unionize in May, 96% voted in favor. To stay out of earshot of managers, avoid employee surveillance tools, and sidestep conference calls that could be recorded, organizers met with workers in their homes.

“That tactic is probably what made the difference between winning the election and getting the majority we got,” he says.

Step 3: Find the right union affiliation or go it alone

“Running a campaign against major employers requires the resources and expertise of the larger labor movement, even if workers publicly present as independent,” says Kate Bronfenbrenner, director of labor education research and senior lecturer emeritus at Cornell University’s School of Industrial and Labor Relations.

Options include the Communications Workers of America (CWA), Service Employees International Union (SEIU), and the Office and Professional Employees International Union (OPEIU), among others. Another resource, the Tech Workers Coalition (TWC), provides training on organizing tactics, AI-in-workplace issues, and contract negotiation, and can match workers to the right unions for their needs.

The Alphabet Workers Union decided early on to affiliate with CWA. “They gave us a bunch of support early on in our campaign with no strings attached,” McAvinney says.

Kickstarter is organized through OPEIU, Thompson says. “They’ll usually have resources and staff that can help you through the next steps: collecting signatures in support of a union, bringing that to management, holding a vote — the more formalized things that interact with US labor law. They’ll also help with organizing along the way,” he says.

For workers at institutions where a union already exists, there may be a faster path. Organizers at UCLA did what’s called a “unit modification,” aligning with UPTE. By organizing under UPTE, the workers didn’t have to negotiate a new contract from scratch — they joined an already-negotiated contract covering existing UPTE tech members, which put them in “a much stronger position” than starting fresh, Belasco says.

Step 4: Choose your union model: majority vs. pre-majority or minority

Assess what’s practical for your organizing effort. In a majority union, more than 50% of all workers in a defined bargaining unit must vote to join the union through an NLRB-supervised election in the private sector, or a Public Employment Relations Board (PERB)-supervised election for public sector workers.

The NLRB must certify the union, which then operates under its legal protections. This means, for example, that the employer must bargain, negotiated contracts are enforceable, violations must go to the NLRB or arbitration, and workers can’t be dismissed without just cause.

A pre-majority or minority union is a minority labor organization operating without NLRB protections or collective bargaining agreements. “Pre-majority means that workers are able to demonstrate majority support — through signed cards, petitions, a walkout, or everyone wearing solidarity T-shirts — without going through a formal election,” Bronfenbrenner says.

width="1024" height="683" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Kate Bronfenbrenner from the School of Industrial and Labor Relations, Cornell University


ILR School/Cornell University

The Alphabet Workers Union-CWA (AWU-CWA) formed as a pre-majority union because achieving majority status across a globally distributed workforce of over 100,000 was not a realistic near-term goal. “An underground model where you try to reach 70% support across a workforce of over 100,000 people isn’t realistic,” McAvinney says.

A pre-majority union can still make a difference, he says. For example, the Alphabet Workers Union-CWA convinced management to offer voluntary exit packages — buyouts — prior to announcing layoffs.

For smaller organizations, a majority union may be the more practical option — it’s more attainable, McAvinney says. “I don’t think [the pre-majority union model] is the correct thing to do in all situations. I certainly would not recommend it to a 200-person shop.”

Kickstarter, which had fewer than 100 employees, was able to form a majority union, with 55% voting to organize.

Ultimately, says McAvinney, “there’s no inflection point where you go from being able to win nothing to winning everything, even with a contract and a supermajority. But the more people you have who are willing and able to fight for what they want, the more you’ll be able to get.”

Step 5: Who should — and should not — be in your union?

Belasco’s situation at UCLA illustrates a broader strategic choice that every organizing campaign must make. He had been in a union position in educational technology when he was told his role would be reclassified as a non-union position.

“I was given a choice: apply to the new non-union position to continue doing the work I’d trained for, or stay in my union position doing service desk work I wasn’t used to,” he says. “Essentially, it was a choice between job security and career progression.”

Belasco joined a “wall-to-wall” union, which represents a broad range of university professional and technical employees across the UC system rather than a single job category, such as engineers or tech professionals.

Kickstarter United is another example of a wall-to-wall union. “It’s not just the engineers who are unionized, but also customer support, designers — everyone,” Thompson says.

Wall-to-wall unions are more powerful, but they’re also more difficult to achieve. Under US labor law, “professionals have to vote separately on whether they want to be combined with other workers,” says Bronfenbrenner. “You can never have a wall-to-wall unit without giving professionals the chance to decide whether they want to be separate.”

The law’s “professional employees” category includes roles like software engineers and developers but not necessarily others. For example, customer support specialists and QA analysts would fall into the “non-professional workers” category.

“For decades, the pattern was either to organize everybody except the engineers, or manage to organize the engineers and fail to bring in everybody else — neither of which builds real worker power,” says Simone Robutti, an organizer with Tech Workers Coalition Global, an international branch of TWC based in Berlin.

width="959" height="713" sizes="auto, (max-width: 959px) 100vw, 959px">

Simone Robutti from Tech Workers Coalition Global


TWC

Step 6: You won the vote. Get ready for what comes next

Winning a union vote means having a seat at the table, says Thompson. “Once the workers have come together and agreed they want that seat, you bring that to management, and they have a chance to voluntarily recognize a union,” he says.

But in most cases employers contest the results, which must be certified by the NLRB or PERB. That process, in which the employer uses various tactics to challenge the legitimacy of the outcome, can take weeks or months.

Unfortunately, the legal framework that is supposed to protect workers during this process has been significantly weakened in the last few years. In a potentially more ominous development, SpaceX, Amazon, Trader Joe’s, Starbucks, and the University of Southern California have in separate legal actions challenged the constitutionality of the NLRB, arguing that the agency’s structure violates the separation of powers. The Fifth Circuit Court of Appeals upheld injunctions against the NLRB in SpaceX’s case in August 2025 — a serious challenge to the agency’s authority.

In the meantime, some companies may disregard negotiated contracts, which can lead to lengthy legal appeals or extended arbitration.

“The NLRB can still force an election, but it can’t force a contract, and companies are saying they simply won’t comply,” Bronfenbrenner says. This is where the expertise and resources of affiliation with a major union can help, she adds.

As a result, contract negotiations can take far longer than workers might expect. At Kickstarter, for example, two years and four months elapsed from the time of the union vote to the first contract, and that was at a 59-person company with a relatively cooperative employer. At larger companies with more aggressive legal teams, the timeline will be longer.

Forming a union is hard work, Robutti says. “It’s not a service you pay for and they protect you. It doesn’t happen spontaneously, and it doesn’t happen magically. It’s the choice to take responsibility for improving your workplace.”

]]> <![CDATA[ABB Ability Edgenius]]> https://tsecurity.de/de/3668601/it-security-nachrichten/abb-ability-edgenius/ https://tsecurity.de/de/3668601/it-security-nachrichten/abb-ability-edgenius/ Tue, 14 Jul 2026 18:14:54 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

ABB is aware of public reports of a vulnerability CVE‑2026‑31431 (Copy Fail) in the product versions listed as affected in the advisory. An update is available that resolves a publicly reported vulnerability. CVE‑2026‑31431 (Copy Fail) is a Linux kernel vulnerability that may allow a locally authenticated user or compromised container workload to gain elevated (root) privileges on affected systems. Once root access is obtained, the attacker can effectively gain complete control of the system

The following versions of ABB Ability Edgenius are affected:

  • Ability Edgenius >=3.2.0.0|<3.2.4.1 installed on ABB Ability Edgenius Gateway - bE100, >=3.2.0.0|<3.2.4.1 installed on ABB Ability Edgenius Gateway - E3100C, >=3.2.0.0|<3.2.4.1 installed on ABB Ability Edgenius Server - vE1000 (CVE-2026-31431, CVE-2026-31431, CVE-2026-31431)
CVSS Vendor Equipment Vulnerabilities
v3 7.8 ABB ABB Ability Edgenius Incorrect Resource Transfer Between Spheres

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Switzerland

Vulnerabilities

Expand All +

CVE-2026-31431

CVE‑2026‑31431 (Copy Fail) is a Linux kernel vulnerability that may allow a locally authenticated user or compromised container workload to gain elevated (root) privileges on affected systems. The issue originates in the Linux kernel’s cryptographic subsystem and impacts kernels used by most major Linux distributions released since 2017. Successful exploitation requires local code execution, however, in shared, containerized, or multi‑tenant environments this may increase the security risk

View CVE Details

Affected Products

ABB Ability Edgenius
Vendor:
ABB
Product Version:
ABB Ability Edgenius >=3.2.0.0|<3.2.4.1 installed on ABB Ability Edgenius Gateway - bE100, ABB Ability Edgenius >=3.2.0.0|<3.2.4.1 installed on ABB Ability Edgenius Gateway - E3100C, ABB Ability Edgenius >=3.2.0.0|<3.2.4.1 installed on ABB Ability Edgenius Server - vE1000
Product Status:
known_affected
Remediations

Vendor fix
The problem is corrected in the following product versions: - Edgenius 3.2.4.1 ABB recommends that customers apply the update at earliest convenience.

Mitigation
Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. Refer to section General security recommendations for further advise on how to keep your system secure. Recommended mitigation factors - Limit access to ssh or cockpit - By default, no additional lower privilege users are present on Edgenius installations

Relevant CWE: CWE-669 Incorrect Resource Transfer Between Spheres

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Acknowledgments

  • ABB PSIRT reported this vulnerability to CISA.

Notice

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.

Frequently Asked Questions

What causes the vulnerability? - A flaw was found in the Linux kernel's algif_aead cryptographic algorithm interface. An incorrect 'in-place operation' was introduced, where the source and destination data mappings were different. This could lead to unexpected behavior or data integrity issues during cryptographic operations, potentially impacting the reliability of encrypted communications. What is Edgenius? - ABB Abilityℱ Edgenius is an edge computing platform that - Connects to control systems, devices, and equipment - Collects and contextualizes operational data - Hosts applications that deliver real-time insights and AI-driven recommendations What might an attacker use the vulnerability to do? - Successful exploitation could enable a local user attacker to gain administrative control of the system node, execute arbitrary code, or cause the node to become unavailable. How could an attacker exploit the vulnerability? - An attacker could exploit this vulnerability after obtaining local access to the system. By invoking the Linux kernel’s affected cryptographic interface (algif_aead), the attacker can trigger incorrect memory handling in the kernel. This allows the attacker to escalate privileges from a normal user to full administrative (root) access on the affected system node Could the vulnerability be exploited remotely? - No, to exploit this vulnerability an attacker would need to have local access (physical access or through valid SSH credentials) to an affected system node. What does the update do? - The update resolves the issue by incorporating the security update of the Linux kernel. When this security advisory was issued, had this vulnerability been publicly disclosed? - Yes, this vulnerability has been publicly disclosed. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited for Edgenius when this security advisory was originally issued.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of ABB PSIRT 7PAA024620 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-06-25
Date Revision Summary
2026-06-25 1 Initial version.
2026-07-14 2 Initial CISA Republication of ABB PSIRT 7PAA024620 advisory

Legal Notice and Terms of Use

]]> <![CDATA[ABB T-MAC Plus]]> https://tsecurity.de/de/3668600/it-security-nachrichten/abb-t-mac-plus/ https://tsecurity.de/de/3668600/it-security-nachrichten/abb-t-mac-plus/ Tue, 14 Jul 2026 18:14:53 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves the reported vulnerabilities. An attacker who successfully exploited any of these vulnerabilities could potentially compromise the system in different ways.

The following versions of ABB T-MAC Plus are affected:

  • T-MAC Plus 4.0-24 (CVE-2025-14771, CVE-2025-14772, CVE-2025-14773, CVE-2025-14774)
CVSS Vendor Equipment Vulnerabilities
v3 9.9 ABB ABB T-MAC Plus Files or Directories Accessible to External Parties, Authorization Bypass Through User-Controlled Key, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Incorrect Authorization

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Switzerland

Vulnerabilities

Expand All +

CVE-2025-14771

File Disclosure in ABB T-MAC Plus web application allows authenticated users to exfiltrate files containing sensitive information via crafted HTTP GET request.

View CVE Details

Affected Products

ABB T-MAC Plus
Vendor:
ABB
Product Version:
ABB T-MAC Plus 4.0-24
Product Status:
known_affected
Remediations

Vendor fix
ABB has investigated these vulnerabilities to provide adequate protection to customers. The problem is corrected in the following product versions: T-MAC Plus version 4.0-25 ABB recommends that customers apply the update at earliest convenience.

Mitigation
The misconfigurations on the IIS server, which were reported to security auditing, have been corrected. File Browsing Feature was enabled on that IIS server. That feature along with the default IIS site has been removed.

Workaround
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”.

Relevant CWE: CWE-552 Files or Directories Accessible to External Parties

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2025-14772

Broken access controls in ABB T-MAC Plus web application allows unprivileged users to performs administrative operations

View CVE Details

Affected Products

ABB T-MAC Plus
Vendor:
ABB
Product Version:
ABB T-MAC Plus 4.0-24
Product Status:
known_affected
Remediations

Vendor fix
ABB has investigated these vulnerabilities to provide adequate protection to customers. The problem is corrected in the following product versions: T-MAC Plus version 4.0-25 ABB recommends that customers apply the update at earliest convenience.

Mitigation
ABB T-MAC Plus web application supports several classes of users (e.g., Admin, Customer, Operator, etc.) with different roles. An authenticated user with low privileges (e.g., Customer) can execute administrative operations. The privileges associated to the different users have been revised and applied correctly.

Workaround
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”.

Relevant CWE: CWE-639 Authorization Bypass Through User-Controlled Key

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2025-14773

Stored Cross-Site Scripting (XSS) in ABB T-MAC Plus web application allows authenticated users to execute arbitrary HTML or JavaScript code on victims browser.

View CVE Details

Affected Products

ABB T-MAC Plus
Vendor:
ABB
Product Version:
ABB T-MAC Plus 4.0-24
Product Status:
known_affected
Remediations

Vendor fix
ABB has investigated these vulnerabilities to provide adequate protection to customers. The problem is corrected in the following product versions: T-MAC Plus version 4.0-25 ABB recommends that customers apply the update at earliest convenience.

Mitigation
A DOM-based XSS vulnerability is present. If a malicious actor gains access to the operations network and can create or edit an existing entity, they could insert malicious JavaScript code to be executed in the web forms. New T-MAC Plus version 4.0-25 will correct the vulnerability.

Workaround
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”.

Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CVE-2025-14774

Insecure network protocol in ABB T-MAC Plus allows unauthenticated attackers to perform a denial-of-service (DoS) of the Card Reader service.

View CVE Details

Affected Products

ABB T-MAC Plus
Vendor:
ABB
Product Version:
ABB T-MAC Plus 4.0-24
Product Status:
known_affected
Remediations

Vendor fix
ABB has investigated these vulnerabilities to provide adequate protection to customers. The problem is corrected in the following product versions: T-MAC Plus version 4.0-25 ABB recommends that customers apply the update at earliest convenience.

Mitigation
If a malicious actor gains physical access to a serial device, disables it, connects a malicious device with same IP address, and sends a specially crafted message, the service responsible for communicating with the device will be blocked until a manual restart is performed. New T-MAC Plus version 4.0-25 will correct the vulnerability.

Workaround
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”.

Relevant CWE: CWE-863 Incorrect Authorization

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.4 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Acknowledgments

  • Angelo Catalani of the Italian National Cybersecurity Agency (ACN) responsibly disclosed the vulnerabilities and provided valuable input on product improvements.

Notice

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.

Frequently Asked Questions

What causes the vulnerability? - The vulnerabilities are caused by: - Wrong configuration in T-MAC Plus IIS Server. - Wrong configuration of privileges of users. - Lack of encryption in communication protocol. What is T-MAC Plus? - T-MAC Plus is a Terminal Management System (TMS) that handles the different operations (receipt and dispatch product, access control, product movement in the tank farm, 
) in a terminal. It is applicable to different type of products such as chemical and petroleum terminals, pipeline or refinery tankage, bulk plants or hydrogen terminals. The following components are affected: - TMAC Plus Web application - Communication protocol with Card Readers What might an attacker use the vulnerability to do? - An attacker who successfully exploited this vulnerability could cause the affected system node to stop or become inaccessible and allow the attacker to insert and run arbitrary code. How could an attacker exploit the vulnerability? - An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to an affected system node. This would require that the attacker has access to the system network, by connecting to the network directly. Recommended practices help mitigate such attacks, see section Mitigating Factors. Could the vulnerability be exploited remotely? - No, to exploit this vulnerability an attacker would need to have physical access to an affected system node. Can functional safety be affected by an exploit of this vulnerability? - While these vulnerabilities primarily impact confidentiality, integrity, and availability, they do not directly affect functional safety in the traditional sense What does the update do? - The update removes the vulnerability by modifying the way that the T-MAC Plus web application and the communication protocol are configured. When this security advisory was issued, had this vulnerability been publicly disclosed? - No, ABB received information about this vulnerability through responsible disclosure. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of ABB PSIRT 9AKK108472A7840 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-06-03
Date Revision Summary
2026-06-03 1 Initial version.
2026-07-14 2 Initial CISA Republication of ABB PSIRT 9AKK108472A7840 advisory

Legal Notice and Terms of Use

]]> <![CDATA[ABB Advant Master Online Builder]]> https://tsecurity.de/de/3668599/it-security-nachrichten/abb-advant-master-online-builder/ https://tsecurity.de/de/3668599/it-security-nachrichten/abb-advant-master-online-builder/ Tue, 14 Jul 2026 18:14:51 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

ABB became aware of vulnerability in the products versions listed as affected in the advisory, where an incorrect version of Online Builder (ONB) was included in the media. An update is available that resolves the vulnerability, see details in Recommended immediate actions.

The following versions of ABB Advant Master Online Builder are affected:

  • Control Builder A <=1.4/4 (CVE-2025-13162)
  • 800xA for Advant Master <=6.0.3-1, <=6.1.1-1, 6.1.1-3, 6.2.0-1 (CVE-2025-13162, CVE-2025-13162, CVE-2025-13162, CVE-2025-13162)
CVSS Vendor Equipment Vulnerabilities
v3 4.4 ABB ABB Advant Master Online Builder Uncontrolled Search Path Element

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Switzerland

Vulnerabilities

Expand All +

CVE-2025-13162

The application improperly handles the search path for loading DLLÂŽs, potentially allowing unauthorized libraries from untrusted directories. An attacker who obtains the necessary access could exploit the vulnerability leading to unauthorized code execution and compromising system integrity.

View CVE Details

Affected Products

ABB Advant Master Online Builder
Vendor:
ABB
Product Version:
ABB Control Builder A <=1.4/4, ABB 800xA for Advant Master <=6.0.3-1, ABB 800xA for Advant Master <=6.1.1-1, ABB 800xA for Advant Master 6.1.1-3, ABB 800xA for Advant Master 6.2.0-1
Product Status:
known_affected
Remediations

Vendor fix
ABB has investigated the vulnerability and remediated it in the newly released versions. The vulnerability has been resolved in the product versions listed as fixed in the advisory. - Version 6.1.1-2 does not contain this vulnerability and therefore no update is required. The vulnerability was again introduced in 6.1.1-3 when an older ONB version was included in the release media. - Version 6.1.1-4 do not contain this vulnerability but present version 6.1.1-3 by 800xA System Installer and System Configuration Console (SCC). Version 6.1.1-4 is therefore withdrawn. - Version 6.2.0-2 do not contain this vulnerability but present version 6.2.0-1 by 800xA System Installer and System Configuration Console (SCC). Version 6.2.0-2 is therefore withdrawn. ABB recommends that customers apply the update at their earliest convenience. - Control Builder A: It is recommended to update Control Builder A to version 1.4/5 or later. - 800xA for Advant Master: - Versions 6.0.3-1 and earlier, - Versions 6.1.1-1 and earlier, - Versions 6.1.1-2, 6.1.1-3, and 6.1.1-4 should be updated to version 6.1.1-5 or later. - 800xA for Advant Master: - Versions 6.2.0-1 and 6.2.0-2 should be updated to version 6.2.0-3 or later.

Mitigation
Since it is required that the attacker has access to the system, it is important that all users that have access to the system are managed as recommended by ABB guidelines. - Allow only authorized users to log on to the system and enforce strong passwords that are changed regularly. - Restrict temporary connection of portable computers, USB memory devices and other removable data carriers. Computers that can be physically accessed by regular users should have ports for removable data carriers disabled or at least managed to only allow intended device types. For more information on recommended practices, see [1].

Workaround
The recommendation is to upgrade to a version where the vulnerability is corrected. If an upgrade Is not possible and a workaround is needed, contact ABB Support.

Relevant CWE: CWE-427 Uncontrolled Search Path Element

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 4.4 MEDIUM CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Acknowledgments

  • ABB PSIRT reported this vulnerability to CISA.

Notice

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB. ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.

Frequently Asked Questions

What is the scope of vulnerability? - An attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node. What causes the vulnerability? - The vulnerability is caused by not having restricted permission on an application directory where DLL files are stored. What is Advant Master Online Builder? - Online Builder is part of Control Builder A, being a set of applications for configuration and programming of Advant Master controllers. Online Builder is also part of 800xA for Advant Master, an extension package to System 800xA connecting to Advant Master controllers. What might an attacker use the vulnerability to do? - An attacker who successfully exploited this vulnerability can run arbitrary code in an affected node. How could an attacker exploit the vulnerability? - An attacker who obtains the necessary access could exploit vulnerability by placing malicious DLLÂŽs in the unrestricted application directory, leading to unauthorized code execution and compromising system integrity. Could the vulnerability be exploited remotely? - No, to exploit this vulnerability an attacker would need to have physical access to an affected system node. Can functional safety be affected by an exploit of this vulnerability? - No. What does the update do? - The update of the Online Builder (ONB) resolves the vulnerability by adding restrictions to the application folder, requiring authentication. When this security advisory was issued, had this vulnerability been publicly disclosed? - No, ABB identified this vulnerability through its internal security assessment and verification processes. When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited? - No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of ABB PSIRT 7PAA020047 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact ABB PSIRT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-06-23
Date Revision Summary
2026-06-23 1 Initial version.
2026-07-14 2 Initial CISA Republication of ABB PSIRT 7PAA020047 advisory

Legal Notice and Terms of Use

]]> <![CDATA[Rockwell Automation 1715-AENTR EtherNet/IP Adapter]]> https://tsecurity.de/de/3668598/it-security-nachrichten/rockwell-automation-1715-aentr-ethernetip-adapter/ https://tsecurity.de/de/3668598/it-security-nachrichten/rockwell-automation-1715-aentr-ethernetip-adapter/ Tue, 14 Jul 2026 18:14:50 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could allow an attacker to read or delete files, stop tasks, modify memory, and change I/O states, potentially impacting the confidentiality, integrity, and availability of the device.

The following versions of Rockwell Automation 1715-AENTR EtherNet/IP Adapter are affected:

  • 1715-AENTR EtherNet/IP Adapter <=3.003 (CVE-2026-10577)
CVSS Vendor Equipment Vulnerabilities
v3 10 Rockwell Automation Rockwell Automation 1715-AENTR EtherNet/IP Adapter Missing Authentication for Critical Function

Background

  • Critical Infrastructure Sectors: Energy, Water and Wastewater, Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-10577

A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege controls, allowing unauthenticated remote access to intrusive command-line interface (CLI) commands. If exploited, a threat actor could read or delete files, stop tasks, modify memory, and change I/O states, potentially impacting the confidentiality, integrity, and availability of the device.

View CVE Details

Affected Products

Rockwell Automation 1715-AENTR EtherNet/IP Adapter
Vendor:
Rockwell Automation
Product Version:
Rockwell Automation 1715-AENTR EtherNet/IP Adapter: <=3.003
Product Status:
known_affected
Remediations

Vendor fix
Rockwell Automation recommends that users update to 1715-AENTR EtherNet/IP Adapter version 3.011 and later.

Mitigation
Rockwell Automation recommends users of the affected software who are not able to upgrade to one of the corrected versions should use their security best practices.
https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

Mitigation
For more information, see the Rockwell Automation security advisory SD1785
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1785.html

Mitigation
If you have any questions regarding this security issue and how to mitigate it,contact Rockwell Automation for help.
https://www.rockwellautomation.com/en-us/company/about-us/contact-us.html

Relevant CWE: CWE-306 Missing Authentication for Critical Function

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 10 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 10 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Acknowledgments

  • Rockwell Automation reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-14
Date Revision Summary
2026-07-14 1 Initial Republication of Rockwell Automation security advisory SD1785.

Legal Notice and Terms of Use

]]> <![CDATA[UniGetUI v2026.2.3]]> https://tsecurity.de/de/3668477/downloads/unigetui-v202623/ https://tsecurity.de/de/3668477/downloads/unigetui-v202623/ Tue, 14 Jul 2026 17:32:37 +0200 đŸ’Ÿ Downloads tsecurity.de Devolutions UniGetUI 2026.2.3

This release focuses on performance, efficiency, and responsiveness across the entire application. UniGetUI now ships with NativeAOT enabled by default for all release packages, resulting in faster startup times and a leaner runtime. This update also delivers significant optimizations to GPU usage, memory consumption, package icon handling, and scrolling performance, making the application smoother and more responsive

Highlights

  • NativeAOT is now the default for all UniGetUI release packages, improving startup performance and reducing runtime overhead.
  • Significantly reduced GPU usage by eliminating unnecessary indeterminate progress bar animations.
  • Optimized package icon loading and memory management for improved responsiveness and lower memory usage.
  • Improved package list and DataGrid scrolling performance for a smoother browsing experience.
  • Restored the dockable navigation pane with adaptive, docked, and overlay display modes.
  • Added toast notifications and enhanced operations feedback.
  • Added a manual Install, Update, and Uninstall mode for greater control over package operations.

Improvements

  • Package list sort order is now remembered independently for each page.
  • Improved operation logs by preserving your scroll position while new output is generated.
  • Updated the empty and loading state illustrations.
  • Improved title bar search layout and styling.
  • Fixed sidebar and filter pane icon inconsistencies.

Bug Fixes

  • Fixed the main window gradually increasing in size after restarting on Windows.
  • Fixed title bar search clipping when the window is maximized.
  • Fixed dark theme flyout readability on the release notes page.
  • Fixed log text colors when switching themes.
  • Fixed several installer script issues.

Thank you to everyone who reported issues, submitted feedback, and contributed improvements to the project.

Full Changelog: v2026.2.2...v2026.2.3

]]> <![CDATA[CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)]]> https://tsecurity.de/de/3668067/it-security-nachrichten/cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/ https://tsecurity.de/de/3668067/it-security-nachrichten/cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/ Tue, 14 Jul 2026 15:24:24 +0200 📰 IT Security Nachrichten tsecurity.de Overview

Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution (RCE) against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft are disclosing the first vulnerability in this chain, the authentication bypass vulnerability CVE-2026-55040. The RCE component of the exploit chain is expected to be patched by Microsoft in the next update cycle for August 2026. The exploit chain was developed as an entry for the recent Pwn2Own Berlin hacking competition – part of Rapid7 Labs' continued effort to raise the bar in Vulnerability Intelligence and our commitment to the preemptive protection of our customers through original vulnerability research.

A remote unauthenticated attacker can leverage CVE-2026-55040 to bypass authentication on a vulnerable SharePoint server and perform operations as a SharePoint site user or administrator. The vulnerability is due to several issues in the JWT token validation pipeline.

CVE-2026-55040 has a CVSSv3.1 score of 5.3 (Medium), and a Common Weakness Enumeration (CWE) of CWE-1390: Weak Authentication.

Product description

Microsoft SharePoint is a ubiquitous, web-based collaboration and document management platform deeply integrated into the Microsoft 365 ecosystem. Serving as the central hub for corporate intranets, internal file sharing, and workflow automation, it is trusted by enterprises worldwide to store and manage vast repositories of sensitive business data. Because SharePoint acts as a critical bridge between internal users, active directories, and cloud infrastructure, vulnerabilities within its architecture present a high-risk attack surface.

Impact

By leveraging CVE-2026-55040, a remote unauthenticated attacker can assume the identity of any SharePoint site user; the prerequisite is the attacker must know in advance the user they wish to identify as. This can be achieved in a number of ways, including via a user’s Active Directory (AD) Security ID (SID), or via a user’s AD User Principal Name (UPN). A UPN is the primary logon name for a user in either Windows AD or Microsoft Entra ID, and is formatted similar to that of an email address, e.g. administrator@domain.local.

In the example screenshot below, with identifying information redacted, a Rapid7 Labs proof-of-concept script discovers potential SharePoint users via SID enumeration and then leverages CVE-2026-55040 to bypass authentication on the target SharePoint site to assume the identity of that user — ultimately identifying the SharePoint site administrator user account.

Rapid7-Labs-PoC-CVE-2026-55040.png
Figure 1: The Rapid7 Labs PoC for CVE-2026-55040.

⠀

An attacker who successfully exploits CVE-2026-55040 can perform operations against the target SharePoint site as the user they identify as. Furthermore, this authentication bypass can be chained to additional vulnerabilities within the authenticated attack surface of the target site.

Rapid7 Labs has chained the authentication bypass CVE-2026-55040 with a separate RCE vulnerability for unauthenticated RCE. Patching CVE-2026-55040 will successfully break this exploit chain. The RCE component has been disclosed to Microsoft and is expected to be patched in the scheduled August patch cycle. The chaining of vulnerabilities highlights that even though the authentication bypass has been assigned a medium severity CVSS score by Microsoft, the impact of successfully chaining a medium severity authentication bypass to an RCE component is significant. This also underscores the importance of patching vulnerabilities such as authentication bypasses, which can break complex and high impact exploit chains.

Leveraging AI

To develop our SharePoint exploit chain, Rapid7 Labs undertook a research project divided into two main sprints, the first in January and the second in March, 2026. While both sprints did encompass more traditional vulnerability research such as manual code review and reverse engineering, a significant amount of the work was undertaken through an agent. Over 24 active days of agentic work, we leveraged 96 sessions, issued 256 prompts, and generated approximately 80,000 agentic tool calls.

The initial January sprint was unsuccessful, resulting in no findings that could be leveraged for an exploit chain. We used this sprint to experiment with several different publicly available models, along with different workflows to navigate and reason across a massive and complex codebase. However, our second sprint in March was successful and yielded, through a heavily prompted agent, a two-vulnerability exploit chain that achieved unauthenticated RCE.

The improvement in quality between January and March in terms of agentic work, along with our improved workflows, was noticeable. This highlights the speed at which this field is evolving, how publicly available models are improving, and how as research teams develop their workflows, the results begin to compound.

Credit

This vulnerability was discovered by Stephen Fewer, Senior Principal Security Researcher at Rapid7 and is being disclosed in accordance with Rapid7's vulnerability disclosure policy.

Vendor statement

The following statement has been provided by Microsoft:

“We would like to thank Rapid7 for responsibly reporting this issue through coordinated vulnerability disclosure.”

Technical analysis

Rapid7 will be publishing full technical details for CVE-2026-55040 within 30 days of this disclosure.

Remediation

Customers are advised to apply the latest available updates for the impacted product to ensure they are protected.

Rapid7 customers

Exposure Command, InsightVM and Nexpose customers will be able to assess their exposure to CVE-2026-55040 with Authenticated vulnerability checks available in the July 14 content release

Disclosure timeline

  • May 18, 2026: Rapid7 discloses an unauthenticated RCE exploit chain to Microsoft. Microsoft acknowledges receipt of the disclosure the same day.

  • May 20, 2026: Microsoft confirms the findings and indicates that the exploit chain will be patched across two scheduled update cycles - the authentication bypass component in July, and the RCE component in August.

  • May 21, 2026: Rapid7 acknowledges the disclosure schedule and requests supporting information. Microsoft requests a 30 day stay on disclosure of technical details and publication of PoC.

  • May 29, 2026: Rapid7 agrees to a 30 day stay on technical details with a proviso to publish earlier should either exploitation in-the-wild or third-party publication of details occur within the 30 days. Microsoft confirms the disclosure plan the same day.

  • June 30, 2026: Rapid7 requests supporting information for the upcoming disclosure.

  • June 30, 2026: Microsoft provides supporting information to Rapid7.

  • July 14, 2026: This disclosure for CVE-2026-55040.

]]> <![CDATA[The essence of data management CIOs must embrace]]> https://tsecurity.de/de/3667389/it-security-nachrichten/the-essence-of-data-management-cios-must-embrace/ https://tsecurity.de/de/3667389/it-security-nachrichten/the-essence-of-data-management-cios-must-embrace/ Tue, 14 Jul 2026 11:08:51 +0200 📰 IT Security Nachrichten tsecurity.de

Since the advent of generative AI, the use of AI in business has shifted from something we should do to something we must do to survive. Many companies are now working to utilize AI with the aim of improving productivity and creating value.

Here, I would like to pose a question to you all once again: “What is the fundamental factor that determines AI performance?”

Is it the AI model? Is it the AI tool? Or is it the AI agent?

Of course, I believe all of these are important. However, if we look at the long-term perspective, the competition among multiple companies to improve AI model performance will eventually level off, and we will eventually reach a point where every AI model is amazing!

In that context, what I believe is the most important factor influencing AI performance is the data accumulated by companies that connects to their unique strengths.

For example, if asked, “What do plants need to grow?” I would say “good water and light.”

Similarly, if asked, “What do people need to thrive?” I would say, “Kind words.”

Finally, “What does AI need to thrive?” The answer is “good data.”

I believe that the extent to which companies can genuinely understand the importance of this extremely simple principle and implement it with unwavering dedication will determine their ability to establish a competitive advantage and achieve sustainable growth.

AI is a mirror of data

As I’m sure you’re all aware, AI is by no means a magic wand. It is an entity that learns based on the data it is given and makes inferences within that scope. In other words, AI’s output depends heavily on the quality of its input data; one could say that AI is a mirror of data.

  • If you feed it inaccurate data, it will return inaccurate results (i.e., garbage in, garbage out)
  • If you feed it biased data, it will make biased judgments
  • Insufficient data yields only shallow insights and suggestions

In this way, AI is not smart but rather faithful to the data. Based on this premise, it becomes clear that the essence of AI utilization lies not in which tools to use, but in what kind of high-quality data to prepare and how to utilize it.

What is good data?

So, what exactly is good data?

It goes without saying that data is useless if it is merely abundant in quantity, but on the other hand, what specific qualities must good data possess?

Generally speaking, good data possesses at least the following elements.

  • Accuracy: Data containing many errors or noise will skew conclusions, no matter how advanced the analysis. It is important to minimize sensor errors, input mistakes and duplicates.
  • Completeness: Are any required fields missing, and are there too many missing values? For example, if customer data is missing information such as age, region or gender, it becomes difficult to perform meaningful analysis.
  • Consistency: Is data with the same meaning mixed in different formats (e.g., date formats, units, variations in notation)? This is particularly important for system integration and long-term data.
  • Timeliness: No matter how accurate it is, data that is too old may not be useful for decision-making. Whether real-time data is required or historical data is sufficient depends on the use case, but it is important that the data has the appropriate freshness for the purpose.
  • Relevance: If there is a large amount of data unrelated to the analysis objective, it becomes noise and leads to incorrect judgments. It is necessary to clearly define what the data is used for and ensure the data is appropriate for that purpose.
  • Reliability: The data’s source and collection method must be clear, ensuring reliability and reproducibility. Data with an unknown source or that is a black box cannot be verified later.

In summary, good data is data that is accurate, has few gaps, is consistent in meaning and notation, is collected at the appropriate time, is suitable for the purpose and comes from a reliable source.

Only when the quality of this good data is guaranteed can AI produce valuable outputs. Conversely, introducing AI with unorganized data will not yield the expected results. Many complaints, such as “We implemented AI but it’s unusable” or “The AI’s accuracy isn’t improving stem from data issues.”

Data does not organize itself naturally

The key point here is that good data does not arise naturally. On the contrary, if left unattended, data will inevitably deteriorate.

  • Rules become inconsistent depending on who entered the data and when
  • Multiple instances of data with the same meaning exist
  • Outdated data is scattered and left unattended
  • Data becomes siloed by department

These conditions are likely common in many companies.

Below is an overview of our company’s data management framework.

Overview of data management at Kansai Electric Power Company

Akio Ueda

Broadly speaking, it consists of data governance — covering roles and structures, risk management and evaluation — and data management, which encompasses data utilization cycle management and data utilization support services. Within this framework, data utilization cycle management involves:

  • Needs management: We clarify the purpose and needs by asking, “What is the data being used for?” and “For whom, and in what way, does this data create value?”
  • Collection: We gather the necessary data based on the defined objectives. We design the process to determine what data is required (internal/external), the level of detail and frequency of collection, and how to ensure data quality.
  • Processing: We enhance the quality and prepare the data for use. This includes cleansing (correcting errors and missing values), standardizing formats, deduplicating and integrating data, processing structured and unstructured data separately, and assigning business and operational meaning to the data.
  • Storage: We ensure the data is available to the right people at the right time. This involves storing data in databases or data lakes, implementing security and access controls, and managing metadata (ensuring the data is clearly identifiable).
  • Utilization: This is the most critical step. The purpose of data is not merely analysis but driving action. We generate value from the data through visualization (dashboards), analysis (statistical processing, BI, AutoML, AI) and integration into business operations (automation and decision support).
  • Disposal: We properly dispose of data that is no longer needed. Simply holding data can itself pose risks, such as managing retention periods, complying with laws and governance requirements, and mitigating security risks. That is why the principle of not holding data that is not used is so important.

Data management is not a one-time effort; it is an ongoing initiative that requires continuous maintenance and improvement.

The CIO must embed data management as a system within the organization and continue to implement it until it becomes firmly established.

Data management is not just the IT department’s job

Another important point is that data management is not just the IT department’s job.

Data is fundamentally generated within day-to-day operations on the front lines. Therefore:

  • Who determines the meaning and definition of data
  • How should input rules be standardized?
  • How do we ensure data quality?

are, in essence, operational issues, business issues and management issues.

The latest Digital Skills Standard ver. 2.0, published by the Ministry of Economy, Trade and Industry in April 2026, defines the following three roles within the data management category:

  • Data steward: Based on business domain knowledge, this role is responsible for operations aimed at ensuring data quality, reliability and security, as well as for promoting the adoption and establishment of data management within business divisions and frontline organizations, and for fostering data utilization. In short, they are the data quality manager and data utilization promoter.
  • Data engineer: This role involves understanding the current state of data and supporting the organization’s continuous data utilization through data preparation and preprocessing in processes such as collection, integration, processing and provision, as well as the design and implementation of data pipelines. In essence, they are the implementers and operators who drive data.
  • Data architect: This role involves taking a bird’s-eye view of the data structure, flow and utilization methods across the entire organization and business. By designing and continuously reviewing data architecture that encompasses the entire data lifecycle in alignment with business strategy, they ensure the successful integration of company-wide data utilization and governance—essentially serving as the overall designer of data.

The CIO is not merely responsible for establishing data storage and analysis infrastructure; they are also tasked with appropriately assigning personnel to these three roles within the company and establishing cross-departmental, company-wide tools and rules to connect data with management, business operations and daily tasks.

Ultimately, the success of data utilization depends on organizational culture

On the other hand, no matter how much progress is made in staffing, infrastructure, tools and rulemaking, data will not be utilized unless there is an organizational culture that actively drives management, business and operations based on data.

  • The purpose of data entry is not understood
  • Data is optimized solely for the department’s own operations
  • Decision-making based on data is not valued

In such a situation, no matter how well the systems are set up, they will become mere formalities.

In contrast, in organizations where data utilization is advanced:

  • Discussions are based on data
  • Formulate hypotheses and verify them with data
  • And continuously improve based on data

These actions occur naturally.

In other words, the essence of data management ultimately lies in creating an organizational culture that assumes the effective use of data.

Data management cannot be achieved overnight. That is precisely why it is important to start small and build on your successes.

  • Organize data for specific tasks and achieve results through the use of AI
  • Rolling out successful practices
  • Gradually Expand the Scope

By repeating this cycle, the importance of data will permeate the entire organization.

The role expected of a CIO in the AI era

In the AI era, the role expected of a CIO has changed significantly.

Traditionally:

  • Ensuring the stable operation of systems
  • And optimizing costs

However, moving forward:

  • We will view data as an asset and maximize its value
  • Developing the data infrastructure, tools and rules that underpin AI adoption, and advancing personnel allocation and development
  • And fostering an organizational culture that embraces data utilization —roles that are more directly linked to business management

In other words, the CIO must evolve into the person responsible for creating value from data.

Data is the source of competitive advantage

In the coming era, the use of AI will be a given. What will set companies apart is not whether they use AI, but what data they possess.

Data is the accumulation of a company’s past strengths and the source of future value creation. And its quality is determined by daily operations and the nature of the organization.

  • AI grows by being fed good data
  • And companies grow through that AI

Taking this simple principle as our starting point, we must place data management at the core of our business strategy. Isn’t that the shortest route to sustainable growth in the AI era?

CIOs are called upon to lead the way in making this a reality.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[EU to Review Social Media Age Limits After Child Safety Report]]> https://tsecurity.de/de/3666978/it-security-nachrichten/eu-to-review-social-media-age-limits-after-child-safety-report/ https://tsecurity.de/de/3666978/it-security-nachrichten/eu-to-review-social-media-age-limits-after-child-safety-report/ Tue, 14 Jul 2026 08:10:56 +0200 📰 IT Security Nachrichten tsecurity.de Child Safety Online

The European Commission is moving closer to introducing new measures on Child Safety Online after President Ursula von der Leyen received recommendations from a Special Panel examining the impact of social media on children. The report, released Monday, calls for stronger safeguards, greater platform accountability, and age-appropriate restrictions as the EU prepares to review the findings and present legislative proposals after the summer.

Speaking alongside the panel's co-chairs, von der Leyen said protecting children online has become one of the most pressing challenges facing governments. She stressed that parents, not algorithms, should shape children's development and warned that the current digital environment is exposing young users to growing risks.

Child Safety Online Becomes a Priority for the EU

Von der Leyen said the Special Panel examined both the opportunities and harms created by social media algorithms and their effects on children. According to the findings highlighted in her statement, young people across Europe now spend between four and six hours each day on screens, while nearly 60% of young children have experienced emotional or psychosocial problems online.

She said these challenges include loss of sleep, anxiety, depression, cyberbullying, exposure to harmful content, and unwanted online interactions, all occurring while children's brains are still developing.

"We believe that parents bring up our kids, and not predatory algorithms," von der Leyen said, adding that social media platforms should no longer have unrestricted access to children.

Digital Services Act Places Responsibility on Platforms

A key recommendation focuses on holding technology companies accountable for the safety of their services. Von der Leyen said platforms that build online systems should also be responsible for ensuring they do not harm users, particularly children.

She pointed to the Digital Services Act (DSA) as the EU's framework for requiring providers to remove harmful features, including addictive algorithms, dark patterns, harmful content, and unwanted contacts.

According to the Commission President, the EU has already taken action under the Digital Services Act against TikTok over its addictive design and recently against Meta. She said platforms have a duty of care toward users and must respond quickly when children report harmful experiences.

EU Considers Social Media Age Restrictions

The report also strengthens the case for introducing social media age restrictions, with von der Leyen arguing that the debate is no longer about whether children use social media but when platforms should be allowed to reach them.

She said the European Union's age verification app is designed to help parents by providing an easy-to-use, privacy-preserving, and open-source tool to verify age before accessing online platforms.

Von der Leyen also suggested that Europe should consider establishing a "social media start date," comparing it to existing age limits for driving and purchasing alcohol.

Panel Calls for Age-Appropriate Digital Access

According to the statement, children under the age of three should have no exposure to screens or digital platforms. Older children should only access social media under parental, caregiver, or teacher supervision and within limited time periods.

Von der Leyen said childhood is a critical stage of brain development and argued that children need opportunities to play, build real-world friendships, and develop their identities before algorithms begin shaping their online experiences.

She added that policymakers should first identify platforms with age-inappropriate and addictive features, describing the category as "social media plus," before considering phased access for different age groups.

EU to Review Recommendations Before New Proposal

The European Commission said the report comes after consultations with parents, educators, experts, young people, EU member states, and international partners, including Australia.

Von der Leyen confirmed that the Commission will now review the recommendations before presenting a formal proposal after the summer.

While no legislative measures have yet been announced, the report signals the EU's intent to strengthen Child Safety Online protections by expanding platform accountability, improving age verification, and evaluating new rules governing children's access to social media.

]]> <![CDATA[iPadOS 26.6 Developer Beta 5 Now Available for Developers]]> https://tsecurity.de/de/3666599/ios-mac-os/ipados-266-developer-beta-5-now-available-for-developers/ https://tsecurity.de/de/3666599/ios-mac-os/ipados-266-developer-beta-5-now-available-for-developers/ Tue, 14 Jul 2026 01:53:57 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[IBM Quantum System One London: Why Every Organisation Should Be Preparing for Post-Quantum Cryptography (PQC)]]> https://tsecurity.de/de/3666536/it-security-nachrichten/ibm-quantum-system-one-london-why-every-organisation-should-be-preparing-for-post-quantum-cryptography-pqc/ https://tsecurity.de/de/3666536/it-security-nachrichten/ibm-quantum-system-one-london-why-every-organisation-should-be-preparing-for-post-quantum-cryptography-pqc/ Tue, 14 Jul 2026 00:22:17 +0200 📰 IT Security Nachrichten tsecurity.de Walking past IBM's offices on York Road, just a short walk from Waterloo Station, I spotted the IBM Quantum System One on public display. Like many people, I initially wondered whether it was simply a replica or a marketing exhibit.

The answer is no.

This is a genuine IBM Quantum System One, housed within a sophisticated dilution refrigerator designed to keep its superconducting quantum processor at temperatures only a fraction of a degree above absolute zero.

The striking gold structure that catches everyone's attention is not the quantum processor itself. The processor is tiny compared with the surrounding equipment and sits deep inside the system. Much of what you can see exists to cool, control and protect the processor from heat, vibration and electrical interference.

It is a fascinating sight and well worth stopping to admire when passing through Waterloo.

More Than a Display

What many people do not realise is that IBM's quantum technology is not simply something to observe through glass.

Through the IBM Quantum Platform, researchers, developers, students and organisations can access IBM quantum computers remotely through the cloud.

IBM currently offers access to quantum processing units, or QPUs, alongside documentation, tutorials, learning resources and software tools. Its platform also provides a limited amount of free execution time, allowing users to experiment with real quantum hardware rather than relying only on simulators.

Developers can create and execute quantum circuits using Qiskit, IBM's open-source software development kit for quantum computing.

For developers, the basic installation begins with:

pip install qiskit
pip install qiskit-ibm-runtime

The IBM Quantum Platform includes resources covering quantum information science, optimisation, Hamiltonian simulation and machine learning. It also offers tools such as Composer, which allows users to construct and run quantum circuits visually.

Quantum computing is no longer confined entirely to specialist laboratories. Developers and researchers can already gain practical experience with real quantum hardware.

Why Does a Quantum Computer Need to Be So Cold?

IBM's systems use superconducting qubits, which are extremely sensitive to their surroundings.

At ordinary temperatures, heat and electrical noise would disrupt the fragile quantum states needed for computation. The dilution refrigerator therefore cools the processor through several stages until it reaches temperatures close to absolute zero.

This extremely controlled environment allows the qubits to retain their quantum properties long enough for calculations to be performed.

It is an extraordinary feat of engineering.

Will Quantum Computers Break Today's Encryption?

This is the question cybersecurity professionals hear most often.

Not today.

Current quantum computers do not have the scale, reliability or fault tolerance required to break the public key cryptography used across banking, virtual private networks, digital certificates, software signing and secure communications.

However, a sufficiently powerful and fault-tolerant quantum computer could theoretically use Shor's algorithm to undermine widely used public key algorithms, including:

  • RSA
  • Elliptic Curve Cryptography, or ECC
  • Diffie-Hellman key exchange
  • Elliptic Curve Diffie-Hellman

That does not mean organisations should panic. It does mean they should begin preparing before such capability exists.

Post-Quantum Cryptography Is Already Here

The transition towards quantum-resistant cryptography is already under way.

In August 2024, the U.S. National Institute of Standards and Technology published its first three finalised Post-Quantum Cryptography standards.

These standards give governments, technology providers and organisations a foundation for moving towards cryptographic methods designed to resist both conventional and quantum-enabled attacks.

The Risk Is Not Only in the Future

One important concern is sometimes described as harvest now, decrypt later.

An attacker may collect encrypted information today in the hope of decrypting it in the future, once more capable quantum technology becomes available.

This matters most where information must remain confidential for many years, such as:

  • Government and defence information
  • Intellectual property and trade secrets
  • Long-term commercial agreements
  • Personal, medical or financial records
  • Critical infrastructure designs
  • Authentication and identity information

The urgency of Post-Quantum Cryptography (PQC) planning should therefore be based not only on when a cryptographically relevant quantum computer may arrive, but also on how long an organisation's data must remain protected.

What Should Organisations Be Doing Today?

For most organisations, the first challenge is not selecting a new algorithm. It is understanding where cryptography is already being used.

Cryptographic dependencies may be embedded within applications, network protocols, certificates, hardware, cloud services, APIs, supplier products and legacy systems.

You cannot migrate what you have not identified.

1. Build a cryptographic inventory

Identify where encryption, digital signatures, certificates, key exchange mechanisms and cryptographic libraries are used.

The inventory should cover:

  • Applications and databases
  • Web services and APIs
  • TLS certificates
  • VPNs and remote-access technologies
  • Identity and authentication platforms
  • Code-signing and software-update processes
  • Hardware security modules
  • Cloud services
  • Third-party and supplier solutions
  • Operational technology and embedded devices

2. Identify quantum-vulnerable algorithms

Determine where RSA, ECC, Diffie-Hellman and related public key algorithms are used.

Do not assume that a certificate-management database alone provides a complete view. Cryptography may also be hard-coded into applications, libraries, firmware and external services.

3. Map cryptography to business services

A technical inventory is useful, but it becomes more valuable when linked to critical business services.

Organisations should understand:

  • Which important services depend on vulnerable cryptography
  • What information those services protect
  • How long that information must remain confidential
  • What would happen if the cryptography could no longer be trusted
  • Which suppliers or platforms must be upgraded first

4. Design for cryptographic agility

Cryptographic agility is the ability to replace algorithms, protocols, certificates and keys without rebuilding an entire system.

New systems should avoid unnecessary dependencies on a single algorithm or cryptographic implementation. Cryptographic choices should be configurable, documented and capable of being updated as standards and threats evolve.

5. Engage suppliers

Organisations depend heavily on software vendors, cloud providers, network suppliers and managed service providers.

Useful questions include:

  • Where does your product use RSA, ECC or Diffie-Hellman?
  • Do you maintain a cryptographic bill of materials?
  • What is your roadmap for supporting NIST PQC standards?
  • Will customers need new hardware or software?
  • Will hybrid classical and post-quantum modes be supported?
  • How will certificates, keys and protocols be migrated?
  • What testing has been completed for performance and interoperability?

6. Test before large-scale migration

Post-quantum algorithms can have different key sizes, signature sizes, processing requirements and network implications.

Organisations should test their effect on applications, protocols, devices and infrastructure before committing to widespread deployment.

7. Establish governance and ownership

PQC migration is not solely a security engineering problem. It may require coordination across:

  • Cybersecurity
  • Enterprise architecture
  • Infrastructure and cloud teams
  • Application development
  • Procurement
  • Legal and privacy teams
  • Risk and compliance
  • Business service owners

Clear ownership, funding, milestones and reporting will be essential for what is likely to become a multi-year transformation programme.

A Practical Post-Quantum Cryptography Roadmap

A proportionate roadmap could follow four stages.

Discover

  • Build the cryptographic inventory
  • Identify vulnerable algorithms
  • Map dependencies to critical services
  • Assess long-term confidentiality requirements

Prioritise

  • Rank systems by business criticality and data sensitivity
  • Identify difficult-to-replace legacy technology
  • Assess supplier readiness
  • Determine where harvest-now-decrypt-later risk is greatest

Prepare

  • Introduce cryptographic agility requirements
  • Update procurement and architecture standards
  • Establish governance and ownership
  • Begin laboratory testing and controlled pilots

Migrate and validate

  • Deploy approved algorithms using a risk-based sequence
  • Validate interoperability and performance
  • Retire vulnerable cryptographic dependencies
  • Collect evidence that migration has been completed successfully

Final Thoughts

Standing in front of IBM Quantum System One was a fascinating reminder that the future often arrives quietly.

Today's immediate cybersecurity priorities remain ransomware, identity compromise, supply chain risk, exposed services and weak security controls. Quantum computing does not replace those priorities.

However, responsible security leadership also means recognising risks that require years of preparation.

Quantum computing is no longer confined entirely to theoretical research. Developers and researchers can already access real quantum processors through services such as the IBM Quantum Platform.

That does not mean organisations need to rush into an uncontrolled migration. It means they should begin understanding their exposure, improving cryptographic agility and establishing a structured roadmap.

The organisations that start mapping their cryptographic landscape today will be better prepared when quantum-safe migration becomes a business requirement rather than a future consideration.

Useful Resources

]]> <![CDATA[Windows Insiders Can Test a Decluttered Windows Search Experience]]> https://tsecurity.de/de/3666123/windows-tipps/windows-insiders-can-test-a-decluttered-windows-search-experience/ https://tsecurity.de/de/3666123/windows-tipps/windows-insiders-can-test-a-decluttered-windows-search-experience/ Mon, 13 Jul 2026 20:11:56 +0200 đŸȘŸ Windows Tipps tsecurity.de Microsoft is improving the Windows Search experience by improving the quality of search results and making it easy to hide recommended content.

The post Windows Insiders Can Test a Decluttered Windows Search Experience appeared first on Thurrott.com.

]]> <![CDATA[iOS 26.6 Developer Beta 5 Released With Latest Bug Fixes]]> https://tsecurity.de/de/3666062/ios-mac-os/ios-266-developer-beta-5-released-with-latest-bug-fixes/ https://tsecurity.de/de/3666062/ios-mac-os/ios-266-developer-beta-5-released-with-latest-bug-fixes/ Mon, 13 Jul 2026 19:40:01 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Improving Windows Search Box, with less clutter and more control]]> https://tsecurity.de/de/3665998/windows-tipps/improving-windows-search-box-with-less-clutter-and-more-control/ https://tsecurity.de/de/3665998/windows-tipps/improving-windows-search-box-with-less-clutter-and-more-control/ Mon, 13 Jul 2026 19:12:41 +0200 đŸȘŸ Windows Tipps tsecurity.de Hello Windows Insiders,

You’ve have been asking for search that is faster, more relevant, and easier to use—whether you’re opening an app, finding a file, or changing a setting.

Because the Windows Search Box is where many people start, we fo

The post Improving Windows Search Box, with less clutter and more control appeared first on Windows Insider Blog.

]]> <![CDATA[What is devops? Bringing dev and ops together to build better software]]> https://tsecurity.de/de/3665673/ai-nachrichten/what-is-devops-bringing-dev-and-ops-together-to-build-better-software/ https://tsecurity.de/de/3665673/ai-nachrichten/what-is-devops-bringing-dev-and-ops-together-to-build-better-software/ Mon, 13 Jul 2026 17:04:38 +0200 🔧 AI Nachrichten tsecurity.de

A portmanteau of “development” and “operations,” devops emerged as a way of bringing together two previously separate groups responsible for the building and deploying of software.

In the old world, developers (devs) typically wrote code before throwing it over to the system administrators (operations, or ops) to deploy and integrate that code. But as the industry shifted towards agile development and cloud-native computing, many organizations reoriented around modern, cloud-native practices in the pursuit of faster, better releases.

This required a new way to perform these key functions in a more streamlined, efficient, and cohesive way, one where the old frustrations of disconnected dev and ops functions would be eliminated. With two groups working together, developers can rapidly roll out small code enhancements via continuous integration and delivery rather than spending years on “big bang” product releases.

Devops was born at cloud-native companies like Facebook, Netflix, Spotify, and Amazon; but it’s become one of the defining technology industry trends of the past decade, primarily because it bridges so many of the changes that have shaped modern software development.

As agile development and cloud-native computing have become ubiquitous, devops has enabled the entire industry to speed up its software development cycles. Thus, devops has now thoroughly infiltrated the enterprise, especially in organizations that rely on software to run their business, such as banks, airlines, and retailers. And it’s spawned a host of other “ops” practices, some of which we’ll touch on here.[JF1] 

Devops practices

Devops requires a shift in mindset from both sides of the dev and ops divide. Development teams should focus on learning and adopting agile processes, standardizing platforms, and helping drive operational efficiencies. Operations teams must now focus on improving stability and velocity, while also reducing costs by working hand in hand with the developer team.

Broadly speaking, these teams need to all speak a common language and there needs to be a shared goal and understanding of each other’s key skills for devops to thrive.

More specifically, engineers Damon Edwards and John Willis created the CALMS model to bring together what are commonly understood to be the key principles of devops:

  • Culture: One that embraces agile methodologies and is open to change, constant improvement, and accountability for the end-to-end quality of software.
  • Automation: Automating away toil is a key goal for any devops team.
  • Lean: Ensuring the smooth flow of software through key steps as quickly as possible.
  • Measurement: You can’t improve what you don’t measure. Devops pushes for a culture of constant measurement and feedback that can be used to improve and pivot as required, on the fly.
  • Sharing: Knowledge sharing across an organization is a key tenet of devops.

“Who could go back to the old way of trying to figure out how to get your laptop environment looking the same as the production environment? All these things make it so clear that there’s a better way to work. I think it’s very tough to turn back once you’ve done things like continuous integration, like continuous delivery. Once you’ve experienced it, it’s really tough to go back to the old way of doing things,” Kim told InfoWorld.

What is a devops engineer?

Naturally, the emergence of devops has spawned a whole new set of job titles, most prominent of which is the catch-all devops engineer.

Generally speaking, this role is the natural evolution of the system administrator — but in a world where developers and ops work in close tandem to deliver better software. This person should have a blend of programming and system administrator skills so that he or she can effectively bridge those two sides of the team.

That bridging of the two sides requires strong social skills more than technical. As Kim put it, “one of the most important skills, abilities, traits needed in these pioneering rebellions — using devops to overthrow the ancient powerful order, who are very happy to do things the way they have for 30 to 40 years — are the cross-functional skills to be able to reach across the table to their business counterparts and help solve problems.”

This person, or team of people, will also have to be a born optimizer, tasked with continually improving the speed and quality of software delivery from the team, be that through better practices, removing bottlenecks, or applying automation to smooth out software delivery.

The good news is that these skills are valuable to the enterprise. Salaries for this set of job titles have risen steadily over the years, with 95% of devops practitioners making more than $75,000 a year in salary in 2020 in the United States. In Europe and the UK, where salaries are lower across the board, 71% made more than $50,000 a year in 2020, up from 67% in 2019.

Key devops tools

While devops is at its heart a cultural shift, a set of tools has emerged to help organizations adopt devops practices.

This stack typically includes infrastructure as code, configuration management, collaboration, version control, continuous integration and delivery (CI/CD), deployment automation, testing, and monitoring tools.

Here are some of the tools/categories that are increasingly relevant in 2025, and what is changing:

  • CI/CD and delivery automation: Traditional tools like Jenkins remain in many stacks, but newer orchestration tools and CLI-driven or GitOps-centric platforms are growing in importance (e.g. ArgoCD, Flux, Tekton). Also, platforms that integrate more tightly with monitoring, secrets management, drift detection, and policy enforcement are gaining traction.
  • Security, compliance, and devsecops tooling: Security tools are increasingly integrated into devops pipelines. Expect to see more use of static analysis (SAST), dynamic testing (DAST), dependency and supply chain scanning (SCA), secret management, and policy as code. The push is toward embedding security earlier and bridging gaps between dev, security, and machine learning teams. (InfoWorld:)
  • AI  and automation augmentation: AI-assisted tools are increasingly part of tooling stacks: auto-suggestions in CI/CD, anomaly detection, predictive scaling, intelligent test suite selection, and more. The hope is that these tools will reduce manual interventions and improve reliability. Tools that are “AI ready”—that is, they integrate well with AI or have mature built-in automation or assistance—increasingly stand out from the pack.

Devops challenges

Even as devops becomes more widely adopted, there remain real obstacles that can slow progress or limit impact. One major challenge is the persistent skills gap. The modern devops engineer (or team) is expected to master not just source control, CI/CD, and scripting, but also cloud architecture, infrastructure as code, security best practices, observability, and strong cross-team communication. In many organizations these capabilities are uneven: some teams excel, others lag behind. A 2024 survey showed that while 83% of developers report participating in devops activities, using multiple CI/CD tools was correlated with worse performance — a sign that complexity without deep expertise can backfire.

Toolchain fragmentation and complexity is a related issue. Devops toolchains have sprouted into a sometimes bewildering array of packages and techniques to master: version control, CI build/test, security scanning, artifact management, monitoring, observability, deployment, secret management, and more.

The more tools you have, the more difficult it becomes to integrate them cleanly, manage their versions, ensure compatibility, and avoid duplicated effort. Organizations often get stuck with “tool sprawl” — tools chosen by different teams, legacy systems, or overlapping functionalities — which introduce friction, maintenance burden, and sometimes vulnerabilities.

Finally, although devops has spread far and wide, there is still cultural resistance and alignment. Devops isn’t just about tools and processes; it’s about collaboration, shared responsibility, and continuous feedback. Teams rooted in traditional silos (dev vs ops, or security separate) may resist changes to roles and workflows. Leadership support, communication of shared goals, trust, and allowance for continuous learning are all necessary.

Many CIOs focus too much on tools or implementation first, rather than organizational culture and behaviors; but without addressing culture, even the best tools or processes may not yield the hoped-for velocity, quality, or reliability. Organizations that succeed here tend to have proactive strategies: dedicated training programs, mentorship, internal “guilds,” pairing junior and senior engineers, and making sure leadership supports ongoing learning rather than one-off bootcamps.

Why do devops?

Whoever you ask will tell you that devops is a major culture shift for organizations, so why go through that pain at all?

Devops aims to combine the formerly conflicting aims of developers and system administrators. Under its principles, all software development aims to meet business demands, add functionality, and improve the usability of applications while also ensuring those applications are stable, secure, and reliable. Done right, this improves the velocity and quality of your output, while also improving the lives of those working on these outcomes.

Does devops save money — or add cost?

Devops teams are recognizing that speed and agility are only part of success — unchecked cloud bills and waste undermine long-term sustainability. Waste in devops often comes in the form of “devops debt”— idle cloud capacity, dead code, or false-positive security alerts—which was called a “hidden tax on innovation” in recent Java-environment studies.

 Embedding finops practices can help fight these costs. Teams should shift left on cost: estimating costs when spinning up new environments, resizing instances, and scaling down unused resources before they become runaway expenses.

How to start with devops

There are lots of resources for help getting started with devops, including Kim’s own Devops Handbook, or you can enlist the help of external consultants. But you have to be methodical and focus on your people more than on the tools and technology you will eventually use if you want to ensure lasting buy-in across the business.

A proven route to achieving this is a “land and expand” strategy, where a small group starts by mapping key value streams and identifying a single product team or workload for trialing devops practices. If this team is successful in proving the value of the shift, you will likely start to get interest from other teams and from senior leadership.

If you are at the start of your devops journey, however, make sure you are prepared for the disruption a change like this can have on your organization, and keep your eye on the prize of building better, faster, stronger software.

More on devops:

]]> <![CDATA[16 open source projects transforming AI and machine learning]]> https://tsecurity.de/de/3665665/ai-nachrichten/16-open-source-projects-transforming-ai-and-machine-learning/ https://tsecurity.de/de/3665665/ai-nachrichten/16-open-source-projects-transforming-ai-and-machine-learning/ Mon, 13 Jul 2026 17:04:27 +0200 🔧 AI Nachrichten tsecurity.de

For several decades now, the most innovative software has always emerged from the world of open source software. It’s no different with machine learning and large language models. If anything, the open source ecosystem has grown richer and more complex, because now there are open source models to complement the open source code.

For this article, we’ve pulled together some of the most intriguing and useful projects for AI and machine learning. Many of these are foundation projects, nurturing their own niche ecology of open source plugins and extensions. Once you’ve started with the basic project, you can keep adding more parts.

Most of these projects offer demonstration code, so you can start up a running version that already tackles a basic task. Additionally, the companies that build and maintain these projects often sell a service alongside them. In some cases, they’ll deploy the code for you and save you the hassle of keeping it running. In others, they’ll sell custom add-ons and modifications. The code itself is still open, so there’s no vendor lock in. The services simply make it easier to adopt the code by paying someone to help.

Here are 16 open source projects that developers can use to unlock the potential in machine learning and large language models of any size—from small to large, and even extra large.

Agent Skills

AI coding agents are often used to tackle standard tasks like writing React components or reviewing parts of the user interface. If you are writing a coding agent, it makes sense to use vetted solutions that are focused on the task at hand. Agent Skills are pre-coded tools that your AI can deploy as needed. The result is a focused set of vetted operations capable of producing refined, useful code that stays within standard guidelines. License: MIT.

Awesome LLM Apps

If you are looking for good examples of agentic coding, see the Awesome LLM Apps collection. Currently, the project hosts several dozen applications that leverage some combination of RAG databases and LLMs. Some are simple, like a meme generator, while others handle deeper research like the Journalist agent. The most complex examples deploy multi-agent teams to converge upon an answer. Every application comes with working examples for experimentation, so you can learn from what’s been successful in the past. Altogether, the apps in this collection are great inspiration for your own projects. License: Apache 2.0.

Bifrost

If your application requires access to an LLM service, and you don’t have a particular one in mind, check out Bifrost. A fast, unified gateway to more than 15 LLM providers, this OpenAI-compatible API quickly abstracts away the differences between models, including all the major ones. It includes essential features like governance, caching, budget management, load balancing, and it has guardrails to catch problems before they are sent out to service providers, who will just bill you for the time. With dozens of great LLM providers constantly announcing new and better models, why limit yourself? License: Apache 2.0.

Claude Code

If the popularity of AI coding assistants tells us anything, it’s that all developers—and not just the ones building AI apps—appreciate a little help writing and reviewing their code. Claude Code is that pair programmer. Trained on all the major programming languages, Claude Code can help you write code that is better, faster, and cleaner. It digests a codebase and then starts doing your bidding, while also making useful suggestions. Natural language commands plus some vague hand waving are all the Anthropic LLM needs to refactor, document, or even add new features to your existing code. License: Anthropic’s Commercial TOS.

Clawdbot

Many of the tools in this list help developers create code for other people. Clawdbot is the AI assistant for you, the person writing the code. It integrates with your desktop to control built-in tools like the camera and large applications like the browser. A multi-channel inbox accepts your commands through more than a dozen different communication channels including WhatsApp, Telegram, Slack, and Discord. A cron job adds timing. It’s the ultimate assistant for you, the ruler of your data. If AI exists to make our lives easier, why not start by organizing the applications on your desktop? License: MIT.

Dify

For projects that require more than just one call to an LLM, Dify could be the solution you’ve been looking for. Essentially a development environment for building complex agentic workflows, Dify stitches together LLMs, RAG databases, and other sources. It then monitors how they perform under different prompts and parameters and puts it all together in a handy dashboard, so you can iterate on the results. Developing agentic AI requires rapid experimentation, and Dify provides the environment for those experiments. License: Modified version of Apache 2.0 to exclude some commercial uses.

Eigent

The best way to explore the power and limitations of an agentic workflow is to deploy it yourself on your own machine, where it can solve your own problems. Eigent delivers a workforce of specialized agents for handling tasks like writing code, searching the web, and creating documents. You just wave your hands and issue instructions, and Eigent’s LLMs do their best to follow through. Many startups brag about eating their own dogfood. Eigent puts that concept on a platter, making it easy for AI developers to experience directly the abilities and failings of the LLMs they’re building. License: Apache 2.0.

Headroom

Programmers often think like packrats. If the data is good, why not pack in some more? This is a challenge for code that uses an LLM because these services charge by the token, and they also have a limited context window. Headroom tackles this issue with agile compression algorithms that trim away the excess, especially the extra labels and punctuation found in common formats like JSON. A big part of designing working AI applications is cost engineering, and saving tokens means saving money. License: Apache 2.0.

Hugging Face Transformers

When it comes to starting up a brand-new machine learning project, Hugging Face Transformers is one of the best foundations available. Transformers offers a standard format for defining how the model interacts with the world, which makes it easy to drop a new model into your working infrastructure for training or deployment. This means your model will interact nicely with all the already available tools and infrastructure, whether for text, vision, audio, video, or all of the above. Fitting into a standard paradigm makes it much easier to leverage your existing tools while focusing on the cutting edge of your research. License: Apache 2.0.

LangChain

For agentic AI solutions that require endless iteration, LangChain is a way to organize the effort. It harnesses the work of a large collection of models and makes it easier for humans to inspect and curate the answers. When the task requires deeper thinking and planning, LangChain makes it easy to work with agents that can leverage multiple models to converge upon a solution. LangChain’s architecture includes a framework (LangGraph) for organizing easily customizable workflows with long-term memory, and a tool (LangSmith) for evaluating and improving performance. Its Deep Agents library provides teams of sub-agents, which organize problems into subsets then plan and work toward solutions. It is a proven, flexible test bed for agentic experimentation and production deployment. License: MIT.

LlamaIndex

Many of the early applications for LLMs are sorting through large collections of semi-structured data and providing users with useful answers to their questions. One of the fastest ways to customize a standard LLM with private data is to use LlamaIndex to ingest and index the data. This off-the-shelf tool provides data connectors that you can use to unpack and organize a large collection of documents, tables, and other data, often with just a few lines of code. The layers underneath can be tweaked or extended as the job requires, and LlamaIndex works with many of the data formats common in enterprises. License: MIT.

Ollama

For anyone experimenting with LLMs on their laptop, Ollama is one of the simplest ways to download one or more of them and get started. Once it’s installed, your command line becomes a small version of the classic ChatGPT interface, but with the ability to pull a huge collection of models from a growing library of open source options. Just enter: ollama run and the model is ready to go. Some developers are using it as a back-end server for LLM results. The tool provides a stable, trustworthy interface to LLMs, something that once required quite a bit of engineering and fussing. The server simplifies all this work so you can tackle higher level chores with many of the most popular open source LLMs at your fingertips. License: MIT.

OpenWebUI

One of the fastest ways to put up a website with a chat interface and a dedicated RAG database is to spin up an instance of OpenWebUI. This project knits together a feature-rich front end with an open back end, so that starting up a customizable chat interface only requires pulling a few Docker containers. The project, though, is just a beginning, because it offers the opportunity to add plugins and extensions to enhance the data at each stage. Practically every part of the chain from prompt to answer can be tweaked, replaced, or improved. While some teams might be happy to set it up and be done, the advantages come from adding your own code. The project isn’t just open source itself, but a constellation of hundreds of little bits of contributed code and ancillary projects that can be very helpful. Being able to customize the pipeline and leverage the MCP protocol supports the delivery of precision solutions. License: Modified BSD designed to restrict removing OpenWebUI branding without an enterprise license.

Sim

The drag-and-drop canvas for Sim is meant to make it easier to experiment with agentic workflows. The tool handles the details of interacting with the various LLMs and vector databases; you just decide how to fit them together. Interfaces like Sim make the agentic experience accessible to everyone on your team, even those who don’t know how to write code. License: Apache 2.0.

Sloth

One of the most straightforward ways to leverage the power of foundational LLMs is to start with an open source model and fine-tune it with your own data. Unsloth does this, often faster than other solutions do. Most major open source models can be transformed with reinforcement learning. Unsloth is designed to work with most of the standard precisions and some of the largest context windows. The best answers won’t always come directly from RAG databases. Sometimes, adjusting the models is the best solution. License: Apache 2.0.

vLLM

One of the best ways to turn an LLM into a useful service for the rest of your code is to start it up with vLLM. The tool loads many of the available open source models from repositories like Hugging Face and then orchestrates the data flows so they keep running. That means batching the incoming prompts and managing the pipelines so the model will be a continual source of fast answers. It supports not just the CUDA architecture but also AMD CPUs and GPUs, Intel CPUs and GPUs, PowerPC CPUs, Arm CPUs, and TPUs. It’s one thing to experiment with lots of models on a laptop. It’s something else entirely to deploy the model in a production environment. vLLM handles many of the endless chores that deliver better performance. License: Apache-2.0.

]]> <![CDATA[Firefox Application Security Team: Firefox Security & Privacy Newsletter 2026 Q2]]> https://tsecurity.de/de/3665507/tools/firefox-application-security-team-firefox-security-privacy-newsletter-2026-q2/ https://tsecurity.de/de/3665507/tools/firefox-application-security-team-firefox-security-privacy-newsletter-2026-q2/ Mon, 13 Jul 2026 16:10:17 +0200 đŸ’Ÿ Tools tsecurity.de Welcome to the Q2 2026 edition of the Firefox Security & Privacy Newsletter.

Security and privacy are core principles of Mozilla’s Manifesto and remain at the heart of Firefox’s development. In this edition, we highlight some of the key security and privacy initiatives from Q2 2026, grouped into the following areas:

  • Firefox Product Security & Privacy, new security and privacy features, protections, and integrations in Firefox
  • Core Security, platform security improvements, hardening efforts, and foundational enhancements
  • Community Engagement, highlights from our security research community and bug bounty program
  • Web Security & Standards, progress on web technologies and standards that help websites better protect users from online threats

Preface

Note: Some of the bugs linked below might not be accessible to the general public and restricted to specific work groups. We de-restrict fixed security bugs after a grace-period, until the majority of our user population have received Firefox updates. If a link does not work for you, please accept this as a precaution for the safety of all Firefox users.

Firefox Product Security & Privacy

Private Access Control Tokens (PACT): PACT is a cross-industry initiative designed to tackle one of the web’s most urgent challenges: enabling websites to reliably distinguish legitimate users and authorized automated agents from abusive traffic without compromising user privacy. To introduce the initiative, we published a technical deep dive on Mozilla Hacks alongside a companion Mozilla blog post that explains the vision, motivation, and privacy-preserving design behind PACT.

Qualified Website Authentication Certificates (QWACs): Firefox is prepared to meet upcoming eIDAS requirements under the EU Digital Identity Framework. Qualified Website Authentication Certificates (QWACs), as required by the framework, are supported in Firefox 153 (Bug 2043399) onwards.

Hardening Firefox with Claude Mythos: In a blogpost we shared how our AI-assisted security testing pipeline, powered by Claude Mythos, uncovered and helped remediate hundreds of previously hidden vulnerabilities in Firefox, significantly strengthening the browser’s security while demonstrating the transformative potential of AI to enhance defensive cybersecurity.

Visual Indications for Geolocation Access: In light of some web pages using geolocation for activities that are not related to their maps functionality, Firefox now displays a real-time visual indicator whenever a web page is accessing the user’s geolocation. Starting with Firefox 153, the address bar now provides a real-time visual indicator the moment a website begins accessing a user’s location, providing users with immediate awareness and greater transparency into when and how their geolocation data is being used.

Improving Website Compatibility in Private Browsing: Starting with Firefox 152, Private Browsing Mode now offers users the option to temporarily lower tracking protections for the current tab when stricter tracker blocking could be causing a website to malfunction. Previously, this may have resulted in users turning off privacy protections completely to continue using visited web page. With our new feature, users can quickly restore site functionality of the current tab, preserving users’ overall privacy settings.

Instant fresh start through new Fire Button: Firefox 151 introduced the new Fire Button for Private Browsing, giving users an instant fresh start with a single click. Instead of closing and reopening a Private Window, users can immediately clear all browsing data and continue browsing in a clean session, making Private Browsing faster, more convenient, and just as private.

Advanced Anti-Fingerprinting Protections: Firefox 151 expands our default anti-fingerprinting defenses by ensuring the Available Screen Resolution, Touch Points, and Canvas APIs will provide uniform results for all of our users while also maintaining performance and compatibility. On macOS, for example, these enhancements are expected to reduce the share of users identified as unique by more than 20%, making it significantly harder for websites to uniquely identify and track users using obscure fingerprinting.

Local Network Access Protections: Firefox now requires user permission before websites can access apps and services on a user’s local network or device, helping prevent unauthorized access and sneaky tracking attempts. The LNA feature is rolling out gradually, starting with Firefox Desktop 151 through 153. Android support will follow in upcoming releases.

Core Security

Firefox CA Root Program: We published Root Store Policy v3.1, introducing stricter transparency, documentation, and audit requirements for public CAs to strengthen trust in the Web PKI.

WebAuthn Related Origin Requests: This feature allows seamless passkey sign-ins across related domains e.g., the same provider using multiple top-level domains. In contrast to other browsers, Firefox UI provides transparency and choice so users are aware and can control when websites request for passkeys from other, related sites.

Community Engagement

Hosting Events: We organized and hosted multiple web tech meet-ups in the Mozilla Berlin office, bringing together the developer community to explore the latest advances in web technology, privacy, and security. If you’re in the area, we’d love to have you join us at a future event.

Community Shares: Firefox tracking protection was presented at the SnooSec conference held in the Reddit NYC office. We also had a presentation about existing and upcoming protections against web tracking at the Chemnitz Linux Days conference, and a talk about the latest browser-based XSS protections at OWASP AppSec ‘26 in Vienna.

Web Security & Standards

Web Application Integrity, Consistency and Transparency (WAICT): We are working on WAICT, a new proposal to bring stronger integrity and transparency guarantees to web applications, helping make the web a more trustworthy platform for security-sensitive applications such as end-to-end encrypted messaging. We shared our technical vision in a Mozilla Hacks blog post, including a prototype implementation in Firefox Nightly that works with our WAICT Demo and a draft specification.

Sanitizer API: We are advancing the Sanitizer API to make robust protection against cross-site scripting (XSS) vulnerabilities more accessible. By exploring an implicit sanitizer policy that integrates with Trusted Types, we aim to prevent an entire class of XSS attacks with no application code changes, making secure-by-default web applications easier to build and deploy.

Looking Ahead

Firefox users will receive these security and privacy improvements automatically. If you’re not already a user, we recommend you give it a try. Firefox helps you shape a more personal internet that puts you back in control - all while supporting the non-profit Mozilla in its mission to keep the web open, safe, and accessible for everyone.

Thank you to everyone who contributes to making Firefox and the web more secure and privacy-focused. You can have an impact too, just by reporting bugs, conducting research, contributing code, or providing feedback.

We look forward to sharing more updates in the Q3 2026 edition.

— The Firefox Security & Privacy Teams

]]> <![CDATA[Cloudflare Precursor uses continuous behavioral analysis to stop advanced bots]]> https://tsecurity.de/de/3665418/it-security-nachrichten/cloudflare-precursor-uses-continuous-behavioral-analysis-to-stop-advanced-bots/ https://tsecurity.de/de/3665418/it-security-nachrichten/cloudflare-precursor-uses-continuous-behavioral-analysis-to-stop-advanced-bots/ Mon, 13 Jul 2026 15:38:29 +0200 📰 IT Security Nachrichten tsecurity.de Cloudflare has announced the general availability of Precursor, a next-generation, continuous behavioral validation engine for bot management. Precursor runs seamlessly inside web browsers to monitor entire user sessions in order to detect bot automation. Unlike static CAPTCHAs, it analyzes ongoing interactions in real time to catch advanced bots, improving detection precision without interrupting legitimate users. For the first time, automated bot traffic has eclipsed human activity on the Internet, now generating roughly 57% of all 
 More →

The post Cloudflare Precursor uses continuous behavioral analysis to stop advanced bots appeared first on Help Net Security.

]]> <![CDATA[Which AI model should you bet your company on?]]> https://tsecurity.de/de/3664783/ai-nachrichten/which-ai-model-should-you-bet-your-company-on/ https://tsecurity.de/de/3664783/ai-nachrichten/which-ai-model-should-you-bet-your-company-on/ Mon, 13 Jul 2026 11:33:26 +0200 🔧 AI Nachrichten tsecurity.de

Every day this past week I did something I suspect millions of other people also did: I stared at an LLM model picker and wondered which one I was supposed to want.

OpenAI just released ⁠GPT-5.6 Sol, Terra, and Luna. Sol is the flagship. Terra offers much of its intelligence for less money. Luna is cheaper still. Anthropic released ⁠Claude Sonnet 5 at the end of June and Opus 4.8 the month prior, with a little Fable 5 emerging in between. Meanwhile, Google, which seemed to be winning the model wars a few months ago, is now getting shade from Gergely Orosz, who ⁠argues that Gemini has slipped outside the top tier for software development and has been out of the major model release game for eons (May 19).

Perhaps Orosz is right. Perhaps he’ll be wrong again in six weeks. Honestly, it’s exhausting.

I use ChatGPT and Claude constantly and still have no principled idea which model to choose most of the time. I tend to click whatever looks like the biggest, most expensive option because I don’t know what I’m giving up by choosing something smaller. “Instant” sounds dangerously unserious. “Thinking” sounds expensive but powerful.

A quick survey of my LinkedIn crowd suggests others also feel my “WHICH MODEL???” pain. More importantly, I suspect most enterprises do, too.

A model doesn’t rot

Before getting carried away, however, it’s worth considering whether any of this model churn actually matters. After all, a model doesn’t rot. The model an enterprise put into production in March performs just as well in July as it did when the company selected it. “Obsolete” generally means that something better now exists, not that the deployed model suddenly stopped summarizing insurance claims or classifying support tickets. (In other words, once you have something working, the idea that “but maybe Opus 200.2 is better!” is really a FOMO problem, not a performance issue.)

Most enterprise workloads don’t live at the frontier anyway. Extraction, summarization, classification, document comparison, and customer-service assistance often work perfectly well with smaller, cheaper models. OpenAI’s own pitch for the trio of GPT-5.6 models isn’t simply that Sol is better. It’s that ⁠Terra and Luna deliver different combinations of intelligence, latency, and cost. Luna, the cheapest tier, nearly matches the previous generation’s peak performance at less than half the estimated cost, according to OpenAI.

The practical question, of course, is where to start. An enterprise can’t test every model, every reasoning setting, and every price tier before doing any work. So here’s my advice (which I don’t follow in my own work, but I’m not defining enterprise strategy and can be a little price-insensitive). Start with the cheapest credible model that appears capable of the task. Give it a representative set of real examples and, before you start testing, define what counts as good enough. If it passes, stop. If it fails, move up a tier or try a model with strengths better suited to the work.

That sounds almost offensively simple, but it reverses the way many people, including me, use these products. We start with the biggest model because we’re afraid of what we might lose. Enterprises should start lower and require evidence before paying for more intelligence.

There are exceptions, of course. For genuinely difficult work, such as autonomous coding, complex research, or high-stakes reasoning, beginning with a frontier model may save time. But even then, the goal should be to establish a quality ceiling, then test whether a cheaper model can meet it. It’s changing the question from “which model is best?” to “what is the least expensive model that reliably clears the bar for this job?”

For many workloads, that price improvement matters more than a few extra benchmark points. ⁠As I argued back in 2023, following AI hype doesn’t help anyone. If your model strategy depends on whichever benchmark screenshot is circulating on X this week, you don’t have a strategy. Not a viable one, anyway. Pick a model and ignore the noise.

Except, of course, when that noise suggests a serious signal.

Sometimes better really is better

Frontier improvements aren’t always incremental, making it advantageous to consider an upgrade. Coding is the obvious example. There’s a significant difference between a model that suggests the next few lines of code and one that can inspect a repository, plan a change, use tools, run tests, discover its own mistakes, and keep working for an extended period. That isn’t merely a nicer autocomplete experience. It can reorganize a development workflow.

This is why enterprises can’t simply standardize on an 18-month-old model and declare victory. In some areas, particularly software development and other agentic work, better models can unlock compounding productivity. A model that reliably completes 80% of a bounded task rather than 50% may justify an entirely different division of labor between humans and machines.

Still, that upgrade isn’t free.

Models differ in how they interpret instructions, call tools, manage context, refuse requests, and fail. Prompts and scaffolding tuned for one model can regress when moved to another. Or costs can explode. As one of my Oracle colleagues discovered just this week, running the same tasks in GPT 5.6 was orders of magnitude more expensive than 5.5. The API change may be trivial, but the revalidation and implications are not.

This leaves enterprises caught between two bad options. They can freeze and potentially miss out on meaningful improvements or chase every release and repeatedly test production systems on faith. What to do?

Stop making model bets

The answer is to stop making LLM bets and start making job-to-be-done bets. Stop asking which model is fastest. Instead, figure out what work you are trying to improve. What does a good result look like? How much latency and cost can the workflow tolerate? How wrong can it be before a human must intervene? Once those questions have answers, model selection becomes less opaque.

A difficult code migration may justify GPT-5.6 Sol or Claude Sonnet 5. A repetitive classification task may work just as well with Luna or another smaller model. A regulated workflow may require a model or deployment option that offers particular data controls. Sometimes the correct model is no LLM at all, like when I’m writing this post. Sorry, AI vendors! (At least you won’t get blamed for my mistakes.)

This is where evaluations become the center of enterprise AI strategy. ⁠As I’ve said before, most companies don’t have an AI quality problem so much as an AI measurement problem. Hence, a private evaluation suite built from real company work is the only leaderboard that matters. Does the new model materially improve quality? If so, use it! Does it reduce cost or latency? Again, that’s your free pass to adoption. Does the improvement justify the expense and effort of revalidation? If yes, continue.

Make model releases boring

As important as the model is, keep in mind that AI success always comes back to your company’s data, your company’s workflows, your company’s integrations, etc. That’s the ⁠dull reality behind sexy AI. Retrieval, memory, governance, data quality, observability, and feedback loops aren’t as exciting as a new model launch, but they’re what ultimately make AI truly work.

Again, when it’s time to consider something new, the principle should be to default to the least expensive model that reliably passes your evaluations. Only escalate harder tasks to more capable models when measurement shows that the premium pays. Tip: Make this invisible to employees so that the system routes to the best model for a particular prompt. As dbt Labs’ Jon Lewis expresses it, “The best model is ‘Auto’ and I won’t hear anyone say otherwise.” OpenAI’s own ⁠migration guidance recommends testing models on representative tasks, including trying a lower reasoning level rather than automatically cranking everything to the maximum.

As for me, I’ll probably keep clicking the shiniest option. I don’t have a formal evaluation suite for InfoWorld columns, and the marginal cost is a subscription I already pay. Enterprises don’t get that excuse.

]]> <![CDATA[Hungry? We talk Smoked Meat, Poutine, and Bagel - also, Identiverse Interviews! - John Pritchard, Cassie Christensen, Jaime Lewis-Gross, François Proulx, Kim Brown - ESW #467]]> https://tsecurity.de/de/3664752/it-security-nachrichten/hungry-we-talk-smoked-meat-poutine-and-bagel-also-identiverse-interviews-john-pritchard-cassie-christensen-jaime-lewis-gross-franois-proulx-kim-brown-esw-467/ https://tsecurity.de/de/3664752/it-security-nachrichten/hungry-we-talk-smoked-meat-poutine-and-bagel-also-identiverse-interviews-john-pritchard-cassie-christensen-jaime-lewis-gross-franois-proulx-kim-brown-esw-467/ Mon, 13 Jul 2026 11:21:15 +0200 📰 IT Security Nachrichten tsecurity.de Interview with François Proulx from Boost Security

Software Supply Chain Security: Build Pipeline (CI/CD) Exploitation

Boost Security is the creator of some very popular build pipeline security tools, like Bagel and Poutine. Today, we discuss their latest tool, Smoked Meat. They describe it as "Like Metasploit, but for CI/CD pipelines".

Segment Resources:

Identiverse Interview with Dr. John Prichard from Radiant Logic

The Three Identity Problem: Surviving Identity Security's Chaotic Era

Identity security has entered its chaotic era. Human, non-human, and agentic AI identities no longer just coexist. They form an uncontrolled inheritance chain in which a human creates an agent, the agent spins up service principals, OAuth grants, and role assignments, and that whole chain keeps running long after the human changes roles or leaves. Most of these chains are being spawned by business users on low-code and enterprise AI platforms, outside traditional identity controls and largely invisible to security.

In this segment, Radiant Logic CEO Dr. John Pritchard joins us to unpack why this is no longer a visibility problem. It is an observability problem. And it is shifting the center of gravity in identity security from authentication to authorization. Listeners will leave with a clearer view of where their current IAM, IGA, and NHI programs fall short, and a practical lens for governing the rapidly expanding population of AI agents already inside their environments.

To go deeper on what John discussed today, watch Radiant Logic's on-demand webinar Identities Under Attack: How Adversaries Exploit the Human-Machine-Agent Divide at https://securityweekly.com/radiantlogicidv.

Identiverse Interview with Cassie Christensen from Saviynt

Everyone Wants an AI Assistant. Few Are Ready to Govern One

Explore a growing reality many professionals can relate to: the appeal of using AI agents to handle the work that keeps piling up - from inbox management to research and logistics - and the governance challenges that quickly follow. The real barrier to scaling personal or enterprise AI agents isn't the technology itself, but defining clear roles, access boundaries, oversight, and lifecycle management. As organizations deploy more autonomous AI agents, the same identity frameworks used to govern workforce and non-employee identities must now evolve to manage AI-driven access before scale and risk outpace control.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Identiverse Interview with Jaime Lewis-Gross from Saviynt

From Sales Engineer to Forward Deployed Engineer: The Rise of Hybrid Technical Roles

As technology organizations evolve, technical roles are becoming increasingly fluid - particularly at the intersection of product, engineering, and customer success. This conversation explores what it means to be a modern sales engineer and how the role is increasingly expanding into responsibilities often associated with forward deployed engineers: translating complex technical capabilities into real-world outcomes, solving customer challenges in real time, and serving as a critical bridge between product teams and end users. At the center of this evolution is a customer-first mindset - one that prioritizes listening, adaptability, and long-term partnership. As organizations race to innovate, the companies that stand out will be those that remain deeply focused on customer needs while empowering technical teams to operate beyond traditional role boundaries.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Identiverse Interview with Kim Brown from LexisNexis

Stop Identity Fraud: Modern Strategies for Insurance and Healthcare

Identity fraud is growing more sophisticated across both insurance and healthcare, making identity management a critical line of defense. In this executive interview, Kim Brown, VP of Product Management, will explore how organizations can strengthen identity verification, authentication, and risk assessment to reduce fraud while improving user experiences. The discussion will highlight emerging threats, evolving regulatory expectations, and practical strategies for deploying identity solutions at scale. Attendees will gain actionable insights to protect customers, patients, and their organizations without adding friction.

This segment is sponsored by LexisNexis Risk Solutions. Visit https://securityweekly.com/lexisnexisidv to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-467

]]> <![CDATA[Hungry? We talk Smoked Meat, Poutine, and Bagel - also, Identiverse Interviews! - ESW #467]]> https://tsecurity.de/de/3664747/it-security-video/hungry-we-talk-smoked-meat-poutine-and-bagel-also-identiverse-interviews-esw-467/ https://tsecurity.de/de/3664747/it-security-video/hungry-we-talk-smoked-meat-poutine-and-bagel-also-identiverse-interviews-esw-467/ Mon, 13 Jul 2026 11:17:45 +0200 đŸŽ„ IT Security Video tsecurity.de Author: Security Weekly - A CRA Resource - Bewertung: 1x - Views:2

Interview with François Proulx from Boost Security

Software Supply Chain Security: Build Pipeline (CI/CD) Exploitation

Boost Security is the creator of some very popular build pipeline security tools, like Bagel and Poutine. Today, we discuss their latest tool, Smoked Meat. They describe it as "Like Metasploit, but for CI/CD pipelines".

Segment Resources:
- Smoked Meat announcement: https://labs.boostsecurity.io/articles/introducing-smokedmeat
- Smoked Meat github: https://github.com/boostsecurityio/smokedmeat
- Smoked Meat demo: https://www.youtube.com/watch?v=F5Hr_201Au8 with Guillaume and François

Dr. John Prichard from Radiant Logic

The Three Identity Problem: Surviving Identity Security's Chaotic Era

Identity security has entered its chaotic era. Human, non-human, and agentic AI identities no longer just coexist. They form an uncontrolled inheritance chain in which a human creates an agent, the agent spins up service principals, OAuth grants, and role assignments, and that whole chain keeps running long after the human changes roles or leaves. Most of these chains are being spawned by business users on low-code and enterprise AI platforms, outside traditional identity controls and largely invisible to security.

In this segment, Radiant Logic CEO Dr. John Pritchard joins us to unpack why this is no longer a visibility problem. It is an observability problem. And it is shifting the center of gravity in identity security from authentication to authorization. Listeners will leave with a clearer view of where their current IAM, IGA, and NHI programs fall short, and a practical lens for governing the rapidly expanding population of AI agents already inside their environments.

To go deeper on what John discussed today, watch Radiant Logic's on-demand webinar Identities Under Attack: How Adversaries Exploit the Human-Machine-Agent Divide at https://securityweekly.com/radiantlogicidv.

Cassie Christensen from Saviynt

Everyone Wants an AI Assistant. Few Are Ready to Govern One

Explore a growing reality many professionals can relate to: the appeal of using AI agents to handle the work that keeps piling up - from inbox management to research and logistics - and the governance challenges that quickly follow. The real barrier to scaling personal or enterprise AI agents isn’t the technology itself, but defining clear roles, access boundaries, oversight, and lifecycle management. As organizations deploy more autonomous AI agents, the same identity frameworks used to govern workforce and non-employee identities must now evolve to manage AI-driven access before scale and risk outpace control.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Jaime Lewis-Gross from Saviynt

From Sales Engineer to Forward Deployed Engineer: The Rise of Hybrid Technical Roles

As technology organizations evolve, technical roles are becoming increasingly fluid - particularly at the intersection of product, engineering, and customer success. This conversation explores what it means to be a modern sales engineer and how the role is increasingly expanding into responsibilities often associated with forward deployed engineers: translating complex technical capabilities into real-world outcomes, solving customer challenges in real time, and serving as a critical bridge between product teams and end users. At the center of this evolution is a customer-first mindset - one that prioritizes listening, adaptability, and long-term partnership. As organizations race to innovate, the companies that stand out will be those that remain deeply focused on customer needs while empowering technical teams to operate beyond traditional role boundaries.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Kim Brown from LexisNexis

Stop Identity Fraud: Modern Strategies for Insurance and Healthcare

Identity fraud is growing more sophisticated across both insurance and healthcare, making identity management a critical line of defense. In this executive interview, Kim Brown, VP of Product Management, will explore how organizations can strengthen identity verification, authentication, and risk assessment to reduce fraud while improving user experiences. The discussion will highlight emerging threats, evolving regulatory expectations, and practical strategies for deploying identity solutions at scale. Attendees will gain actionable insights to protect customers, patients, and their organizations without adding friction.

This segment is sponsored by LexisNexis Risk Solutions. Visit https://securityweekly.com/lexisnexisidv to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-467

]]> <![CDATA[Why AI needs contextual intelligence — not just bigger models]]> https://tsecurity.de/de/3664720/it-security-nachrichten/why-ai-needs-contextual-intelligence-not-just-bigger-models/ https://tsecurity.de/de/3664720/it-security-nachrichten/why-ai-needs-contextual-intelligence-not-just-bigger-models/ Mon, 13 Jul 2026 11:08:42 +0200 📰 IT Security Nachrichten tsecurity.de

A product manager on my team recently asked me where we were seeing the most issues across the engineering team. Instead of guessing, I had an engineering lead point Claude at our Jira via an MCP connector and look at the bug patterns himself.

One team had a wildly disproportionate share of tickets — about 50% of their sprint time was spent on “bugs,” versus roughly 25% for everyone else. The headline number suggested a quality problem.

It wasn’t. When we layered in the context around those tickets, almost none of them were bugs. They were manual workarounds for a missing product capability: customers asking us, one request at a time, to restore items they had accidentally deleted. Not shipping an item restore feature was burning roughly 1.5 engineers’ worth of capacity. I went back to our product team and said, “Build this, and you reclaim a person and a half.”

The analysis took 45 minutes. It was only possible because our data was already organized, tagged by team, connected to contributors, accessible through MCP and protected by role-based access. None of that is “AI.” All of it is the layer underneath AI that almost nobody invests in first. That’s probably because the investment is unglamorous: updating data dictionaries, access controls, team taxonomies, system-to-system mappings. Most of the work has been the same for twenty years. AI just raised the cost of skipping it.

The intelligence underneath the models

I keep coming back to the value of context data layers as a CTO in the middle of an AI rollout. I have started calling that value proposition contextual intelligence because I haven’t found a better name. Anthropic’s engineering team has been calling this kind of work “context engineering” since late 2025, and CIO ran its own feature on the term shortly after. Whether you describe it as contextual intelligence or context engineering, it’s the part of the stack where the actual programming work still lives.

If business logic is your company’s official org chart, then contextual intelligence is knowing who actually gets things done, how decisions are actually made and what the unwritten rules are. One is theory. The other is reality.

Most enterprise systems capture the theory. The systems that capture how work actually happens — what people do, how teams operate, where decisions get stuck — are rarer and harder to build. And modern LLMs, it turns out, are useless without both.

I learned this the hard way at a recent company hackathon. Nine engineering teams, one prompt: make our operational dataset more usable through AI. My team built persona-based chatbots (CFO, CIO, sales manager) on top of an MCP server backed by Postgres and our enrichment data. Other teams built dashboard generators, Looker conversational analytics and workflow agents.

The initial demos all had the same problem. Claude could talk to our data, but the answers were either generic or confidently wrong. The CFO persona would happily report a “spend trend” that quietly conflated two distinct cost categories across two different tables. The CIO persona would answer questions about team productivity, but the averages across roles should never have been aggregated. The sales manager persona returned answers that were technically correct against the schema and completely wrong against the business. The raw data was rich. The context layer around it didn’t exist yet. Chatting with raw data is not an AI product. It’s a demo.

One of my senior engineers spent the second day ripping out the agent’s direct database connection. He stopped trying to prompt-engineer the LLM to understand our business and instead codified that logic into the data pipeline. Working backward from the failed CFO answers, he mapped out the implicit knowledge an experienced controller relies on: Explicitly defining which legacy tables actually represent ‘spend,’ writing the rules for currency normalization and hardcoding our fiscal time windows. He built a series of semantic SQL views to enforce these rules and restricted the MCP server to exposing only this curated layer. When we pointed the same model at those same questions, it returned completely different answers. They were specific, evidence-based and grounded in our actual business reality. The model didn’t get smarter. The engineering beneath it did.

The same pattern shows up everywhere I look right now

McKinsey keeps publishing that software development tops enterprise AI use cases, with companies reporting 30–50% productivity gains in pilots. The pilot numbers are real. They rarely translate to top- or bottom-line impact in production. Our own company data tells the same story: Between Q1 2025 and Q1 2026, our total AI tool usage grew by 328% (over 4x). Over that same period, PR throughput grew by just 49%.

That gap — adoption way up, outcomes inching along — is the context gap. Plug a generic agent into raw, uninterpreted data, and it will act inefficiently at best, harmfully at worst. An agent optimizing sales without your customer segmentation or product hierarchy will confidently recommend the wrong thing. Anthropic framed the shift directly: building with language models is becoming “less about finding the right words and phrases for your prompts, and more about answering the broader question of what context configuration is most likely to generate our model’s desired behavior.” That second question — what context configuration  — is the entire game. Most organizations are still answering the first one.

Where the work actually lives

A growing number of CTOs I talk to are shifting their AI investments accordingly. Less attention on the model. More on the layer between the model and the data.

When peers ask me what that actually looks like day-to-day, I tell them I give every engineering role the same mandate: the LLM should never see raw, uncontextualized data.

In practice, that breaks down to three pieces of work, none of them glamorous.

The first is semantic middleware. We need code that transforms raw data into business-meaningful signals before it ever reaches the model. Our feature stores hold things like “employee code velocity on critical-path features,” not “X logged 50 Git commits.” The work of figuring out what “critical-path” means in our product, in our org, on this team is the work. It does not get cheaper because the model has gotten better.

The second is multi-agent design. Instead of one omniscient orchestrator, we run smaller agents scoped to specific domains, each with rules that catch the failure modes the main model is known for. We pair them with RAG that retrieves precomputed insights, with their rules attached, rather than raw documents. Validation checkpoints sit between steps and flag suggestions that violate known constraints, such as averaging productivity across completely different job functions. The guardrails are not there to be clever. They are there because we already watched the model make those exact mistakes.

The third is evaluation that takes business logic seriously. When I look at a model, general benchmark accuracy is the least interesting number. I want to know whether it respects our constraints and integrates cleanly with our existing architecture. That sometimes means fine-tuning our patterns, sometimes constitutional approaches to embed principles, sometimes hybrid systems where deterministic rules sit alongside the probabilistic ones. The throughline is the same: validate against reality, not against the benchmark.

Why this matters now

The reason this matters more now than it did six months ago is that adoption is moving faster than measurement, let alone integration. Model Evaluation & Threat Research’s (METR) developer productivity work tells the story in a way they didn’t intend. In early 2025, they ran a controlled study and found AI tools slowed experienced open-source developers by 19%. When they tried to repeat the study in late 2025, the experiment broke. Thirty to fifty percent of developers refused to submit tasks under the no-AI condition. They wouldn’t accept working without their tools. METR is now redesigning the study because the original methodology no longer holds up against how developers actually work. That’s how fast adoption moved. But I’d be willing to bet the organizational scaffolding required to convert that adoption into outcomes — context layers, workflow redesign, retraining around new tools — moved nowhere near as fast.

Get ahead with context

The teams I’ve seen succeed with AI built the context layer first. The teams I’ve seen struggle eventually built in context anyway, just at higher cost and with more scar tissue. Raw data is the new currency. But raw data without a context layer is cash sitting in a vault. It cannot act on anything. The difference between insight and noise is a layer of code that understands what your data means.

That layer is the work. It is where the next decade of competitive advantage will sit. And in my experience, the organizations that build it first are the ones that will actually get the productivity gains the rest of the market keeps promising.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Stanford Researchers Introduce TRACE: A Capability-Targeted Agentic Training System That Turns Recurrent Agent Failures Into Synthetic RL Environment]]> https://tsecurity.de/de/3664678/ai-nachrichten/stanford-researchers-introduce-trace-a-capability-targeted-agentic-training-system-that-turns-recurrent-agent-failures-into-synthetic-rl-environment/ https://tsecurity.de/de/3664678/ai-nachrichten/stanford-researchers-introduce-trace-a-capability-targeted-agentic-training-system-that-turns-recurrent-agent-failures-into-synthetic-rl-environment/ Mon, 13 Jul 2026 10:49:15 +0200 🔧 AI Nachrichten tsecurity.de Agentic LLMs keep failing the same way because they lack specific, reusable capabilities. Stanford's TRACE diagnoses those gaps from an agent's own trajectories, synthesizes one verifiable training environment per capability, trains a LoRA adapter for each, and routes tokens across experts—improving τÂČ-Bench by +15.3 points and reaching 73.2% Pass@1 on SWE-bench Verified.

The post Stanford Researchers Introduce TRACE: A Capability-Targeted Agentic Training System That Turns Recurrent Agent Failures Into Synthetic RL Environment appeared first on MarkTechPost.

]]> <![CDATA[Your AI agent shouldn’t know everything – it should know who to ask]]> https://tsecurity.de/de/3664615/it-nachrichten/your-ai-agent-shouldnt-know-everything-it-should-know-who-to-ask/ https://tsecurity.de/de/3664615/it-nachrichten/your-ai-agent-shouldnt-know-everything-it-should-know-who-to-ask/ Mon, 13 Jul 2026 10:18:31 +0200 📰 IT Nachrichten tsecurity.de

Intro

  • Consumers across APJ are getting more impatient. They expect brands to resolve their issues in just 24 minutes on average.
  • If the brand is unsuccessful, 34% say they’ll switch channels to find a faster path to resolution, and 30% say they’ll abandon the effort altogether.
  • Most leaders reading this insight would respond by improving agent response times, but speed isn’t the problem. The crux is that consumers want a solution, not to wait less.
  • Unfortunately, the AI that most brands have deployed are chatbots who try to handle everything (and then fail).
  • What we’re seeing is the opposite. The most productive agents aren’t generalists, but specialists who excel at one thing and know when to hand off when they can’t handle something.
  • This intelligent orchestration is a superpower.

The cost of sending customers in circles

  • 90% of business leaders believe their customers are satisfied with conversational AI, but only 59% of consumers agree.
  • 54% of consumers say AI agents rarely or never have context about them as a customer.
  • 78% say it’s important to be able to switch from an AI agent to a human, yet only 15% report experiencing seamless handoffs.
  • Most escalations involve lost context, repeated explanations, and restarted conversations. Every misroute doesn’t just waste one interaction—it triggers a cascade. The customer calls back, a second agent asks the same questions, trust erodes, and the next interaction starts from a deficit.
  • It’s no wonder that 42% of consumers say AI makes them less patient, not more. 41% are satisfied with how brands currently use AI.
  • For customer service teams, the real challenge is routing, not tech.

What self-service really needs

  • Brands need four capabilities for self-service AI agents to work.
    • 1. Agency: Specialised agents that can handle defined tasks with precision and don’t attempt everything and resolve nothing.
    • 2. Always-on monitoring: The system must monitor interaction quality in real time and catch failures before they compound into callbacks.
    • 3. Real-time contextual data: Agents must have a unified view of the customer, including history, intent, and recent interactions.
    • 4. Intelligent routing: The system must accurately decide in the moment whether a task stays with AI, moves to a specialist, or escalates to a human with full context.
  • Of these four, routing is the most underinvested and the one that determines whether the other three deliver value.

Routing is the intelligence layer

  • Think of routing not as plumbing but as decision-making.
  • A well-designed system evaluates task complexity, required skills, customer history, sentiment, and more before matching it to the right resource.
  • For example, a complex billing dispute will be routed to a senior billing specialist, not the next available generalist. A routing appointment request stays with the AI agent that can solve it in seconds.
  • When the AI encounters an edge case it can’t handle, the routing layer transfers the task, along with full context, so the next agent can pick up where the AI left off.
  • Twilio’s own research confirms this. 42% of consumers prefer starting with a human agent, even if it takes longer, while 23% are comfortable starting with AI and escalating when needed.
  • Both paths demand routing intelligence. The AI-first customer needs seamless escalation, and the human-first customer needs to reach the right human immediately. Neither can afford a misroute.

When resolution compounds

  • Every issue resolved on first contact is one fewer repeat call in the queue.
  • Fewer repeat calls mean shorter wait times for everyone.
  • This compounding effect extends to agent capacity. When routing works, human agents are freed from solving issues that should have been addressed the first time. They spend their time on complex, high-value interactions instead.
  • This is what 72% of consumers are signaling when they say they’d choose AI over a human if the issue was guaranteed to be solved faster.
  • 46% of consumers say quick service and resolution are their top priorities, and 51% say delays are acceptable if they lead to better customer support.
  • Patience is available but only when the brands earn it by sending customers to the right place the first time.
  • The brands that treat routing as an afterthought will keep optimising for speed and see their customers quietly leave. Those who optimise for resolution will build trust that compounds with every interaction.

To learn more about Twilio, visit here.

]]> <![CDATA[Why SBOMs, signing, and provenance still don’t tell you if software is safe]]> https://tsecurity.de/de/3664553/it-security-nachrichten/why-sboms-signing-and-provenance-still-dont-tell-you-if-software-is-safe/ https://tsecurity.de/de/3664553/it-security-nachrichten/why-sboms-signing-and-provenance-still-dont-tell-you-if-software-is-safe/ Mon, 13 Jul 2026 09:38:51 +0200 📰 IT Security Nachrichten tsecurity.de We have made real progress in software supply chain security, improving visibility into software components, authenticity and build integrity. Much of this progress traces back to Executive Order 14028, which pushed agencies, contractors and enterprises to invest in SBOMs, signing


Read more →

The post Why SBOMs, signing, and provenance still don’t tell you if software is safe appeared first on IT Security News.

]]> <![CDATA[Why SBOMs, signing, and provenance still don’t tell you if software is safe]]> https://tsecurity.de/de/3664416/it-security-nachrichten/why-sboms-signing-and-provenance-still-dont-tell-you-if-software-is-safe/ https://tsecurity.de/de/3664416/it-security-nachrichten/why-sboms-signing-and-provenance-still-dont-tell-you-if-software-is-safe/ Mon, 13 Jul 2026 08:37:11 +0200 📰 IT Security Nachrichten tsecurity.de We have made real progress in software supply chain security, improving visibility into software components, authenticity and build integrity. Much of this progress traces back to Executive Order 14028, which pushed agencies, contractors and enterprises to invest in SBOMs, signing and provenance. All of that matters, but it is not enough. The current software trust model still stops short of the question that determines risk at execution: What is this code capable of doing if 
 More →

The post Why SBOMs, signing, and provenance still don’t tell you if software is safe appeared first on Help Net Security.

]]> <![CDATA['Forget Coders. the Real AI Threat Is In the Back Office']]> https://tsecurity.de/de/3663920/it-security-nachrichten/forget-coders-the-real-ai-threat-is-in-the-back-office/ https://tsecurity.de/de/3663920/it-security-nachrichten/forget-coders-the-real-ai-threat-is-in-the-back-office/ Mon, 13 Jul 2026 00:37:56 +0200 📰 IT Security Nachrichten tsecurity.de

Read more of this story at Slashdot.

]]> <![CDATA[Lending DocAI fast tracks the home loan process]]> https://tsecurity.de/de/3662838/it-security-nachrichten/lending-docai-fast-tracks-the-home-loan-process/ https://tsecurity.de/de/3662838/it-security-nachrichten/lending-docai-fast-tracks-the-home-loan-process/ Sun, 12 Jul 2026 08:07:00 +0200 📰 IT Security Nachrichten tsecurity.de

Artificial intelligence (AI) continues to transform industries across the globe, and business decision makers of all kinds are taking notice. One example is the mortgage industry; lending institutions like banks and mortgage brokers process hundreds of pages of borrower paperwork for every loan - a heavily manual process that adds thousands of dollars to the cost of issuing a loan. In this industry, borrowers and lenders have high expectations; they want a mortgage document processing solution catered to improving operational efficiency, while ensuring speed and data accuracy. They also want a document automation process that helps enhance their current security and compliance posture.

At Google, our goal to understand and synthesize the content of the world wide web has given us unparalleled capabilities in extracting structured data from unstructured sources. Through Document AI, we've started bringing this technology to some of the largest enterprise content problems in the world. And with Lending DocAI, now in preview, we're delivering our first vertically specialized solution in this realm.

Lending DocAI.gif

Lending DocAI is a specialized solution in our Document AI portfolio for the mortgage industry. Unlike more generalized competitive offerings, Lending DocAI provides industry-leading data accuracy for documents relevant to lending. It processes borrowers’ income and asset documents to speed-up loan applications—a notoriously slow and complex process. Lending DocAI leverages a set of specialized models, focused on document types used in mortgage lending, and automates many of the routine document reviews so that mortgage providers can focus on the more value-added decisions. Check out this product demo. 

In short, Lending DocAI helps:  

  • Increase operational efficiency in the loan process: Speed up the mortgage workflow processes (e.g. loan origination and mortgage servicing) to easily process loans and automate document data capture, while ensuring that accuracy and breadth of different documents (e.g. tax statements, income and asset documents) support enterprise readiness.

  • Improve home loan experience for borrowers and lenders: Transform the home loan experience by reducing the complexity of document process automation. Enable mortgage applications to be more easily processed across all stages of the mortgage lifecycle, and accelerate time to close in the loan process.

  • Support regulatory and compliance requirements: Reduce risk and enhance compliance posture by leveraging a technology stack (e.g. data access controls and transparency, data residency, customer managed encryption keys) that reduces the risk of implementing an AI strategy. It also streamlines data capture in key mortgage processes such as document verification and underwriting.

Partnering to transform your home loan experience

Our Deployed AI approach is about providing useful solutions to solve business challenges, which is why we’re working with a network of partners in different phases of the loan application process. We are excited to partner with Roostify to transform the home loan experience during origination. Roostify makes a point-of-sale digital lending platform that uses Google Cloud Lending DocAI to speed-up mortgage document processing for borrowers and lenders. Roostify has been working with many customers to develop our joint solution, and we have incorporated valuable feedback along the way.

“The mortgage industry is still early in transitioning from traditional, manual processes to digitally-enabled and automated, and we believe that transformation will happen much more quickly with the power of AI. And if you are going to do AI, you’ve got to go Google.” - Rajesh Bhat, Founder and CEO, Roostify

Our goal is to give you the right tools to help borrowers and lenders have a better experience and to close mortgage loans in shorter time frames, benefiting all parties involved. With Lending DocAI, you will reduce mortgage processing time and costs, streamline data capture, and support regulatory and compliance requirements.

Let’s connect

Be sure to tune in to the Mortgage Bankers Association annual convention to learn more from our Fireside Chat and session with Roostify!

Related Article

Empowering teams to unlock the value of AI

The latest and greatest AI and machine learning news from Google Cloud

Read Article
]]> <![CDATA[Unifiedpost and Google collaborate on Document AI to automate procurement data capture]]> https://tsecurity.de/de/3662837/it-security-nachrichten/unifiedpost-and-google-collaborate-on-document-ai-to-automate-procurement-data-capture/ https://tsecurity.de/de/3662837/it-security-nachrichten/unifiedpost-and-google-collaborate-on-document-ai-to-automate-procurement-data-capture/ Sun, 12 Jul 2026 08:06:59 +0200 📰 IT Security Nachrichten tsecurity.de

Belgian fintech company, Unifiedpost Group has deployed Procurement DocAI to process nearly 350 million invoices and other procure-to-pay docs per year, in 15 countries across Europe. 

Procurement DocAI, which was announced at Google Cloud Next OnAir, automates the capture of invoices, receipts and other procurement data at scale. It takes unstructured documents across a variety of formats and turns them into cleanly structured data, increasing operational efficiency and improving document processing accuracy.    

“At Unifiedpost, we believe that administrative and financial processes should be simple and smart. Google Cloud’s Procurement DocAI solution helps us achieve that goal by providing the best in class document automation processing with high accuracy and global, multi-language support.” - Hans Leybaert, CEO, Unifiedpost Group

DocAI.gif

Large enterprise procurement and distribution networks as well as small and medium enterprises (SMEs) generate millions of invoices, receipts, and other related documents a year. These processes generate significant overhead for every procured item. With competitive pressures increasing, businesses are finding new ways to automate one of their highest volume business processes -- the procurement cycle.

A key part of our strategy at Google Cloud is the creation of industry-specific solutions that address vertical needs. Cross-industry solutions like Document AI are built to plug into your existing workflows and deliver business results from AI without having to hire an army of AI experts, or manage cloud infrastructure to get there.

Procurement DocAI is one of our newest solutions, and it’s deployed by many customers and partners including Unifiedpost. The company currently serves 400k SMEs and 250+ corporations; their offering includes: documents (e.g., invoice PDF to XML conversion, e-invoicing), identity (e.g., KYC), and payments (e.g., IBAN accounts, online collection services, PSD2 payment services). 

With a large, rapidly growing, and heavily multi-language footprint, Unifiedpost sought the best industry solutions to meet their automation challenges and connect their customers such as Billtobox.com or JeFacture.com. Google Cloud’s Procurement DocAI delivered two key benefits to address Unifiedpost’s business needs:

  • Lower TCO of procure-to-pay processing. Unifiedpost will be able to lower their TCO of procure-to-pay processing costs by up to 60% with Procurement DocAI. This solution provided them a cost effective approach for data extraction for invoices, receipts, and other valuable documents in the procurement cycle of procure to invoice, and invoice to pay.

  • Improve procurement document processing accuracy. Procurement DocAI also helped boost data accuracy by 250% for Unifiedpost’s document extraction through specialized DocAI parsers with advanced OCR, computer vision, and Natural Language Processing. Additionally, Unifiedpost needed rapid multi-language expansion to enable regionalization support across Europe, particularly for French and Dutch to begin with, which Google delivered in less than a month.

The collaboration between Google Cloud and Unifiedpost is just one of the latest examples of how we’re providing AI-powered functional solutions to solve business problems by leveraging our Deployed AI approach.

Let’s connect

For more customer stories from EMEA, check out Google Cloud Next OnAir EMEA, which has tailored content to support the needs of our customers in Europe, Middle East, and Africa, kicking off from 29 September - 27 October.

]]> <![CDATA[How Mercari reduced request latency by 15% with Cloud Profiler]]> https://tsecurity.de/de/3662835/it-security-nachrichten/how-mercari-reduced-request-latency-by-15-with-cloud-profiler/ https://tsecurity.de/de/3662835/it-security-nachrichten/how-mercari-reduced-request-latency-by-15-with-cloud-profiler/ Sun, 12 Jul 2026 08:06:56 +0200 📰 IT Security Nachrichten tsecurity.de

Editor’s note: For retailers, predicting consumers’ desires and demand is the holy grail. For retail IT, the goal is understanding the performance of your ecommerce applications. Here, Japanese online retailer Mercari shows how they used Cloud Profiler and Trace to understand a complex microservices-based application running on Google Cloud, to meet rigorous SLOs as demand shifts for their products. 

The events of 2020 have accelerated ecommerce, increasing demand for and traffic on online marketplaces. Analyst eMarketer predicts that ecommerce sales in the United States will grow 18% in 2020, against an overall fall in total retail sales of 10.5% for the year. Likewise, our business—Japan-headquartered consumer-to-consumer marketplace Mercari Inc—is growing rapidly. In the United States alone, we have seen 74% year-on-year growth in monthly average users to 3.4 million. A big part of our success are our robust payment and deposit systems and AI-based fraud monitoring, which enable sellers to list items for purchase and buyers to complete transactions safely. 

Mercari started as a monolithic application but as complexity grew we decided to transition to a microservices architecture. And through it all, tools like Cloud Profiler and Cloud Trace helped us track down performance problems in our code, significantly improving latency.

A microservices menagerie

Today, we run 80+ microservices on Google Cloud with a mix of languages including Go, Python, JavaScript and Java. To deliver this new architecture, we created a gateway-like microservice to route traffic from soon-to-be migrated monolithic service to the Google Cloud microservices, which  delivers a range of features. 

After creating several microservices, we identified common requirements and created a template to accelerate their development. These common requirements included: 

  • Exporting metrics to Prometheus

  • A gRPC server and interceptors

  • Error Reporting, Cloud Trace and Cloud Profiler. Error Reporting counts, analyzes and aggregates crashes in running cloud services, while Cloud Trace provides a view of requests as they flow through microservices and Cloud Profiler shows how microservices consume CPU, memory and threads.  

We then used Python to create a template for machine learning services, also expediting the creation of new microservices. This has enabled us to grow the number of microservices we use in order to address new requirements. However, as our microservices proliferated, we needed to efficiently monitor and understand their performance. 

Maintaining SLO a challenge

In particular, we needed to monitor the impact of new versions on the production environment and the efficiency of production operations, so we could maintain our service level objective (SLO) for success rates of 99.95% and 350 milliseconds for 95% latency. 

Our engineering team also uses canary deployments to detect issues with new versions of major services. However, despite applying these measures, we found it challenging to maintain our SLO when our business grew faster than expected or during unanticipated spikes in demand. Some issues can be obvious or easy to detect. For example, if a service is experiencing high CPU utilization, we could simply place or fine tune our horizontal pod autoscaler (HPA) to resolve the problem. However, other issues may be less obvious. For example, a drop in performance may not directly be tied to a specific release—it may instead be due to unexpected requests, or may arise from changes to multiple functions in a single code release. 

Using Cloud Profiler and Cloud Trace to minimize performance issues

In particular, our business-critical UserStats service, which tracks the speed with which a user replies to a message and how fast and reliably a seller ships an item, recently started performing poorly. 

New feature requirements had prompted us to track how often a seller cancels an order and provide statistics. However, while adding this new functionality, the change refactored other functions, meaning we were unable to identify the function experiencing reduced performance. Since most of our services are enabled with Cloud Profiler and Cloud Trace, we turned to these products to investigate and identify the root cause.  

Before the change:

Using Cloud Profiler and Cloud Trace.jpg
Click to enlarge

After the change:

Using Cloud Profiler and Cloud Trace 2 (1).jpg
Click to enlarge

These two Cloud Profiler views show the CPU time of the call stack increased from 457 milliseconds to 904 milliseconds, with most of the delta attributable to the _UserStats_SellerCancelStats_Handler function. But because other functions also saw variations in their CPU consumption, and because calls occurred in parallel, we found it difficult to identify the cause of latency increases. The fact that this function call was necessary meant we could not remove the entire function. 

We checked Cloud Trace and confirmed the function call had increased overall latency on some requests, similar to below:

trace waterfall view.jpg
Click to enlarge

We analyzed the service with Cloud Profiler and identified hot spots that were contributing to the increase in CPU time consumption. We optimized these hot functions, deployed the new code, used Cloud Profiler to verify that the changes had the desired effect of reducing the CPU time. Doing so, we were able to improve latency by 10% to 15%!

Simplifying the DevOps experience

Before adopting Cloud Profiler, profiling production services was a tedious and manual undertaking involving recompiling with debug flags; deployment to production environments, and using disparate  tools to collect profiles and perform analysis. Containerization only increased this complexity, further reducing developer productivity. 

Cloud Profiler enables us to continuously profile production environments with small and simple code changes, replacing the tedious work previously required to set up environments for performance analysis. Low overhead continuous profiling with Cloud Profiler helps us react swiftly to changes in service performance by root causing and resolving issues quickly.

Further, tools such as Cloud Trace and Cloud Profiler require minimal effort to setup and provide a consistent DevOps experience for our service owners. This is particularly important as we grow in the United States and elsewhere. Without Google Cloud, monitoring, debugging and profiling across production environments that feature a mix of languages, technology stacks, frameworks and containers would be extremely challenging and time-consuming. The release of new features and experiences in tools such as Cloud Profiler make us glad we chose Google Cloud as our primary cloud platform. We will continue to work with new features and provide feedback to Google Cloud, so it can continue to provide a better service to users.  

Visit the Google Cloud website to learn more about Cloud Profiler and Cloud Trace.

Related Article

Mercari: Faster and more efficient development with the help of Google Cloud

Technical implementation can be challenging, and many businesses can benefit from hands-on support from their cloud provider. Learn how w...

Read Article
]]> <![CDATA[Enhancing our privacy commitments to customers]]> https://tsecurity.de/de/3662834/it-security-nachrichten/enhancing-our-privacy-commitments-to-customers/ https://tsecurity.de/de/3662834/it-security-nachrichten/enhancing-our-privacy-commitments-to-customers/ Sun, 12 Jul 2026 08:06:55 +0200 📰 IT Security Nachrichten tsecurity.de

Around the world, companies in every industry rely on our cloud services to run their businesses, and we take that responsibility seriously. That’s why we’re focused on providing industry-leading security and product capabilities, certifications, and commitments, along with transparency and visibility into when and how customer data is accessed. Today, we’re expanding on these commitments and sharing an update on our latest work in this area. 

Commitment to privacy 

Our Google Cloud Enterprise Privacy Commitments outline how we protect the privacy of customers whenever they use Google Workspace, Google Workspace for Education and Google Cloud . There are two distinct types of data that we consider across both of these platforms—customer data and service data:

  • Customer data: We start from the fundamental premise that, as a Google Cloud customer, you own your customer data. We implement stringent security measures to safeguard that data, and provide you with tools to control it on your terms. Customer data is the data you, including your organization and your users, provide to Google when you access Google Workspace, Google Workspace for Education and Google Cloud, and the data you create using those services.

  • Service data: We also secure any service data—the information Google Cloud collects or generates while providing and administering Google Workspace, Google Workspace for Education, and Google Cloud — which is critical to help ensure the security and availability of our services. Service data does not include customer data — it includes information about security settings, operational details, and billing information. We process service data for the purposes that are detailed in our Google Cloud Privacy Notice (newly launched to provide more specific information about how we process service data, and effective November 27, 2020), such as making recommendations to optimize your use of Google Workspace and Google Cloud, and improving performance and functionality.

When you use Google Cloud services, you can be confident that:

  • You control your data. Customer data is your data, not Google Cloud’s. We only process your data according to your agreement(s). 

  • We never use your data for ads targeting. We do not process your customer data or service data to create ads profiles or improve Google Ads products.

  • We are transparent about data collection and use. We’re committed to transparency, compliance with regulations like the GDPR, and privacy best practices.

  • We never sell customer data or service data. We never sell customer data or service data to third parties.

  • Security and privacy are primary design criteria for all of our products. Prioritizing the privacy of our customers means protecting the data you trust us with. We build the strongest security technologies into our products.

These commitments are backed by the strong contractual privacy commitments we make available to our customers for Google Workspace, Google Workspace for Education and Google Cloud. 

Enhanced customer controls and new third party certifications

We recently released new capabilities that further improve visibility and control over how data in our cloud is accessed and processed. In 2018, we were the first major cloud provider to bring Access Transparency to our customers, providing you with near real-time logs of the rare occasions Google Cloud administrators access your content. To give you even more visibility and control, we’ve made Access Approval for Google Cloud generally available to let you approve or dismiss requests for access by Google employees working to support your service. 

Our Transparency & Control Center is also now generally available as part of the Google Cloud Console. It gives you the ability to enable and disable data processing that supports features such as recommendations and insights at the organization and project level. It also allows you to export personal data that may be used to generate recommendations and insights. 

For Google Workspace, in addition to providing granular audit logs, we offer organization admins and users the ability to download a copy of their data via the data export tool and Google Takeout. These are just some of the ways we help support data portability requirements under privacy regulations such as the EU’s GDPR and the California Consumer Privacy Act (CCPA).

We continue to reinforce our commitment to privacy by meeting the requirements of internationally-recognized privacy laws, regulations, and standards. This summer we announced that we are the first major cloud provider and productivity suite to receive accredited ISO/IEC 27701 certification as a data processor. Our accredited ISO/IEC 27701 certifications for Google Workspace and Google Cloud provide customers with benefits including simplified audit processes, universal privacy controls and greater clarity around privacy-related roles and responsibilities. Certifications provide independent validation of our ongoing dedication to world-class security and privacy, and we look forward to obtaining additional certifications in the future. 

Continued innovation to support customer needs 

As the global privacy landscape and our customers’ needs change, Google Cloud will continue to work diligently to maintain our commitments to privacy, control and transparency. To learn more about our efforts, visit our Trust and Security center.

]]> <![CDATA[Attackers Have the Advantage Now]]> https://tsecurity.de/de/3660924/it-security-video/attackers-have-the-advantage-now/ https://tsecurity.de/de/3660924/it-security-video/attackers-have-the-advantage-now/ Sat, 11 Jul 2026 00:18:09 +0200 đŸŽ„ IT Security Video tsecurity.de Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:5

The pace of cyberattacks has accelerated dramatically. Techniques that once required weeks can now happen in minutes, hours, or days, making it increasingly difficult for defenders to respond using traditional security processes.

The concern isn't that attackers will always have the advantage, but that today's defensive systems may no longer match the speed of modern threats. Improving cybersecurity may require rethinking how security, automation, and compliance work together rather than relying solely on existing tools.

If the balance between attackers and defenders is constantly shifting, what changes would have the biggest impact on restoring the advantage to defenders?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#SecurityResearch #BlueTeam #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec

]]> <![CDATA[SAP Makes It Easier For Customers To Shop For Legacy Product Support, Ending EU Antitrust Probe]]> https://tsecurity.de/de/3660331/it-security-nachrichten/sap-makes-it-easier-for-customers-to-shop-for-legacy-product-support-ending-eu-antitrust-probe/ https://tsecurity.de/de/3660331/it-security-nachrichten/sap-makes-it-easier-for-customers-to-shop-for-legacy-product-support-ending-eu-antitrust-probe/ Fri, 10 Jul 2026 18:12:50 +0200 📰 IT Security Nachrichten tsecurity.de

Read more of this story at Slashdot.

]]> <![CDATA[With ChatGPT Atlas shutting down, here are the AI browsers people actually use]]> https://tsecurity.de/de/3660008/ios-mac-os/with-chatgpt-atlas-shutting-down-here-are-the-ai-browsers-people-actually-use/ https://tsecurity.de/de/3660008/ios-mac-os/with-chatgpt-atlas-shutting-down-here-are-the-ai-browsers-people-actually-use/ Fri, 10 Jul 2026 16:24:11 +0200 🍏 iOS / Mac OS tsecurity.de

OpenAI is pulling the plug on its dedicated web browser, ChatGPT Atlas. Instead of investing in an AI browser with a small user base, the company is improving agentic web use features inside the new ChatGPT desktop app.

While ChatGPT Atlas may not have gained much traction, AI browsers can be useful for automating tasks like research, browser tidiness, and more. Here are options available on the Mac.

]]> <![CDATA[Microsoft to Retire OWA Light Client In Exchange Server]]> https://tsecurity.de/de/3659664/it-security-nachrichten/microsoft-to-retire-owa-light-client-in-exchange-server/ https://tsecurity.de/de/3659664/it-security-nachrichten/microsoft-to-retire-owa-light-client-in-exchange-server/ Fri, 10 Jul 2026 14:23:38 +0200 📰 IT Security Nachrichten tsecurity.de

Read more of this story at Slashdot.

]]> <![CDATA[How a Formula 1 IT director balances innovation and stability at 200 mph]]> https://tsecurity.de/de/3659354/it-security-nachrichten/how-a-formula-1-it-director-balances-innovation-and-stability-at-200-mph/ https://tsecurity.de/de/3659354/it-security-nachrichten/how-a-formula-1-it-director-balances-innovation-and-stability-at-200-mph/ Fri, 10 Jul 2026 12:08:52 +0200 📰 IT Security Nachrichten tsecurity.de

Michael Taylor has spent 25 seasons with the Mercedes-AMG Petronas F1 team, working every IT role from trackside support to engineering systems to business transformation. Today, as IT director, he leads an 18-person team responsible for one of the most data-intensive operations in the world.

When a car rolls out of the garage, it carries 300 sensors. When it’s running, it generates more than a million data points per second. Every component, system, and lap produces telemetry that engineers use to find fractions of a second — the difference between winning and losing.

“Formula One has been data-centric for many years,” Taylor says. “The key metric in our sport is the stopwatch, and that’s been true since the World Championship began in the 1950s. But now we instrument everything. If you measure it, you can improve it.”

The challenge isn’t collecting data — Formula One has been streaming live telemetry since the 1980s. It’s making decisions at speed while maintaining the governance that keeps a complex, high-stakes operation running.

For CIOs navigating the pressure to move fast on AI while managing risk, security, and data quality, Taylor’s hard-won lessons from the pit lane offer a useful framework: how to balance speed and control, when to keep humans in the loop, and why “good enough” governance beats perfect governance that never ships.

Innovation vs. stability: ‘A constant battle’

In most enterprises, the tension between innovation and control plays out over quarters or years. In F1, it happens weekly.

“It’s really tough,” Taylor admits. “And something we don’t always get right. This is where we rely on people. Industry experience is really important when making decisions around change.”

The team operates in two distinct modes. Between races, they’re at the factory in Brackley, UK. The site, which is headquarters for the design, manufacturing, and operation of their championship-winning Formula One cars, includes a 60,000-square-meter technology campus. It’s all project and program management, with room for experimentation. But as race weekend approaches, everything shifts to execution.

“We have that kind of normal mode when we’re not racing. We’re back at the factory designing and building and improving,” Taylor explains. “But as we get closer to race weekend, we switch to executing that in the most effective way. We have to not make changes that will impact engineers.”

This duality shapes every technology decision. The same agility that drives innovation during the week must yield to stability when results are on the line. Taylor calls it a “constant battle.”

Modernizing at racing speed

Mercedes-AMG Petronas had run SAP since 1999. The platform underpins the team’s entire design-to-track process — from design release through planning, procurement, manufacturing, testing, and development, all the way to reassembling the car trackside.

“All of those steps are core processes,” Taylor says.

So, when it came time to modernize, the team approached it like a pit stop: planned to the second, executed with precision. They chose RISE with SAP — the vendor’s bundled cloud ERP and migration package — agreeing to the journey in December 2024 and targeting a go-live in August 2025, aligned with the sport’s mandatory two-week shutdown.

“It’s the perfect window to make changes,” Taylor says. “We have to plan everything to perfection so it goes smoothly when we start racing again.”

They finished eight weeks ahead of schedule.

“We are control freaks because of the sport and its time-bound nature,” Taylor says. His team prefers to own and manage systems in-house rather than rely on large systems integrators who “dip their toes in and disappear,” Taylor says. With just 18 people on the IT team, they tap SAP’s expertise for specific problems, then take back the reins. “Once done, we continue to own and manage,” Taylor explains, “and SAP does what they do best.”

The secure path must be the easiest path

Intellectual property in F1 racing has a short shelf life. Once a new component is on the car and photographed in the pit lane, competitors can see it. But that doesn’t diminish the value of what’s behind it.

“The real advantage is not just the part,” Taylor says. “It’s the thinking, the modeling, the simulation, the failure modes, the trade-offs, and the development direction behind it.”

Protecting that requires an offensive security posture. Taylor’s head of information security reports directly to him, and the team actively probes its own defenses.

“Act like, think like, work like a hacker,” Taylor says. “We’re thinking about how we can counter threats without impact on end-users.”

In an engineering-permissive culture where people are empowered to move fast, heavy-handed security backfires. Taylor learned early that perfection is the enemy of progress.

“If security gets in the way of the business, the business will find ways to work around it,” he says. “The job is not to slow the organization down; it’s to make the secure path the easiest path.”

Humans in the loop

With AI evolving weekly, Taylor’s team is running pilots across the organization: machine learning for simulation, agentic workflows in production planning, copilots helping developers write code. But he’s resisting the urge to rush.

“We’re still finding our way,” he says. “There’s no one-size-fits-all. We’re playing with everything available, but in six to ten months we’ll make decisions about what to scale.”

Despite the hype around autonomous AI, Taylor remains committed to human oversight.

“I’m still very much ‘humans should be in the loop,’” he says. “When our workforce is harmonized with AI, that’s where we’ll see real benefit — where it complements our people.”

AI has also raised the bar for data governance. “Good enough now includes stronger visibility, cleaner permissions, and clearer ownership,” Taylor says. “You have to be more deliberate about what data AI is allowed to access.”

Start with consequence

Taylor’s advice to CIOs in other industries wrestling with similar questions is deceptively simple: “Start with consequence, not technology.”

In financial services, it might be customer harm or a regulatory breach. In healthcare, patient safety or loss of public trust. In F1, the consequence of a security failure is loss of competitive advantage.

“Once you understand the consequence, you can decide what needs the strongest control, what needs monitoring, what needs retention, and what simply needs better hygiene,” Taylor says.

It’s a lesson learned over 25 seasons at the edge of what’s technically possible — where decisions happen in milliseconds, and the margin between success and failure is measured in fractions of a second.

]]> <![CDATA[The business case for burning down security debt: A practical approach for CISOs]]> https://tsecurity.de/de/3659197/it-security-nachrichten/the-business-case-for-burning-down-security-debt-a-practical-approach-for-cisos/ https://tsecurity.de/de/3659197/it-security-nachrichten/the-business-case-for-burning-down-security-debt-a-practical-approach-for-cisos/ Fri, 10 Jul 2026 11:07:23 +0200 📰 IT Security Nachrichten tsecurity.de

Security leaders have made strong progress in visibility. Most organizations can now identify vulnerabilities across their applications, dependencies and development pipelines with far more consistency than in the past. Yet a fundamental imbalance remains: Vulnerabilities are being discovered faster than they can be remediated.

That imbalance is growing. Today, 82% of organizations carry security debt, defined as accumulated vulnerabilities that have remained unresolved for more than a year. At the same time, the share of vulnerabilities defined as both “severe” and “likely to be exploited” continues to increase.

This combination has real consequences. Vulnerabilities are not just accumulating; they persist in production environments long enough to be discovered and used.

Among my fellow CISOs, the conversation has shifted. The challenge now is to translate this reality into a business case that resonates with executive leadership and drives investment in remediation capacity. Here are six ways to do this.

Treat security debt like financial debt

Security debt behaves much like financial debt. It accumulates over time, compounds when left unmanaged and creates ongoing costs for the business. Those costs show up in delayed releases, emergency remediation efforts, audit findings and incident response.

Managing it effectively requires the same discipline applied to financial risk. That means measuring total and critical debt, setting reduction targets and tracking progress over time. It also means distinguishing between acceptable and unacceptable levels of risk, rather than treating all vulnerabilities as equal.

I believe security debt should be visible at the executive level. Leadership teams routinely track financial performance, operational resilience and service reliability. Security debt belongs in the same category. It reflects the organization’s exposure and its ability to manage that exposure over time.

Frame remediation capacity as a business constraint

Most organizations have a strong awareness of vulnerabilities. The limiting factor is the ability to address them.

Remediation capacity determines whether security debt grows or shrinks. When the volume of new findings exceeds the organization’s ability to fix them, the backlog expands and exposure increases. This dynamic persists regardless of how effective detection tools are.

In my experience, it’s important to quantify this constraint. That includes showing the gap between findings and fixes, identifying where high-risk vulnerabilities remain open and demonstrating how long they persist. These data points make it clear that incremental efficiency improvements will not close the gap on their own.

Presenting remediation capacity in operational terms helps align the discussion with executive priorities. Leaders understand constraints in engineering throughput, cloud spend and service availability. Remediation capacity should be treated in the same way.

Focus on exploitable risk in critical systems

Security debt becomes meaningful when it is tied to business impact.

Not all vulnerabilities carry the same level of risk. The ones that matter most share two characteristics. They are likely to be exploited, and they exist in applications that are important to the business.

Traditional severity scoring does not fully capture this. The Common Vulnerability Scoring System (CVSS) remains useful. Still, it does not reflect whether a vulnerability is reachable, whether it sits in a critical system or whether exploit techniques are readily available.

A practical approach is to layer exploitability and business context onto existing scoring models. This creates a focused set of high-risk vulnerabilities that require immediate attention. In many environments, this represents a relatively small percentage of total findings, but it accounts for a large portion of potential impact.

By concentrating on this subset, organizations can direct resources where they have the greatest effect. This approach also makes it easier to communicate risks in business terms.

Prioritize crown-jewel applications

Risk is not distributed evenly across applications.

Every organization has systems that are more critical than others. These may include customer-facing platforms, revenue-generating services or applications that process sensitive data. Compromise in these areas has a disproportionate impact on the business.

Focusing remediation efforts on these crown-jewel applications improves outcomes quickly. Our research found that 11.3% of flaws have high severity and high exploitability. It ensures that the most important systems receive the highest level of protection and reduces the likelihood of high-impact incidents.

Clear targets help reinforce this focus. Over a defined period, organizations can reduce critical security debt, shorten the lifespan of high-risk vulnerabilities and maintain strict thresholds for exposure in key systems. These targets translate security activity into business outcomes that leadership can understand and support.

Establish metrics that reflect risk

Metrics play a central role in shaping behavior.

Many organizations continue to rely on the number of vulnerabilities discovered or resolved. While these metrics provide useful context, they do not indicate whether risk is increasing or decreasing.

More effective measures focus on exposure. These include the number of critical or exploitable vulnerabilities in key systems, the average age of those vulnerabilities and trends over time. Together, these metrics provide a clearer picture of how risk is evolving.

Linking these measures to organizational objectives strengthens accountability. Security debt reduction can be incorporated into OKRs, with specific targets for reducing critical debt, lowering vulnerability age and maintaining acceptable thresholds in high-risk applications.

Formalizing risk acceptance is also important. High-risk vulnerabilities that remain open should require business approval and defined timelines. This ensures that risk is acknowledged and managed deliberately.

Increase investment in remediation capacity

Improving security outcomes requires sustained investment in the ability to act.

Remediation capacity can be expanded in several ways. Organizations can allocate dedicated engineering time for security work, integrate remediation into development workflows and adopt automation to reduce manual effort. AI-assisted fixes and automated guidance can help teams address vulnerabilities more efficiently without disrupting development velocity.

Preventing new security debt is equally important. Policies such as requiring high-risk vulnerabilities to be resolved before release help limit the introduction of additional exposure. Over time, this reduces the overall burden on remediation teams.

These changes do not slow innovation. They create conditions for delivering software safely and consistently.

Align the business around risk reduction

Security debt affects more than the security function. It influences resilience, regulatory posture and the organization’s ability to deliver software with confidence.

CISOs play a central role in aligning stakeholders around this issue. By framing security debt in terms of business impact, capacity constraints and measurable outcomes, they can shift the conversation from technical backlog management to enterprise risk reduction.

This alignment is critical for securing investment. When leadership understands the relationship between remediation capacity and business risk, decisions about funding, prioritization and trade-offs become clearer.

Security debt will continue to exist. What matters is how effectively it is managed and measured. For example, a good target should be doubling fix capacity through tooling investment, not just headcount.

Organizations that measure, govern and actively invest in reducing it are better positioned to control risk at scale. Those that do not will continue to see exposure grow, even as their visibility improves.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Reeves to launch City ‘skills compact’ committing firms to retrain staff in AI]]> https://tsecurity.de/de/3658725/ai-nachrichten/reeves-to-launch-city-skills-compact-committing-firms-to-retrain-staff-in-ai/ https://tsecurity.de/de/3658725/ai-nachrichten/reeves-to-launch-city-skills-compact-committing-firms-to-retrain-staff-in-ai/ Fri, 10 Jul 2026 07:03:32 +0200 🔧 AI Nachrichten tsecurity.de Exclusive: Plan to improve skills of thousands of financial sector workers to keep pace with tech revolution

Chancellor Rachel Reeves is to announce a new City “skills compact” that will commit firms such as Barclays and Lloyds to retraining thousands of financial sector workers for the AI revolution.

The financial services skills compact will be launched on Tuesday, during what is likely to be Reeves’s final Mansion House speech to City bosses before Andy Burnham’s expected takeover of No 10. The government-backed initiative will commit employers to improving workers’ skills and helping them “keep pace” with significant technological changes that have prompted fears of mass redundancies.

Continue reading...]]> <![CDATA[What happened with reproducible builds (osc26)]]> https://tsecurity.de/de/3657905/it-security-video/what-happened-with-reproducible-builds-osc26/ https://tsecurity.de/de/3657905/it-security-video/what-happened-with-reproducible-builds-osc26/ Thu, 09 Jul 2026 19:48:32 +0200 đŸŽ„ IT Security Video tsecurity.de <![CDATA[Firefox Tooling Announcements: Engineering Effectiveness Newsletter (Q2 2026 Edition)]]> https://tsecurity.de/de/3657816/tools/firefox-tooling-announcements-engineering-effectiveness-newsletter-q2-2026-edition/ https://tsecurity.de/de/3657816/tools/firefox-tooling-announcements-engineering-effectiveness-newsletter-q2-2026-edition/ Thu, 09 Jul 2026 19:08:33 +0200 đŸ’Ÿ Tools tsecurity.de Welcome to the Q2 edition of the Engineering Effectiveness Newsletter! The Engineering Effectiveness org makes it easy to develop, test and release Mozilla software at scale. See below for some highlights, then read on for more detailed info!

Highlights
image

Detailed Project Updates

AI for Development
image

  • Suhaib Mujahid deployed the initial version of Hackbot, a platform for building and running AI agents to automate parts of the Firefox development workflow.

  • Evgeny Pavlov ported the “Build Repair Agent” to Hackbot and deployed it for testing. It now monitors Firefox build failures and triggers the agent. When an analysis and a proposed patch are ready developers can be notified by email.

Bugzilla image

  • David Lawrence added a new GitHubPullRequests extension that renders a live status panel in the bug modal for any attachment whose content type is text/x-github-pull-request. A new REST endpoint fetches PR metadata (state, author, labels, latest review per reviewer) from the GitHub REST API on demand, and a client-side script populates a table with a “show closed/merged” toggle.[image]

  • Xavier L’Hour improved the user experience for developers, adding shortcuts to buglist.cgi for all, open, or closed bugs (1764713)

  • Xavier L’Hour added a new shortcut button to the bug page that allows users to quickly move spam bugs to the Invalid Bugs product (1684509).

Build System and Mach Environment
image

  • Alex Hochheiden has been moving build system logic out of make to pave the way for a new build system backend (coming soon). See Bug 2038789.

  • Alex Hochheiden landed a 30%-50% (platform dependent) speedup for mach startup. See Bug 1775197.

  • Alex Hochheiden sped up subsequent configure runs by ~10s by adding caching to the mach taskgraph toolchain step. See Bug 2017746.

  • Alex Hochheiden reduced mach test startup overhead on Windows by 75%. See Bug 2018327.

  • Alex Hochheiden has achieved significant code deduplication and simplification by consolidating the Android Gradle configuration into convention plugins. There were also various Gradle configure-cache improvements. See Bug 2007013, Bug 1950099, Bug 2013417, Bug 2017752, and Bug 2017753.

Firefox-CI
image

  • Julien Cristau added support for interactive tasks (aka one click loaners) on Windows and macOS

  • Andrew Halberstadt implemented mach try support with Github, being used in mozilla/enterprise-firefox-try and coming to Firefox soon.

  • Andrew Halberstadt implemented the machinery to start making Gecko CI tasks clone from Github.

  • Ryan Curran brought Firefox CI’s Apple Silicon VM infrastructure into production. Building on the MacOS CI image pipeline established last year, he migrated test suites onto virtual machines and grew the macosx1500-aarch64-vms pool so Taskcluster now routes eligible jobs to VMs alongside physical hardware. This reduces reliance on physical Macs, increases CI capacity, and supports the ongoing migration off of older Intel-based macOS infrastructure

  • Jonathan Moss migrated Firefox CI’s cloud-based Windows testing from Windows 11 24H2 to 25H2, moving the bulk of Firefox’s Windows test coverage to Microsoft’s latest platform and keeping CI aligned with the Windows version most commonly used by Firefox Desktop users

  • Florian QuĂšze created many dashboards to help dig into Mochitests and XPCShell tests

  • Ryan VanderMeulen landed a set of improvements to mach try chooser. The update adds an exclude filter, a clearer preview pane with removable job rows, an artifact-builds toggle, and a warning when a selection exceeds task-prioritization thresholds. It also fixes a bug where choosing Firefox for Android jobs would unintentionally clear selections for other platforms.

Lint, Static Analysis and Code Coverage
image

  • Valentin Rigal and Bastien Abadie created a Code Review Bot prototype for publication of review comments using various source linters on Github

  • Morgan Rae Reschenberg added support for accessibility review to Code Review Bot

Mozregression
image

  • Zeid fixed a bug in mozregression-gui on macOS, where the camera and microphone capture request was getting rejected (released in 7.3.0). Thanks to bug report + tip from Andreas Pehrson.

PDF.js
image

Phabricator image, moz-phab, and Lando
image

  • Connor Sheehan improved the uplift experience by leveraging Lando to manage the assessment forms, train selection, and automatic application, so conflicts are detected earlier. The number of uplifts via Lando has out-paced those via Moz-Phab, and sailed through the rise in uplift numbers (likely due to more sec-bugs getting fixed and uplifted).

  • Zeid added support for private GitHub repositories in Lando, allowing security patches to be implemented in a private clone of a repo, and pushed to the public one.

  • Olivier Mehani finalized support for using the new Lando instance for try-pushes. This brings a host of QoL improvements which weren’t backported to the old instance: better UTF-8 support, smarter conflict resolution and improved security and authentication. It is now processing about 1500 pushes / week (old Lando still processes about 50 / week).

  • Magnolia Liu implemented automatic pushes to Try for uplift requests, for faster feedback in case of issues.

  • Olivier Mehani added a view of a user’s current and recent jobs on the landing page of Lando when authenticated.

  • Zeid identified and fixed the causes of some stability and reliability issues in Lando, which were causing increased downtime during deployments and on an ongoing basis.

  • Olivier Mehani deployed a PoC of reviewer selection on the GitHub pilot, allowing Herald-like mechanisms to GitHub PRs.

  • Olivier Mehani and Connor Sheehan (with Corey Bryant and Daniel Darnell) migrated the COMM project to GitHub https://github.com/thunderbird/thunderbird-desktop, sharing Firefox’s syncing model.

Release Management and Engineering
image

  • Donal Meehan drove the Release Management team’s move to a weekly scheduled dot release cadence for Desktop and Android, starting with Firefox 151. This allows us to deliver fixes and approved uplifts to users faster and more predictably. This change is expected to reduce unplanned releases, improve release flexibility, and create a more consistent release rhythm across teams.

  • Dianna Smith drove the update to the Release Management team’s Desktop major release rollout process, starting with Firefox 152. Instead of throttling to 0% on day 2, it will remain at 25% rollout for two days before moving to 100%, unless any issues arise. This should help us collect uptake and stability signals earlier while still allowing time to catch problems before full rollout.

  • Pascal Chevrel completed the update to the dictionaries shipped with Firefox Desktop. The update added eleven new dictionaries, covering Croatian, English (UK), Georgian, Persian, Slovenian, Tajik, Tamil, Tibetan, Turkish, Welsh, and Xhosa, and refreshed nine others. This expanded the number of locales with a built-in spellchecker from 30 to 41 beginning in Firefox 152. Special thanks to Francesco Lodolo, Bryan Olsson, and the localization community for reviewing the patches and helping assess the quality of the dictionaries.

  • Pascal Chevrel delivered a range of improvements to WhatTrainIsItNow, including expanded it to cover weekly dot releases and ESR planned dot releases, added new uplift views including a dot-release uplifts page and a beta uplift graph, and published new APIs that surface train-selection and uplift guidance inside Lando. He also made performance improvements and a steady stream of fixes across the site.

  • At Pwn2Own 2026, Firefox came through with no successful exploits, thanks to preparation across many teams and individuals. Within Release Management, Ryan VanderMeulen drove pre-event patch readiness and Dianna Smith coordinated the releases during the event, including the 150.0.3 dot release, which mitigated the root cause behind several of the contest entries.

  • Dianna Smith built out release-health monitoring and alerting in Bigeye, giving Release Management a growing set of automated alerts that surface data anomalies earlier to aid in release health and regression detection. To make the capability easy to extend, she also created a guide for other teams to add monitoring and alerts for the areas they know best. Teams that want an earlier signal on their own metrics are encouraged to use the guide and help grow the coverage.

Release Operations :wrench:

  • Ryan Curran built Hangar, a live dashboard for monitoring Firefox CI’s worker pools. It consolidates fleet data from several systems into one view, giving Release Operations a single place to check fleet health and catch problems such as missing or quarantined workers early.

  • Ryan Curran created the iOS version of BuildWatch, and Andrew Erickson ported it to Android. BuildWatch lets you monitor Firefox CI try pushes from your phone, including live per-platform build status, failure summaries, and one-tap retriggers. It uses only public APIs, so no VPN is required.

  • Andrew Erickson and Mark Cornmesser developed Fleetbench, a tool for benchmarking Firefox CI workers. It currently measures CPU and ADB/USB I/O performance, helping Release Operations identify slow or outlier hosts before they skew performance test results such as Speedometer and trigger noisy or false regressions.

  • Andrew Erickson built Pool Classifier, a web app for viewing per-worker success rates across Taskcluster worker pools. It classifies newly completed tasks every 15 minutes, giving Release Operations a continuously updated view of worker health and helping surface problematic workers proactively.

  • Andrew Erickson created Fleetroll, a command-line tool Release Operations uses to manage and monitor long-running Linux, macOS, and Windows hardware hosts in Firefox CI Taskcluster. It deploys Puppet branch overrides and Vault secrets, audits what is actually applied, and surfaces each host’s Puppet and Taskcluster state in a live dashboard.

  • Mark Cornmesser built out a set of new worker-metrics dashboards in Yardstick, giving Release Operations clearer real-time visibility into the health of the Firefox CI hardware fleet. These include Linux worker status, Windows worker CPU and disk metrics, and a Windows job pickup and wait timeline, with alerting on key thresholds. The full set lives in the FXCI Hardware Workers folder in Yardstick.

  • Jonathan Moss expanded cloud cost reporting in Looker, adding Azure support alongside the existing GCP data and a cloud-provider filter on the FXCI task overview dashboard. The team can now break down Firefox CI compute costs by cloud provider, making it easier to track and compare spend across Azure and GCP.

Taskcluster image

  • Yaraslau Kurmyza added Azure fast deprovision taskcluster#8790 and concurrency taskcluster#8815 to improve worker scanner performance. This shows ~2x-4x scan time improvements already.

  • Contributor nitishagar and Yaraslau Kurmyza added patches taskcluster#8514, taskcluster#8784 to support compression in Taskcluster services API and Yarik worked with Fastly to resolve broken brotli support on the WAF edge side. Now services transmit significantly less data.

  • Yarik added a dedicated service account to log with read only permissions webservices-infra#11197. This allows tc-logview to be used safely by untrusted agents inside containers with narrow short-lived access tokens.

  • Yarik published queue forecasting dashboard experiments that continuously collects task events and trains models to enable and improve predictions on a task level (how long will it run, and when will it start). With future plans including extending it to the whole task group (mach try)

Treeherder image

  • Florian QuĂšze added treeherder#9540 “Show task group profile” item to the push action menu

  • Cameron Dawson, juungo and moijes12 implemented various Treeherder API performance improvements

  • Heitor Neiva added Git branch labels to pushes in Treeherder

  • Andrew Halberstadt implemented the ability for Treeherder to display multiple Git branches at once, enabling support for “try like” repositories in Github

Version Control
image

Other
image

  • Sylvestre converted our documentation from reStructuredText to MyST flavored Markdown

Thanks for reading and see you next quarter!

1 post - 1 participant

Read full topic

]]> <![CDATA[OpenPLC v3]]> https://tsecurity.de/de/3657579/it-security-nachrichten/openplc-v3/ https://tsecurity.de/de/3657579/it-security-nachrichten/openplc-v3/ Thu, 09 Jul 2026 17:50:53 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to the filesystem and escalate this into arbitrary native code execution through the normal OpenPLC program compilation process, potentially resulting in code execution as the OpenPLC runtime user.

The following versions of OpenPLC v3 are affected:

  • OpenPLC v3
CVSS Vendor Equipment Vulnerabilities
v3 9.9 OpenPLC OpenPLC v3 External Control of File Name or Path

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Energy, Transportation Systems, Water and Wastewater
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-14480

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename (prog_file) directly into the Programs.File database field and later uses this value as the destination path for an uploaded file without validating or restricting the path. Because Python os.path.join() honors attacker‑controlled absolute paths, an authenticated user can write arbitrary files anywhere writable by the OpenPLC webserver process. In the default build pipeline, all C++ source files within the OpenPLC runtime core directory are automatically compiled into the executable runtime binary. By writing a malicious .cpp file into this directory, an authenticated attacker can escalate the arbitrary file write into arbitrary native code execution when the operator triggers a normal program compilation and runtime start.

View CVE Details

Affected Products

OpenPLC v3
Vendor:
OpenPLC
Product Version:
OpenPLC OpenPLC: v3
Product Status:
known_affected
Remediations

Vendor fix
OpenPLC recommends users upgrade to OpenPLC v4 as OpenPLC v3 is end-of-life and is no longer receiving patches, bug fixes, or security updates.

Relevant CWE: CWE-73 External Control of File Name or Path

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.9 CRITICAL CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Grady DeRosa reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-09
Date Revision Summary
2026-07-09 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Schneider Electric Easergy MiCOM Px40 Series]]> https://tsecurity.de/de/3657578/it-security-nachrichten/schneider-electric-easergy-micom-px40-series/ https://tsecurity.de/de/3657578/it-security-nachrichten/schneider-electric-easergy-micom-px40-series/ Thu, 09 Jul 2026 17:50:52 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Schneider Electric is aware of a vulnerability in its Easergy MiCOM Px40 Series products. The [Easergy MiCOM Px40](https://www.se.com/ww/en/product-subcategory/4725-easergy-micom-px40-series/?filter=business-6-medium-voltage-distribution-and-grid-automation) is a protection relay series for Medium Voltage, High Voltage and Extra High Voltage protection. Failure to apply the mitigations provided below may risk unauthorized exposure of basic device identification through the SNMP protocol.

The following versions of Schneider Electric Easergy MiCOM Px40 Series are affected:

  • Easergy MiCOM P14x All versions prior to B4A
  • Easergy MiCOM P24x All versions prior to D3A
  • Easergy MiCOM P341 All versions prior to E3F
  • Easergy MiCOM P342, P343, P344, P345 All versions prior to B3F
  • Easergy MiCOM P442, P444 All versions prior to E3A
  • Easergy MiCOM P443, P445, P446, P543, P544, P545, P546 All versions prior to H6A
  • Easergy MiCOM P841 All versions prior to G6A
  • Easergy MiCOM P643 All versions prior to B3F
  • Easergy MiCOM P642, P645 All versions prior to B4A
  • Easergy MiCOM P741, P742, P743 All versions prior to B2A
  • Easergy MiCOM P746 All versions prior to B4E
  • Easergy MiCOM P746 All versions prior to C4E
  • Easergy MiCOM P849 All versions prior to B4A
CVSS Vendor Equipment Vulnerabilities
v3 5.3 Schneider Electric Schneider Electric Easergy MiCOM Px40 Series Use of Hard-coded Credentials

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Energy, Transportation Systems
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: France

Vulnerabilities

Expand All +

CVE-2026-4832

CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unauthenticated attacker is able to interrogate the SNMP port.

View CVE Details

Affected Products

Schneider Electric Easergy MiCOM Px40 Series
Vendor:
Schneider Electric
Product Version:
Easergy MiCOM P14x All versions prior to B4A, Easergy MiCOM P24x All versions prior to D3A, Easergy MiCOM P341 All versions prior to E3F, Easergy MiCOM P342, P343, P344, P345 All versions prior to B3F, Easergy MiCOM P442 P444 All versions prior to E3A, Easergy MiCOM P443, P445, P446, P543, P544, P545, P546 All versions prior to H6A, Easergy MiCOM P841 All versions prior to G6A, Easergy MiCOM P643 All versions prior to B3F, Easergy MiCOM P642, P645 All versions prior to B4A, Easergy MiCOM P741, P742, P743 All versions prior to B2A, Easergy MiCOM P746 All versions prior to B4E, Easergy MiCOM P746 All versions prior to C4E, Easergy MiCOM P849 All versions prior to B4A
Product Status:
known_affected
Remediations

Mitigation
For customers who do not require SNMP Contact Schneider Electric's [Customer Care Center](https://www.se.com/ww/en/work/support/contacts.jsp) to upgrade the Firmware to a version without SNMP functionality. If customers choose not to apply the upgrade provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Use relays only in a protected network environment, * Use firewalls to protect and separate the control system network from other networks, * Use VPN (Virtual Private Networks) tunnels if remote access is required. For customers who require SNMP Please immediately apply the following mitigations to reduce the risk of exploit: * Use relays only in a protected network environment, * Use firewalls to protect and separate the control system network from other networks, * Use VPN (Virtual Private Networks) tunnels if remote access is required.

Relevant CWE: CWE-798 Use of Hard-coded Credentials

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Acknowledgments

  • Schneider Electric CPCERT reported this vulnerability to CISA.

General Security Recommendations

We strongly recommend the following industry cybersecurity best practices. * Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. * Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks. * Place all controllers in locked cabinets and never leave them in the “Program” mode. * Never connect programming software to any network other than the network intended for that device. * Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks. * Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation. * Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.

For More Information

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process. For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

LEGAL DISCLAIMER

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

About Schneider Electric

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and sustainability for all. We call this Life Is On. Our mission is to be the trusted partner in Sustainability and Efficiency. We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation, software and services, delivering digital twins to enable profitable growth for our customers. We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our meaningful purpose of a sustainable future for all. www.se.com

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Schneider Electric CPCERT SEVD-2026-104-03 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Schneider Electric CPCERT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-04-14
Date Revision Summary
2026-04-14 1 Original Release
2026-05-12 2 Updated the risk associated with successful exploitation of this vulnerability and revised the remediation table to a mitigation table to emphasize that multiple mitigation options are available.
2026-07-09 3 Initial CISA Republication of Schneider Electric CPCERT SEVD-2026-104-03 advisory

Legal Notice and Terms of Use

]]> <![CDATA[Schneider Electric PowerChute Serial Shutdown]]> https://tsecurity.de/de/3657577/it-security-nachrichten/schneider-electric-powerchute-serial-shutdown/ https://tsecurity.de/de/3657577/it-security-nachrichten/schneider-electric-powerchute-serial-shutdown/ Thu, 09 Jul 2026 17:50:50 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could allow attackers to overwrite critical files, forge or inject malicious log data, gain unauthorized account access, trigger denial‑of‑service conditions, truncate or alter logging information, reset user credentials, or expose sensitive information.

The following versions of Schneider Electric PowerChute Serial Shutdown are affected:

  • PowerChute Serial Shutdown <=1.4 
CVSS Vendor Equipment Vulnerabilities
v3 6.1 SuSE, Schneider Electric, Red Hat, Microsoft Schneider Electric PowerChute Serial Shutdown Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Encoding or Escaping of Output, Improper Restriction of Excessive Authentication Attempts, Uncontrolled Resource Consumption, Improper Validation of Specified Quantity in Input, Improper Neutralization of CRLF Sequences ('CRLF Injection'), Insertion of Sensitive Information into Log File

Background

  • Critical Infrastructure Sectors: Communications, Critical Manufacturing, Energy, Healthcare and Public Health, Information Technology, Transportation Systems
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: France

Vulnerabilities

Expand All +

CVE-2026-2399

PowerChute is vulnerable to improper restriction of file paths, which could allow critical system files to be overwritten with unintended data.

View CVE Details

Affected Products

Schneider Electric PowerChute Serial Shutdown
Vendor:
SuSE, Schneider Electric, Red Hat, Microsoft
Product Version:
SuSE, Schneider Electric, Red Hat, Microsoft PowerChute Serial Shutdown: <=1.4
Product Status:
known_affected
Remediations

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/

Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN

Vendor fix
The following product versions have been fixed: PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2399.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2399.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2399.

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json

Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.1 MEDIUM CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
4.0 6.9 MEDIUM CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-2404

PowerChute is vulnerable to improper output encoding, which may allow crafted input to be reflected in log files in unexpected ways.

View CVE Details

Affected Products

Schneider Electric PowerChute Serial Shutdown
Vendor:
SuSE, Schneider Electric, Red Hat, Microsoft
Product Version:
SuSE, Schneider Electric, Red Hat, Microsoft PowerChute Serial Shutdown: <=1.4
Product Status:
known_affected
Remediations

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/

Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2404.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2404.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2404.

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json

Relevant CWE: CWE-116 Improper Encoding or Escaping of Output

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVE-2026-2402

PowerChute is vulnerable to insufficient limitations on repeated authentication attempts across multiple endpoints.

View CVE Details

Affected Products

Schneider Electric PowerChute Serial Shutdown
Vendor:
SuSE, Schneider Electric, Red Hat, Microsoft
Product Version:
SuSE, Schneider Electric, Red Hat, Microsoft PowerChute Serial Shutdown: <=1.4
Product Status:
known_affected
Remediations

Vendor fix
(CVE-2026-2402) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/

Vendor fix
(CVE-2026-2402) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/

Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2402.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2402.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2402.

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json

Relevant CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVE-2026-2405

PowerChute is vulnerable to uncontrolled resource consumption when certain system operations are triggered excessively.

View CVE Details

Affected Products

Schneider Electric PowerChute Serial Shutdown
Vendor:
SuSE, Schneider Electric, Red Hat, Microsoft
Product Version:
SuSE, Schneider Electric, Red Hat, Microsoft PowerChute Serial Shutdown: <=1.4
Product Status:
known_affected
Remediations

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/

Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2405.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2405.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2405.

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json

Relevant CWE: CWE-400 Uncontrolled Resource Consumption

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 5.3 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVE-2026-2403

PowerChute is vulnerable to improper validation of quantity‑related inputs, which can cause event and data logs to be truncated. As a result, important audit information may be lost, reducing visibility into system behavior.

View CVE Details

Affected Products

Schneider Electric PowerChute Serial Shutdown
Vendor:
SuSE, Schneider Electric, Red Hat, Microsoft
Product Version:
SuSE, Schneider Electric, Red Hat, Microsoft PowerChute Serial Shutdown: <=1.4
Product Status:
known_affected
Remediations

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/

Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2403.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2403.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2403.

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json

Relevant CWE: CWE-1284 Improper Validation of Specified Quantity in Input

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.0 5.3 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVE-2026-2400

PowerChute is vulnerable to improper handling of newline sequences in certain inputs, enabling unexpected modification of configuration‑related data.

View CVE Details

Affected Products

Schneider Electric PowerChute Serial Shutdown
Vendor:
SuSE, Schneider Electric, Red Hat, Microsoft
Product Version:
SuSE, Schneider Electric, Red Hat, Microsoft PowerChute Serial Shutdown: <=1.4
Product Status:
known_affected
Remediations

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/

Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2400.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2400.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2400.

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json

Relevant CWE: CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 5.3 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVE-2026-2401

PowerChute is vulnerable to improper logging of sensitive information when certain user‑triggered operations occur.

View CVE Details

Affected Products

Schneider Electric PowerChute Serial Shutdown
Vendor:
SuSE, Schneider Electric, Red Hat, Microsoft
Product Version:
SuSE, Schneider Electric, Red Hat, Microsoft PowerChute Serial Shutdown: <=1.4
Product Status:
known_affected
Remediations

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/

Vendor fix
SuSE, Schneider Electric, Red Hat, and Microsoft have identified the following specific workarounds and mitigations users can apply to reduce risk: (CVE-2026-2399, CVE-2026-2404, CVE-2026-2405, CVE-2026-2403, CVE-2026-2400, CVE-2026-2401) PowerChute Serial Shutdown Versions 1.4 and prior: Version 1.5 of PowerChute Serial Shutdown includes a fix for this vulnerability and is available for download here: Windows (https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/). Linux (https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/).
https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/

Mitigation
Specific instructions and hardening guidelines for these mitigations can be found in the Security Handbook.
https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Microsoft Windows are fixed versions for CVE-2026-2401.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on Red Hat Enterprise Linux are fixed versions for CVE-2026-2401.

Vendor fix
PowerChute Serial Shutdown Version 1.5 installed on SuSE Linux are fixed versions for CVE-2026-2401.

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf

Vendor fix
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-104-01 Multiple Vulnerabilities on PowerChute Serial Shutdown - SEVD-2026-104-01 PDF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). Multiple Vulnerabilities on PowerChute Serial Shutdown- SEVD-2026-104-01 CSAF Version (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json).
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json

Relevant CWE: CWE-532 Insertion of Sensitive Information into Log File

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 2.8 LOW CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
4.0 2.4 LOW CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Acknowledgments

  • Schneider Electric reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-04-14
Date Revision Summary
2026-04-14 1 Initial Publication
2026-07-09 2 Initial Republication of Schneider Electric CPCERT SEVD-2026-104-01

Legal Notice and Terms of Use

]]> <![CDATA[iOS 27 Adds New Languages and Accents to Apple Translate]]> https://tsecurity.de/de/3657399/ios-mac-os/ios-27-adds-new-languages-and-accents-to-apple-translate/ https://tsecurity.de/de/3657399/ios-mac-os/ios-27-adds-new-languages-and-accents-to-apple-translate/ Thu, 09 Jul 2026 16:38:31 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Lateral movement risk rises as enterprises emphasize convenience over containment]]> https://tsecurity.de/de/3656203/it-security-nachrichten/lateral-movement-risk-rises-as-enterprises-emphasize-convenience-over-containment/ https://tsecurity.de/de/3656203/it-security-nachrichten/lateral-movement-risk-rises-as-enterprises-emphasize-convenience-over-containment/ Thu, 09 Jul 2026 09:08:23 +0200 📰 IT Security Nachrichten tsecurity.de

Poorly segmented networks and weak security controls continue to undercut security organizations’ ability to identify and contain attacks, giving attackers free rein after initial compromise, according to a recent study based on real-world enterprise security telemetry.

Zero Networks’ 2026 Lateral Movement Exposure Report — based on analysis of 54 trillion activities across 312 live enterprise environments — found that more than 80% of enterprise servers are reachable from anywhere inside the network.

The study found that 87% of enterprise servers accept inbound Remote Desktop Protocol (RDP) or SSH (Secure Shell) connections from broad internal sources, giving attackers wide access pathways once inside the network.

Furthermore, 78% of enterprise servers are reachable via SMB (Server Message Block) or WinRM (Windows Remote Management) — networking protocols attackers commonly exploit to achieve lateral movement as part of ransomware or other attacks.

In addition, 43% of internal authentication traffic still relies on NTLM (New Technology Lan Manager), a legacy protocol frequently abused for credential relay and privilege escalation attacks. And 12% of organizations maintain direct user-to-server administrative pathways, meaning a single compromised employee device can provide immediate access to high-value systems.

“These findings perfectly align with the reality our threat hunters at Huntress see on the front lines every day,” Dray Agha, senior manager of security operations at managed detection and response firm Huntress, tells CSO. “Most network perimeters are hard on the outside but lose that hostility and become flat on the inside network.”

The accessibility of most enterprise servers from inside compromised network means attackers have little need for sophisticated zero-day exploits once they breach the perimeter.

“They [attackers] are simply ‘living off the land’ using the exact same administrative tools and open pathways (like RDP and SMB) that IT teams use,” Agha adds.

Robby Winchester, chief global professional services officer at cybersecurity firm SpecterOps, also says Zero Networks’ findings are “right on point with what we typically observe.”

“On nearly every red team and penetration test we’ve conducted, our testers have achieved lateral movement,” Winchester explains. “Using tools like BloodHound show us that attack paths are pervasive and hard to eliminate without visibility, underscoring how hard it is to prevent lateral movement.”

Interconnected by design

At issue is the fact that security teams have spent years strengthening the perimeter while accepting a significant degree of implicit trust within the network.

But moving away from this approach is far from trivial, says David Sancho, senior threat researcher at Trend Micro.

“The uncomfortable reality is that many enterprise environments remain highly interconnected by design,” Sancho says. “RDP, SMB, SSH, and WinRM exist because administrators need to get work done.”

Legacy protocols such as NTLM persist because replacing them can be operationally challenging but replacing these aging technologies is nonetheless advisable because their presence makes it easier for attackers to dive deeper into compromised networks.

Still, Sancho notes that broad exposure does not automatically equate to widespread exploitation in all circumstances.

“Reachability indicates potential blast radius, not a certainty of compromise,” he explains. “At the same time, the findings highlight an ongoing operational challenge: balancing security with usability.”

Moreover, Sancho adds, “restricting administrative pathways, retiring legacy protocols, and implementing stronger segmentation are all sensible measures, but they are often difficult to execute in complex environments built over decades.”

Dhruv Datta, founder and co-CTO at GolfWiz AI, also sees reachable servers as only one aspect of the wider problem of enterprise security resilience.

“A reachable server may still be protected by identity controls, endpoint monitoring, access policies, or other safeguards,” Datta tells CSO. “The practical risk also depends on the privileges an attacker has gained, the controls around each protocol, and how quickly suspicious activity is detected.”

Still, defenders must do more to limit where an attacker can move to stand any chance of protecting sensitive systems, argues Joe Brinkley, director of offensive security research at penetration testing as a services firm Cobalt. This requirement is becoming even more pressing with the rising use of automated and AI-driven lateral movement.

“Organizations must pivot away from a strategy of pure detection and prioritize deterministic containment through micro-segmentation and strict, identity-driven least privilege,” Brinkley advises.

Countermeasures

Internal reachability of sensitive systems creates major ransomware and privilege escalation risks. Simply focusing on improving perimeter defences is wholly inadequate.

Mitigating the path to attack and making life harder for attackers involves a combination of improved network segmentation, identity controls, red-team testing, and tighter separation of privileged access.

]]> <![CDATA[I Built a Self-Improving AI, and So Can You]]> https://tsecurity.de/de/3655387/it-nachrichten/i-built-a-self-improving-ai-and-so-can-you/ https://tsecurity.de/de/3655387/it-nachrichten/i-built-a-self-improving-ai-and-so-can-you/ Wed, 08 Jul 2026 22:17:17 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Sonos is finally improving its app — but its not moving fast enough, so people are building new alternatives to solve big gripes about home theater setups and more customizable sound]]> https://tsecurity.de/de/3654859/it-nachrichten/sonos-is-finally-improving-its-app-but-its-not-moving-fast-enough-so-people-are-building-new-alternatives-to-solve-big-gripes-about-home-theater-setups-and-more-customizable-sound/ https://tsecurity.de/de/3654859/it-nachrichten/sonos-is-finally-improving-its-app-but-its-not-moving-fast-enough-so-people-are-building-new-alternatives-to-solve-big-gripes-about-home-theater-setups-and-more-customizable-sound/ Wed, 08 Jul 2026 18:19:34 +0200 📰 IT Nachrichten tsecurity.de <![CDATA[Security Teams Are Ready To Become More Preemptive. What’s Holding Them Back?]]> https://tsecurity.de/de/3654445/it-security-nachrichten/security-teams-are-ready-to-become-more-preemptive-whats-holding-them-back/ https://tsecurity.de/de/3654445/it-security-nachrichten/security-teams-are-ready-to-become-more-preemptive-whats-holding-them-back/ Wed, 08 Jul 2026 15:23:58 +0200 📰 IT Security Nachrichten tsecurity.de The shift toward preemptive security is underway, but most organizations are still navigating the realities of limited resources, fragmented tools, and emerging AI risk. At Rapid7’s recent Global Security Summit, we surveyed attendees to better understand where security leaders and practitioners stand today, what is shaping their priorities, and what they need to move forward. Their responses offer a candid view into the current state of security operations: ambitious, increasingly AI-aware, and ready for change, but still working through the practical challenges of getting there.

For many teams, the direction is clear: security needs to become more proactive, more connected, and more resilient. Attackers are moving quickly, environments are expanding, and teams are under pressure to reduce risk before it turns into business disruption. But the survey results show that most organizations are still somewhere in the middle of that journey.

Where organizations are today

One of the clearest findings is that security operations are increasingly collaborative. According to the survey, 57% of respondents operate in a hybrid internal and MDR model. That reflects a reality many teams know well: internal expertise remains essential, but external support can help extend coverage, add specialist knowledge, and support faster response when internal resources are stretched.

This hybrid model also speaks to the complexity security teams are managing. Modern environments span cloud, identity, endpoints, applications, third parties, and expanding attack surfaces. Keeping watch across all of it requires more than tooling alone. It requires the right mix of people, process, visibility, and support.

At the same time, many organizations are still working to connect the dots across their security ecosystem. Two-thirds of respondents said their security capabilities are only partially integrated. For analysts, partial integration often means more manual work: switching between tools, stitching together context, and making decisions with an incomplete picture. When teams are jumping between systems, manually stitching together context, or working from incomplete data, it becomes harder to act at the speed modern threats demand.

The survey also showed that only 10% of respondents describe their organization as “highly proactive” in predicting and preventing threats, which points to the reality of where many teams are today. The ambition is there, but becoming truly preemptive takes time, integration, and operational maturity. Most organizations are still balancing the day-to-day demands of reactive response with the longer-term work of building a more proactive security model.

Confidence levels tell a similar story. 59% of respondents said they are only somewhat confident in their organization’s ability to prevent attacks before impact. Security teams understand what is at stake, but many still lack full confidence that they can consistently stop threats before they affect the business.

AI is a priority, but trust matters

AI was, of course, another major theme in the survey. Interest is high, especially when it comes to improving efficiency, accelerating triage, and helping teams manage growing volumes of data and alerts, but adoption is still developing. 52% of respondents said AI is in early-stage exploration within their security operations.

AI has clear potential in the SOC and across security operations, from summarizing investigations to enriching alerts, supporting prioritization, and helping analysts move faster. But security teams have to be deliberate about how they apply it. In high-pressure environments where accuracy, context, and accountability matter, AI needs to earn trust.

The survey results show that trust is still a key consideration. 57% of respondents cited securing AI usage as a top AI and security concern, while 44% cited lack of transparency or trust. These responses reflect a practical mindset. Security leaders are thinking about both sides of AI: how it can help defenders move faster, and how to manage the new risks it introduces. Internally, for AI to become operationally valuable, it has to fit into existing workflows, provide explainable outputs, and support human expertise.

What security teams want next

When respondents were asked what is preventing them from becoming more proactive, the top challenges were practical and familiar. 54% cited limited staff or expertise, making capacity one of the biggest barriers to progress. Teams may have the ambition to become more preemptive, but many are already balancing daily alert queues, incident response, vulnerability backlogs, compliance pressure, and business-as-usual security demands.

Visibility is another major factor. 31% of respondents cited lack of visibility across the environment as a barrier to becoming more proactive. Without a clear view of assets, identities, exposures, and attacker activity, teams struggle to prioritize what matters most. This is especially important as organizations look to move from broad detection toward more risk-aware, preemptive action.

The priorities respondents selected show where they want to go next. 41% selected preemptive security as a top security leadership priority, while improving resilience, strengthening incident response, reducing complexity, and improving risk visibility also appeared as recurring themes.

The findings from our Global Security Summit make one thing clear: security teams are ready to move toward more proactive, integrated, and AI-enabled operations, but they need the right visibility, expertise, and confidence to do it well.

To hear more from the experts and practitioners who joined us at the summit, catch up on the on-demand sessions. And to learn how Rapid7 is helping organizations move toward preemptive security, explore Rapid7 Managed Detection and Response, built to disrupt attackers earlier with broad ecosystem coverage, risk visibility, expert guidance, and an AI-powered SOC.

]]> <![CDATA[Anthropic expands Claude Cowork to web and mobile as enterprise use broadens]]> https://tsecurity.de/de/3654335/ai-nachrichten/anthropic-expands-claude-cowork-to-web-and-mobile-as-enterprise-use-broadens/ https://tsecurity.de/de/3654335/ai-nachrichten/anthropic-expands-claude-cowork-to-web-and-mobile-as-enterprise-use-broadens/ Wed, 08 Jul 2026 14:48:40 +0200 🔧 AI Nachrichten tsecurity.de

Anthropic is bringing its Claude Cowork AI agent to web and mobile platforms, a move aimed at helping enterprise users monitor and manage long-running AI-driven tasks from anywhere as organizations increasingly adopt agents for operational and knowledge work.

The rollout, according to the company, is based on an analysis of 1.2 million anonymized and aggregated Claude Cowork sessions conducted between May 11 and May 31 that showed that business process and operations accounted for the largest share of the AI agent’s usage at 33.4%, followed by content creation and copywriting at 16.4%, the company wrote in a blog post.

Software development represented only 8.7% of sessions, ahead of DevOps and infrastructure at 7%, along with research and intelligence at 6.4%, and data analysis and business intelligence (5.8%).

Cowork’s expansion, which is currently in beta, will allow users to start and manage Claude Cowork sessions directly from the Claude interface on the web and mobile, while enabling the AI agent to continue executing long-running tasks in the cloud, the company wrote in a separate blog post.

That cloud functionality would allow users to check progress, respond to approval requests, and resume conversations across devices without returning to their desktop, it added.

More employee productivity

For CIOs and their enterprises, Cowork’s expansion is likely to unlock productivity gains, according to Pareekh Jain, principal at Pareekh Consulting.

“Teams can monitor long-running tasks, respond to exceptions, and keep business processes moving even when away from their desks, reducing operational delays, while also improving AI adoption,” Jain said.  

Beyond productivity gains, the expansion could reshape how CIOs staff and manage operational support functions, according to Bhupendra Chopra, chief revenue officer at IT consulting firm Kanerika.

“As AI agents take on routine knowledge work such as preparing reports, processing documents, and reconciling data, employees would increasingly shift from executing those tasks to supervising AI-generated outputs, reviewing exceptions, and applying business judgment. That would allow CIOs to redeploy knowledge workers toward higher-value activities while reducing the manual effort required across operational support teams,” Chopra said.

For developers, Cowork’s expansion will help shorten development cycles as it makes AI-assisted software engineering more continuous instead of being tied to a desktop IDE, Jain said.  

Background agents bring governance challenges

However, analysts cautioned that the rise and enterprise adoption of Claude Cowork-like tools, which represent a growing class of AI agents that operate in the background, executing long-running tasks with periodic human oversight, would also require CIOs to strengthen governance, security, and oversight.

“Always-on or persistent agents expand the attack surface because they continuously access enterprise systems and data. CIOs will need stronger identity controls, least-privilege permissions, audit trails, approval workflows, policy enforcement, and continuous monitoring to ensure these agents remain secure, compliant, and accountable,” Jain said.

Citing research from Gravitee that surveyed 445 IT and security leaders across multiple industries, Chopra pointed out that 88% of the surveyed leaders said that deploying AI agents reported confirmed or suspected security incidents over the past year, while only about 14% said their agents were deployed with full security and IT approval.

“The deployment velocity is dramatically outpacing governance. A background agent reading email, files, and calendars while the user is offline requires very precise scoping of what it can access and what it can act on,” Chopra said.

“Anthropic has kept human approval in the loop for consequential actions — that’s sensible product design. But enterprises need to build the same discipline on their side before they extend broad access to any agent,” Chopra added. 

The web and mobile experience are currently available only for Max subscribers, Anthropic said, adding that support for Pro, Team, and Enterprise plans will follow in the coming weeks.

]]> <![CDATA[ScienceLogic adds geographic service visibility to Skylar One]]> https://tsecurity.de/de/3653797/it-security-nachrichten/sciencelogic-adds-geographic-service-visibility-to-skylar-one/ https://tsecurity.de/de/3653797/it-security-nachrichten/sciencelogic-adds-geographic-service-visibility-to-skylar-one/ Wed, 08 Jul 2026 11:23:37 +0200 📰 IT Security Nachrichten tsecurity.de ScienceLogic has released the “Kyoto” update for Skylar One, the core observability offering in its AI Platform. The release adds geographic service visibility, simplified location and device management, enhanced relationship mapping, and platform updates aimed at improving observability across hybrid


Read more →

The post ScienceLogic adds geographic service visibility to Skylar One appeared first on IT Security News.

]]> <![CDATA[ScienceLogic adds geographic service visibility to Skylar One]]> https://tsecurity.de/de/3653756/it-security-nachrichten/sciencelogic-adds-geographic-service-visibility-to-skylar-one/ https://tsecurity.de/de/3653756/it-security-nachrichten/sciencelogic-adds-geographic-service-visibility-to-skylar-one/ Wed, 08 Jul 2026 11:09:12 +0200 📰 IT Security Nachrichten tsecurity.de ScienceLogic has released the “Kyoto” update for Skylar One, the core observability offering in its AI Platform. The release adds geographic service visibility, simplified location and device management, enhanced relationship mapping, and platform updates aimed at improving observability across hybrid IT environments. The Kyoto update is designed for organizations managing hybrid infrastructure, cloud environments, and AI workloads. It introduces features for investigating service issues, managing locations and access, and improving platform scalability and resilience. Highlights 
 More →

The post ScienceLogic adds geographic service visibility to Skylar One appeared first on Help Net Security.

]]> <![CDATA[If Linux advocates freedom then why some users are being judged for using proprietary software?]]> https://tsecurity.de/de/3653164/linux-tipps/if-linux-advocates-freedom-then-why-some-users-are-being-judged-for-using-proprietary-software/ https://tsecurity.de/de/3653164/linux-tipps/if-linux-advocates-freedom-then-why-some-users-are-being-judged-for-using-proprietary-software/ Wed, 08 Jul 2026 05:22:30 +0200 🐧 Linux Tipps tsecurity.de

Hi, I use Arch btw

I prefer FOSS much much more than proprietary bloat if able. After all, proprietary software have concerns about security, transparency, or even privacy. However, this is a reality, FOSS and proprietary software still need to co-exist each other. This is how the world runs. To give you examples: proprietary Nvidia driver for gaming, wifi/bluetooth driver or even Steam to launch Steam games.

Now, we may criticize software (FOSS or proprietary) however we want. I in particular is big tech hater and I still hate Nvidia for making Linux unnecessarily complicated. But this is not what we are talking about here.

What I am here for is: when users are being judged for using proprietary software out of necessity or just a matter of preferences. That's just toxic and condescending. We are not improving the situation of forced ecosystem or vendor locked down by shaming users. In fact, we are making it worse.

So instead of shaming them, you should encourage (not force) them to use FOSS alternatives. The more people using FOSS, the more gravity effect is taking place. More users = more feedback = more improvement = more contributors. And when FOSS alternative is prominent enough to make proprietary software obsolete, that's where we win here.

submitted by /u/tungnon
[link] [comments]]]> <![CDATA[deepin 25.2.0 Released: Treeland Usability Improved & Doc Manager Text Search for Images]]> https://tsecurity.de/de/3653059/unix-server/deepin-2520-released-treeland-usability-improved-doc-manager-text-search-for-images/ https://tsecurity.de/de/3653059/unix-server/deepin-2520-released-treeland-usability-improved-doc-manager-text-search-for-images/ Wed, 08 Jul 2026 03:45:50 +0200 🐧 Unix Server tsecurity.de Read more]]> <![CDATA[deepin 25.2.0 Release Note]]> https://tsecurity.de/de/3653029/unix-server/deepin-2520-release-note/ https://tsecurity.de/de/3653029/unix-server/deepin-2520-release-note/ Wed, 08 Jul 2026 03:31:26 +0200 🐧 Unix Server tsecurity.de Read more]]> <![CDATA[Introducing Nitro Automate: Intelligent document automation for enterprise AI workflows]]> https://tsecurity.de/de/3652814/it-nachrichten/introducing-nitro-automate-intelligent-document-automation-for-enterprise-ai-workflows/ https://tsecurity.de/de/3652814/it-nachrichten/introducing-nitro-automate-intelligent-document-automation-for-enterprise-ai-workflows/ Tue, 07 Jul 2026 23:48:09 +0200 📰 IT Nachrichten tsecurity.de

From contracts and invoices to onboarding forms and compliance records, document-heavy processes consume significant time and resources across enterprise organizations.

While AI has introduced new opportunities for automation, many organizations still struggle with one fundamental challenge: A lot of important business information is trapped inside PDFs, forms, and other documents.

Nitro Automate solves this problem.

Designed for enterprise-level document volume, Nitro Automate is an intelligent document automation platform that combines document processing, workflow automation, and AI-powered integrations to help teams eliminate manual document tasks and automate business processes. It’s fast to deploy, built to work anywhere your team handles PDFs, and can start delivering value almost immediately.

Nitro Automate is intelligent document automation for today’s enterprises

Nitro Automate extends Nitro’s document productivity solutions—Nitro PDF, Nitro Sign, Nitro Smart Redact—going beyond document creation, editing, and signing to address the challenge of managing document operations across the AI agents, workflows, and systems your teams rely on.

Instead of depending on employees to move documents between systems, extract data manually, or manage repetitive workflows, Nitro Automate lets you automate tasks throughout the document lifecycle, including:

  • Process, convert, reshape, transform, convert, compress, and secure PDFs
  • Document generation and assembly
  • Data extraction from forms and documents
  • Workflow automation and orchestration
  • eSignature workflow automation
  • Document security and redaction
  • Integration with enterprise applications

Key capabilities of Nitro Automate

Nitro Automate works at two levels.

At the team and department level, it combines document automation, AI-powered data extraction, and workflow orchestration to eliminate manual document work entirely for high-volume processes.

At the individual level, it accelerates essential document tasks that still require human judgment, such as reviewing, approving, or routing documents.

Across both levels, enterprise integrations make document data accessible to every stakeholder, whether they’re automating a process or working through it directly.

Here are four ways Nitro Automate transforms document-intensive workflows.

Eliminate many manual PDF tasks

Despite significant investments in digitalization, many core business workflows, like employee onboarding, contract review, and invoice processing, still depend on employees manually performing routine document tasks before work can move forward. These tasks include:

  • Converting files to the right format
  • Splitting or merging PDFs
  • Extracting specific content
  • Applying security settings
  • Preparing final document packages

Individually, each task takes only a few minutes. But repeated across hundreds or thousands of documents, they add up to hours of low-value manual work embedded inside otherwise automated workflows. Nitro Automate removes these manual document steps from core business workflows entirely, so employees are no longer a required step between one process stage and the next.

These activities may seem insignificant when viewed individually, but when thousands of documents are at play, they can create substantial operational overhead. Nitro Automate helps automate these processes through reusable workflows that can run behind the scenes to support business operations.

That means that your teams can focus on higher-value work while improving process consistency and reducing the risk of errors.

Automate eSignature workflows beyond the signature

In many organizations, obtaining an electronic signature is only one step in a larger workflow.

For example, a contract may require document generation, internal approvals, signature collection, storage, reporting, and follow-up actions. Similar workflows exist across industries, such as HR, procurement, legal, finance, and customer operations.

Nitro Automate helps organizations automate these processes by integrating document preparation, routing, approvals, and Nitro Sign workflows into a single automated experience.

Instead of managing signatures manually across disconnected tools, teams can create workflows that automatically move documents through each stage of the lifecycle, resulting in faster turnaround times, improved visibility, and fewer bottlenecks.

Unlock data trapped in documents

One of Nitro Automate’s most valuable capabilities is how it transforms unstructured document content into actionable business data.

Critical information is often stored inside contracts, invoices, applications, forms, and other documents. Accessing that information traditionally requires manual review and extraction. Nitro Automate uses AI to identify, capture, and structure document data so it can be used by downstream systems and workflows to accelerate processes, such as:

  • Invoice and accounts payable automation
  • Employee onboarding
  • Contract management
  • Customer intake
  • Compliance reporting
  • Claims and case management

Build document workflows that work in the AI era

As enterprises move beyond AI copilots that assist with individual tasks and begin deploying AI agents that can execute multi-step workflows autonomously, document automation is becoming an increasingly important part of AI strategy.

Many AI systems can analyze information and generate recommendations, but they often require specialized tools to execute document-related tasks. Nitro Automate addresses this challenge by providing flexible integration options that support both human- and AI-driven workflows.

For example, business teams can build their own automations using low-code and no-code tools, while developers can easily integrate Nitro Automate into existing applications and workflows using APIs.

Nitro Automate is also compatible with the Model Context Protocol (MCP), an emerging open source standard that allows AI agents to securely access external tools and services. Through MCP, AI agents can use Nitro’s document automation solution to interact with documents inside business workflows, making Nitro Automate a document execution layer for enterprise AI initiatives.

Nitro Automate: A new approach to enterprise document operations

If your organization is investing in automation and AI, it’s important to recognize that document-intensive processes are one of the largest opportunities for operational improvement.

Nitro Automate bridges the gap between documents, workflows, enterprise systems, and AI agents by bringing together document processing, eSignature automation, data extraction, and workflow orchestration.

Ready to discover how Nitro Automate helps create intelligent workflows that can scale alongside the next generation of enterprise AI?

Speak with a Nitro Automation Expert

]]> <![CDATA[Hitachi Energy PROMOD V]]> https://tsecurity.de/de/3652272/it-security-nachrichten/hitachi-energy-promod-v/ https://tsecurity.de/de/3652272/it-security-nachrichten/hitachi-energy-promod-v/ Tue, 07 Jul 2026 18:55:50 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Hitachi Energy is aware of insecure HTTP transmission vulnerability in PROMOD V product versions listed in this document. This vulnerability could allow attackers to intercept or manipulate sensitive data in transit, potentially leading to credential theft, session hijacking, or unauthorized access.

The following versions of Hitachi Energy PROMOD V are affected:

  • PROMOD V vers:PROMOD_V/<=1.0.10
CVSS Vendor Equipment Vulnerabilities
v3 7.1 Hitachi Energy Hitachi Energy PROMOD V Reliance on HTTP instead of HTTPS

Background

  • Critical Infrastructure Sectors: Energy
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Switzerland

Vulnerabilities

Expand All +

CVE-2026-10763

PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server.

View CVE Details

Affected Products

Hitachi Energy PROMOD V
Vendor:
Hitachi Energy
Product Version:
PROMOD V versions 1.0.10 and prior
Product Status:
known_affected
Remediations

Vendor fix
Upgrade to version 1.0.11 and enable HTTPS on Digipede server. [2] Refer to “1.0.11 PROMOD V User Guide”, Section 2 Essential Skills->Running PROMOD V->Digipede Grid. Alternatively, refer to the same section in the online help contained in the application.

Mitigation
Apply general mitigation factors

Relevant CWE: CWE-1428 Reliance on HTTP instead of HTTPS

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.1 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
4.0 7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Acknowledgments

  • Hitachi Energy Internal Team

Notice

The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.

Support

For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.

General Mitigation Factors

Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification. [1]

SSVC

SSVCv2/E:N/A:N/2026-06-29T12:01:59Z/

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000250 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-06-30
Date Revision Summary
2026-06-30 1 Initial public release
2026-07-07 2 Initial CISA Republication of Hitachi Energy PSIRT 8DBD000250 advisory

Legal Notice and Terms of Use

]]> <![CDATA[Siemens SINEC OS]]> https://tsecurity.de/de/3652271/it-security-nachrichten/siemens-sinec-os/ https://tsecurity.de/de/3652271/it-security-nachrichten/siemens-sinec-os/ Tue, 07 Jul 2026 18:55:49 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.

The following versions of Siemens SINEC OS are affected:

  • RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/<4.0 
CVSS Vendor Equipment Vulnerabilities
v3 9.8 Siemens Siemens SINEC OS Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Resource Shutdown or Release, Integer Overflow or Wraparound, Stack-based Buffer Overflow, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Uncontrolled Recursion, Out-of-bounds Read, Covert Timing Channel, Improper Input Validation, Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Improper Update of Reference Count, Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), Multiple Releases of Same Resource or Handle, Permissive Regular Expression, Expired Pointer Dereference, Incorrect Bitwise Shift of Integer, Out-of-bounds Write, User Interface (UI) Misrepresentation of Critical Information, Improper Access Control, Insertion of Sensitive Information Into Sent Data, Inefficient Algorithmic Complexity, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Authentication Bypass by Primary Weakness, NULL Pointer Dereference, Active Debug Code, Loop with Unreachable Exit Condition ('Infinite Loop'), Missing Synchronization, External Control of File Name or Path, Privilege Dropping / Lowering Errors, Use of Web Browser Cache Containing Sensitive Information

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2025-1352

A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

CVE-2025-1376

A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-404 Improper Resource Shutdown or Release

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 2.5 LOW CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CVE-2025-6052

A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 3.7 LOW CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2025-6141

A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-121 Stack-based Buffer Overflow

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 3.3 LOW CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CVE-2025-6170

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-121 Stack-based Buffer Overflow

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 2.5 LOW CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2025-7039

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 3.7 LOW CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2025-8732

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-674 Uncontrolled Recursion

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 3.3 LOW CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CVE-2025-9086

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path=\"/\",`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2025-9230

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2025-9231

Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-385 Covert Timing Channel

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CVE-2025-9232

Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2025-10966

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVE-2025-13465

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

CVE-2025-13601

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.7 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CVE-2025-39913

In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. syzbot reported the splat below. [0] The repro does the following: 1. Load a sk_msg prog that calls bpf_msg_cork_bytes(msg, cork_bytes) 2. Attach the prog to a SOCKMAP 3. Add a socket to the SOCKMAP 4. Activate fault injection 5. Send data less than cork_bytes At 5., the data is carried over to the next sendmsg() as it is smaller than the cork_bytes specified by bpf_msg_cork_bytes(). Then, tcp_bpf_send_verdict() tries to allocate psock->cork to hold the data, but this fails silently due to fault injection + __GFP_NOWARN. If the allocation fails, we need to revert the sk->sk_forward_alloc change done by sk_msg_alloc(). Let's call sk_msg_free() when tcp_bpf_send_verdict fails to allocate psock->cork. The "*copied" also needs to be updated such that a proper error can be returned to the caller, sendmsg. It fails to allocate psock->cork. Nothing has been corked so far, so this patch simply sets "*copied" to 0. [0]: WARNING: net/ipv4/af_inet.c:156 at inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156, CPU#1: syz-executor/5983 Modules linked in: CPU: 1 UID: 0 PID: 5983 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156 Code: 0f 0b 90 e9 62 fe ff ff e8 7a db b5 f7 90 0f 0b 90 e9 95 fe ff ff e8 6c db b5 f7 90 0f 0b 90 e9 bb fe ff ff e8 5e db b5 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc RSP: 0018:ffffc90000a08b48 EFLAGS: 00010246 RAX: ffffffff8a09d0b2 RBX: dffffc0000000000 RCX: ffff888024a23c80 RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000 RBP: 0000000000000fff R08: ffff88807e07c627 R09: 1ffff1100fc0f8c4 R10: dffffc0000000000 R11: ffffed100fc0f8c5 R12: ffff88807e07c380 R13: dffffc0000000000 R14: ffff88807e07c60c R15: 1ffff1100fc0f872 FS: 00005555604c4500(0000) GS:ffff888125af1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555604df5c8 CR3: 0000000032b06000 CR4: 00000000003526f0 Call Trace: __sk_destruct+0x86/0x660 net/core/sock.c:2339 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0xca8/0x1770 kernel/rcu/tree.c:2861 handle_softirqs+0x286/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-40214

In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro. The repro consists of three stages. 1) 1-a. Create a single cyclic reference with many sockets 1-b. close() all sockets 1-c. Trigger GC 2) 2-a. Pass sk-A to an embryo sk-B 2-b. Pass sk-X to sk-X 2-c. Trigger GC 3) 3-a. accept() the embryo sk-B 3-b. Pass sk-B to sk-C 3-c. close() the in-flight sk-A 3-d. Trigger GC As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs: unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3 Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC. At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices. unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight. 3-c decrements sk-A's file refcnt to 1. Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X: sk-A -> sk-B (-> sk-C) sk-X -> sk-X This is totally fine. All of them are not yet close()d and should be grouped into different SCCs. However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead. unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !? The problem is that unix_add_edge() does not initialise scc_index. Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c. Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index. This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2025-40248

In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock_transport_cancel_pkt() -> virtio_transport_purge_skbs() may race with sendmsg() invoking virtio_transport_get_credit(). This results in a permanently elevated `vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling. 2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs. 3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a transport change/drop after TCP_ESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref. Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg().

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2025-40250

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clean up only new IRQ glue on request_irq() failure The mlx5_irq_alloc() function can inadvertently free the entire rmap and end up in a crash[1] when the other threads tries to access this, when request_irq() fails due to exhausted IRQ vectors. This commit modifies the cleanup to remove only the specific IRQ mapping that was just added. This prevents removal of other valid mappings and ensures precise cleanup of the failed IRQ allocation's associated glue object. Note: This error is observed when both fwctl and rds configs are enabled. [1] mlx5_core 0000:05:00.0: Successfully registered panic handler for port 1 mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to request irq. err = -28 infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while trying to test write-combining support mlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1 mlx5_core 0000:06:00.0: Successfully registered panic handler for port 1 mlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to request irq. err = -28 infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while trying to test write-combining support mlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1 mlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to request irq. err = -28 mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to request irq. err = -28 general protection fault, probably for non-canonical address 0xe277a58fde16f291: 0000 [#1] SMP NOPTI RIP: 0010:free_irq_cpu_rmap+0x23/0x7d Call Trace: ? show_trace_log_lvl+0x1d6/0x2f9 ? show_trace_log_lvl+0x1d6/0x2f9 ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] ? __die_body.cold+0x8/0xa ? die_addr+0x39/0x53 ? exc_general_protection+0x1c4/0x3e9 ? dev_vprintk_emit+0x5f/0x90 ? asm_exc_general_protection+0x22/0x27 ? free_irq_cpu_rmap+0x23/0x7d mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] irq_pool_request_vector+0x7d/0x90 [mlx5_core] mlx5_irq_request+0x2e/0xe0 [mlx5_core] mlx5_irq_request_vector+0xad/0xf7 [mlx5_core] comp_irq_request_pci+0x64/0xf0 [mlx5_core] create_comp_eq+0x71/0x385 [mlx5_core] ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core] mlx5_comp_eqn_get+0x72/0x90 [mlx5_core] ? xas_load+0x8/0x91 mlx5_comp_irqn_get+0x40/0x90 [mlx5_core] mlx5e_open_channel+0x7d/0x3c7 [mlx5_core] mlx5e_open_channels+0xad/0x250 [mlx5_core] mlx5e_open_locked+0x3e/0x110 [mlx5_core] mlx5e_open+0x23/0x70 [mlx5_core] __dev_open+0xf1/0x1a5 __dev_change_flags+0x1e1/0x249 dev_change_flags+0x21/0x5c do_setlink+0x28b/0xcc4 ? __nla_parse+0x22/0x3d ? inet6_validate_link_af+0x6b/0x108 ? cpumask_next+0x1f/0x35 ? __snmp6_fill_stats64.constprop.0+0x66/0x107 ? __nla_validate_parse+0x48/0x1e6 __rtnl_newlink+0x5ff/0xa57 ? kmem_cache_alloc_trace+0x164/0x2ce rtnl_newlink+0x44/0x6e rtnetlink_rcv_msg+0x2bb/0x362 ? __netlink_sendskb+0x4c/0x6c ? netlink_unicast+0x28f/0x2ce ? rtnl_calcit.isra.0+0x150/0x146 netlink_rcv_skb+0x5f/0x112 netlink_unicast+0x213/0x2ce netlink_sendmsg+0x24f/0x4d9 __sock_sendmsg+0x65/0x6a ____sys_sendmsg+0x28f/0x2c9 ? import_iovec+0x17/0x2b ___sys_sendmsg+0x97/0xe0 __sys_sendmsg+0x81/0xd8 do_syscall_64+0x35/0x87 entry_SYSCALL_64_after_hwframe+0x6e/0x0 RIP: 0033:0x7fc328603727 Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48 RSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727 RDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d RBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00000000000 ---truncated---

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-40251

In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driver-specific `rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing the parent's refcount, without actually setting the `devlink_rate->parent` pointer to NULL. This leaves a dangling pointer in the `devlink_rate` struct, which cause refcount error in netdevsim[1] and mlx5[2]. In addition, this is inconsistent with the behavior of `devlink_nl_rate_parent_node_set`, where the parent pointer is correctly cleared. This patch fixes the issue by explicitly setting `devlink_rate->parent` to NULL after notifying the driver, thus fulfilling the function's documented behavior for all rate objects. [1] repro steps: echo 1 > /sys/bus/netdevsim/new_device devlink dev eswitch set netdevsim/netdevsim1 mode switchdev echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs devlink port function rate add netdevsim/netdevsim1/test_node devlink port function rate set netdevsim/netdevsim1/128 parent test_node echo 1 > /sys/bus/netdevsim/del_device dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: devl_rate_leaf_destroy+0x8d/0x90 __nsim_dev_port_del+0x6c/0x70 [netdevsim] nsim_dev_reload_destroy+0x11c/0x140 [netdevsim] nsim_drv_remove+0x2b/0xb0 [netdevsim] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x130 device_del+0x159/0x3c0 device_unregister+0x1a/0x60 del_device_store+0x111/0x170 [netdevsim] kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x55/0x10f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] devlink dev eswitch set pci/0000:08:00.0 mode switchdev devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000 devlink port function rate add pci/0000:08:00.0/group1 devlink port function rate set pci/0000:08:00.0/32768 parent group1 modprobe -r mlx5_ib mlx5_fwctl mlx5_core dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: devl_rate_leaf_destroy+0x8d/0x90 mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core] mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core] mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core] mlx5_sf_esw_event+0xc4/0x120 [mlx5_core] notifier_call_chain+0x33/0xa0 blocking_notifier_call_chain+0x3b/0x50 mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core] mlx5_eswitch_disable+0x63/0x90 [mlx5_core] mlx5_unload+0x1d/0x170 [mlx5_core] mlx5_uninit_one+0xa2/0x130 [mlx5_core] remove_one+0x78/0xd0 [mlx5_core] pci_device_remove+0x39/0xa0 device_release_driver_internal+0x194/0x1f0 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x53/0x1f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-911 Improper Update of Reference Count

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.1 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CVE-2025-40252

In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator as the stopping condition. If the terminator was missing or malformed, the loop could run past the end of the fixed-size array. Add an explicit bound check using ARRAY_SIZE() in both loops to prevent a potential out-of-bounds access. Found by Linux Verification Center (linuxtesting.org) with SVACE.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2025-40254

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: remove never-working support for setting nsh fields The validation of the set(nsh(...)) action is completely wrong. It runs through the nsh_key_put_from_nlattr() function that is the same function that validates NSH keys for the flow match and the push_nsh() action. However, the set(nsh(...)) has a very different memory layout. Nested attributes in there are doubled in size in case of the masked set(). That makes proper validation impossible. There is also confusion in the code between the 'masked' flag, that says that the nested attributes are doubled in size containing both the value and the mask, and the 'is_mask' that says that the value we're parsing is the mask. This is causing kernel crash on trying to write into mask part of the match with SW_FLOW_KEY_PUT() during validation, while validate_nsh() doesn't allocate any memory for it: BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary) RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch] Call Trace: validate_nsh+0x60/0x90 [openvswitch] validate_set.constprop.0+0x270/0x3c0 [openvswitch] __ovs_nla_copy_actions+0x477/0x860 [openvswitch] ovs_nla_copy_actions+0x8d/0x100 [openvswitch] ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch] genl_family_rcv_msg_doit+0xdb/0x130 genl_family_rcv_msg+0x14b/0x220 genl_rcv_msg+0x47/0xa0 netlink_rcv_skb+0x53/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x280/0x3b0 netlink_sendmsg+0x1f7/0x430 ____sys_sendmsg+0x36b/0x3a0 ___sys_sendmsg+0x87/0xd0 __sys_sendmsg+0x6d/0xd0 do_syscall_64+0x7b/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The third issue with this process is that while trying to convert the non-masked set into masked one, validate_set() copies and doubles the size of the OVS_KEY_ATTR_NSH as if it didn't have any nested attributes. It should be copying each nested attribute and doubling them in size independently. And the process must be properly reversed during the conversion back from masked to a non-masked variant during the flow dump. In the end, the only two outcomes of trying to use this action are either validation failure or a kernel crash. And if somehow someone manages to install a flow with such an action, it will most definitely not do what it is supposed to, since all the keys and the masks are mixed up. Fixing all the issues is a complex task as it requires re-writing most of the validation code. Given that and the fact that this functionality never worked since introduction, let's just remove it altogether. It's better to re-introduce it later with a proper implementation instead of trying to fix it in stable releases.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2025-40257

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. Add RCU protection to fix this issue. Also change confusing add_timer variable with stop_timer boolean. syzbot report: BUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 Read of size 4 at addr ffff8880311e4150 by task kworker/1:1/44 CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Workqueue: events mptcp_worker Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 sk_stop_timer_sync+0x1b/0x90 net/core/sock.c:3631 mptcp_pm_del_add_timer+0x283/0x310 net/mptcp/pm.c:362 mptcp_incoming_options+0x1357/0x1f60 net/mptcp/options.c:1174 tcp_data_queue+0xca/0x6450 net/ipv4/tcp_input.c:5361 tcp_rcv_established+0x1335/0x2670 net/ipv4/tcp_input.c:6441 tcp_v4_do_rcv+0x98b/0xbf0 net/ipv4/tcp_ipv4.c:1931 tcp_v4_rcv+0x252a/0x2dc0 net/ipv4/tcp_ipv4.c:2374 ip_protocol_deliver_rcu+0x221/0x440 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:239 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6079 [inline] __netif_receive_skb+0x143/0x380 net/core/dev.c:6192 process_backlog+0x31e/0x900 net/core/dev.c:6544 __napi_poll+0xb6/0x540 net/core/dev.c:7594 napi_poll net/core/dev.c:7657 [inline] net_rx_action+0x5f7/0xda0 net/core/dev.c:7784 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] __local_bh_enable_ip+0x1a0/0x2e0 kernel/softirq.c:302 mptcp_pm_send_ack net/mptcp/pm.c:210 [inline] mptcp_pm_addr_send_ack+0x41f/0x500 net/mptcp/pm.c:-1 mptcp_pm_worker+0x174/0x320 net/mptcp/pm.c:1002 mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 44: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __kmalloc_cache_noprof+0x1ef/0x6c0 mm/slub.c:5748 kmalloc_noprof include/linux/slab.h:957 [inline] mptcp_pm_alloc_anno_list+0x104/0x460 net/mptcp/pm.c:385 mptcp_pm_create_subflow_or_signal_addr+0xf9d/0x1360 net/mptcp/pm_kernel.c:355 mptcp_pm_nl_fully_established net/mptcp/pm_kernel.c:409 [inline] __mptcp_pm_kernel_worker+0x417/0x1ef0 net/mptcp/pm_kernel.c:1529 mptcp_pm_worker+0x1ee/0x320 net/mptcp/pm.c:1008 mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 6630: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object m ---truncated---

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-40258

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run immediately and complete before [B] We need instead : sock_hold(sk); if (schedule_work(...)) return true; sock_put(sk); [1] refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25 Call Trace: __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] sock_hold include/net/sock.h:816 [inline] mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943 mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1138 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2025-40261

In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_assocation() waits for pending I/O to complete before returning, and an error can cause ->ioerr_work to be queued after cancel_work_sync() had been called. Move the call to cancel_work_sync() to be after nvme_fc_delete_association() to ensure ->ioerr_work is not running when the nvme_fc_ctrl object is freed. Otherwise the following can occur: [ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL [ 1135.917705] ------------[ cut here ]------------ [ 1135.922336] kernel BUG at lib/list_debug.c:52! [ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary) [ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025 [ 1135.950969] Workqueue: 0x0 (nvme-wq) [ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f [ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b [ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046 [ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000 [ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0 [ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08 [ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100 [ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0 [ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000 [ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0 [ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 1136.055910] PKRU: 55555554 [ 1136.058623] Call Trace: [ 1136.061074] [ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0 [ 1136.071898] ? move_linked_works+0x4a/0xa0 [ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.081744] ? __die_body.cold+0x8/0x12 [ 1136.085584] ? die+0x2e/0x50 [ 1136.088469] ? do_trap+0xca/0x110 [ 1136.091789] ? do_error_trap+0x65/0x80 [ 1136.095543] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.101289] ? exc_invalid_op+0x50/0x70 [ 1136.105127] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20 [ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f [ 1136.120806] move_linked_works+0x4a/0xa0 [ 1136.124733] worker_thread+0x216/0x3a0 [ 1136.128485] ? __pfx_worker_thread+0x10/0x10 [ 1136.132758] kthread+0xfa/0x240 [ 1136.135904] ? __pfx_kthread+0x10/0x10 [ 1136.139657] ret_from_fork+0x31/0x50 [ 1136.143236] ? __pfx_kthread+0x10/0x10 [ 1136.146988] ret_from_fork_asm+0x1a/0x30 [ 1136.150915]

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-1341 Multiple Releases of Same Resource or Handle

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.6 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

CVE-2025-40262

In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption when the imx_sc_key_action() function is called. Remove the &.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-40263

In the Linux kernel, the following vulnerability has been resolved: Input: cros_ec_keyb - fix an invalid memory access If cros_ec_keyb_register_matrix() isn't called (due to `buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains NULL. An invalid memory access is observed in cros_ec_keyb_process() when receiving an EC_MKBP_EVENT_KEY_MATRIX event in cros_ec_keyb_work() in such case. Unable to handle kernel read from unreadable memory at virtual address 0000000000000028 ... x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: input_event cros_ec_keyb_work blocking_notifier_call_chain ec_irq_thread It's still unknown about why the kernel receives such malformed event, in any cases, the kernel shouldn't access `ckdev->idev` and friends if the driver doesn't intend to initialize them.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-40264

In the Linux kernel, the following vulnerability has been resolved: be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site.  This may lead to dereferencing a NULL pointer when processing a workaround for specific packet, as commit bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6 packet") states. The correct way would be to pass the wrb_params from be_xmit().

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2025-40271

In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2)

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-625 Permissive Regular Expression

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2025-40278

In the Linux kernel, the following vulnerability has been resolved: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Fix a KMSAN kernel-infoleak detected by the syzbot . [net?] KMSAN: kernel-infoleak in __skb_datagram_iter In tcf_ife_dump(), the variable 'opt' was partially initialized using a designatied initializer. While the padding bytes are reamined uninitialized. nla_put() copies the entire structure into a netlink message, these uninitialized bytes leaked to userspace. Initialize the structure with memset before assigning its fields to ensure all members and padding are cleared prior to beign copied. This change silences the KMSAN report and prevents potential information leaks from the kernel memory. This fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures no infoleak.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-40280

In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_mon_reinit_self(). syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0] The array is protected by RTNL, but tipc_mon_reinit_self() iterates over it without RTNL. tipc_mon_reinit_self() is called from tipc_net_finalize(), which is always under RTNL except for tipc_net_finalize_work(). Let's hold RTNL in tipc_net_finalize_work(). [0]: BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989 CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events tipc_net_finalize_work Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568 kasan_check_byte include/linux/kasan.h:399 [inline] lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline] rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline] rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244 rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243 write_lock_bh include/linux/rwlock_rt.h:99 [inline] tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718 tipc_net_finalize+0x115/0x190 net/tipc/net.c:140 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 6089: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657 tipc_enable_bearer net/tipc/bearer.c:357 [inline] __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047 __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline] tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393 tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline] tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:729 ____sys_sendmsg+0x508/0x820 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/ ---truncated---

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-825 Expired Pointer Dereference

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-40281

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto syzbot reported a possible shift-out-of-bounds [1] Blamed commit added rto_alpha_max and rto_beta_max set to 1000. It is unclear if some sctp users are setting very large rto_alpha and/or rto_beta. In order to prevent user regression, perform the test at run time. Also add READ_ONCE() annotations as sysctl values can change under us. [1] UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41 shift exponent 64 is too large for 32-bit type 'unsigned int' CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:233 [inline] __ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494 sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509 sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502 sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338 sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline]

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-1335 Incorrect Bitwise Shift of Integer

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 4.4 MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CVE-2025-40345

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin - Automated Vulnerability Discovery Engine. new_pba comes from the status packet returned after each write. A bogus device could report values beyond the block count derived from info->capacity, letting the driver walk off the end of pba_to_lba[] and corrupt heap memory. Reject PBAs that exceed the computed block count and fail the transfer so we avoid touching out-of-range mapping entries.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.8 MEDIUM CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2025-46394

In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-451 User Interface (UI) Misrepresentation of Critical Information

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 3.2 LOW CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

CVE-2025-49794

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-825 Expired Pointer Dereference

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CVE-2025-49795

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-825 Expired Pointer Dereference

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2025-49796

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-125 Out-of-bounds Read

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CVE-2025-60876

BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-284 Improper Access Control

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVE-2025-66035

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-201 Insertion of Sensitive Information Into Sent Data

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE-2025-66382

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-407 Inefficient Algorithmic Complexity

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 2.9 LOW CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2025-66412

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CVE-2025-69720

The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-121 Stack-based Buffer Overflow

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.3 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

CVE-2025-71185

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation Make sure to drop the reference taken when looking up the crossbar platform device during am335x route allocation.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-71186

In the Linux kernel, the following vulnerability has been resolved: dmaengine: stm32: dmamux: fix device leak on route allocation Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-71188

In the Linux kernel, the following vulnerability has been resolved: dmaengine: lpc18xx-dmamux: fix device leak on route allocation Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-71189

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw: dmamux: fix OF node leak on route allocation failure Make sure to drop the reference taken to the DMA master OF node also on late route allocation failures.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-71190

In the Linux kernel, the following vulnerability has been resolved: dmaengine: bcm-sba-raid: fix device leak on probe Make sure to drop the reference taken when looking up the mailbox device during probe on probe failures and on driver unbind.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-71191

In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_hdmac: fix device leak on of_dma_xlate() Make sure to drop the reference taken when looking up the DMA platform device during of_dma_xlate() when releasing channel resources. Note that commit 3832b78b3ec2 ("dmaengine: at_hdmac: add missing put_device() call in at_dma_xlate()") fixed the leak in a couple of error paths but the reference is still leaking on successful allocation.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-1484

A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 4.2 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

CVE-2026-1489

A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

CVE-2026-3784

curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy. The proper behavior is to create or use a separate connection.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-305 Authentication Bypass by Primary Weakness

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVE-2026-22610

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CVE-2026-22976

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset `qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class itself is active. Two qfq_class objects may point to the same leaf_qdisc. This happens when: 1. one QFQ qdisc is attached to the dev as the root qdisc, and 2. another QFQ qdisc is temporarily referenced (e.g., via qdisc_get() / qdisc_put()) and is pending to be destroyed, as in function tc_new_tfilter. When packets are enqueued through the root QFQ qdisc, the shared leaf_qdisc->q.qlen increases. At the same time, the second QFQ qdisc triggers qdisc_put and qdisc_destroy: the qdisc enters qfq_reset() with its own q->q.qlen == 0, but its class's leaf qdisc->q.qlen > 0. Therefore, the qfq_reset would wrongly deactivate an inactive aggregate and trigger a null-deref in qfq_deactivate_agg: [ 0.903172] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 0.903571] #PF: supervisor write access in kernel mode [ 0.903860] #PF: error_code(0x0002) - not-present page [ 0.904177] PGD 10299b067 P4D 10299b067 PUD 10299c067 PMD 0 [ 0.904502] Oops: Oops: 0002 [#1] SMP NOPTI [ 0.904737] CPU: 0 UID: 0 PID: 135 Comm: exploit Not tainted 6.19.0-rc3+ #2 NONE [ 0.905157] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 [ 0.905754] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:992 (discriminator 2) include/linux/list.h:1006 (discriminator 2) net/sched/sch_qfq.c:1367 (discriminator 2) net/sched/sch_qfq.c:1393 (discriminator 2)) [ 0.906046] Code: 0f 84 4d 01 00 00 48 89 70 18 8b 4b 10 48 c7 c2 ff ff ff ff 48 8b 78 08 48 d3 e2 48 21 f2 48 2b 13 48 8b 30 48 d3 ea 8b 4b 18 0 Code starting with the faulting instruction =========================================== 0: 0f 84 4d 01 00 00 je 0x153 6: 48 89 70 18 mov %rsi,0x18(%rax) a: 8b 4b 10 mov 0x10(%rbx),%ecx d: 48 c7 c2 ff ff ff ff mov $0xffffffffffffffff,%rdx 14: 48 8b 78 08 mov 0x8(%rax),%rdi 18: 48 d3 e2 shl %cl,%rdx 1b: 48 21 f2 and %rsi,%rdx 1e: 48 2b 13 sub (%rbx),%rdx 21: 48 8b 30 mov (%rax),%rsi 24: 48 d3 ea shr %cl,%rdx 27: 8b 4b 18 mov 0x18(%rbx),%ecx ... [ 0.907095] RSP: 0018:ffffc900004a39a0 EFLAGS: 00010246 [ 0.907368] RAX: ffff8881043a0880 RBX: ffff888102953340 RCX: 0000000000000000 [ 0.907723] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 0.908100] RBP: ffff888102952180 R08: 0000000000000000 R09: 0000000000000000 [ 0.908451] R10: ffff8881043a0000 R11: 0000000000000000 R12: ffff888102952000 [ 0.908804] R13: ffff888102952180 R14: ffff8881043a0ad8 R15: ffff8881043a0880 [ 0.909179] FS: 000000002a1a0380(0000) GS:ffff888196d8d000(0000) knlGS:0000000000000000 [ 0.909572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.909857] CR2: 0000000000000000 CR3: 0000000102993002 CR4: 0000000000772ef0 [ 0.910247] PKRU: 55555554 [ 0.910391] Call Trace: [ 0.910527] [ 0.910638] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1485) [ 0.910826] qdisc_reset (include/linux/skbuff.h:2195 include/linux/skbuff.h:2501 include/linux/skbuff.h:3424 include/linux/skbuff.h:3430 net/sched/sch_generic.c:1036) [ 0.911040] __qdisc_destroy (net/sched/sch_generic.c:1076) [ 0.911236] tc_new_tfilter (net/sched/cls_api.c:2447) [ 0.911447] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) [ 0.911663] ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:6861) [ 0.911894] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 0.912100] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 0.912296] ? __alloc_skb (net/core/skbuff.c:706) [ 0.912484] netlink_sendmsg (net/netlink/af ---truncated---

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-476 NULL Pointer Dereference

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-22977

In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[] field. [2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg(). The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone() (from skbuff_fclone_cache) [1] 2. The skb is cloned via skb_clone() using the pre-allocated fclone [3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE) 5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb [4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5] When cloned skbs allocated from skbuff_fclone_cache are used in the socket error queue, accessing the sock_exterr_skb structure in skb->cb via put_cmsg() triggers a usercopy hardening violation: [ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)! [ 5.382796] kernel BUG at mm/usercopy.c:102! [ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7 [ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80 [ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490 [ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246 [ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74 [ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0 [ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74 [ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001 [ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00 [ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000 [ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0 [ 5.384903] PKRU: 55555554 [ 5.384903] Call Trace: [ 5.384903] [ 5.384903] __check_heap_object+0x9a/0xd0 [ 5.384903] __check_object_size+0x46c/0x690 [ 5.384903] put_cmsg+0x129/0x5e0 [ 5.384903] sock_recv_errqueue+0x22f/0x380 [ 5.384903] tls_sw_recvmsg+0x7ed/0x1960 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? schedule+0x6d/0x270 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? mutex_unlock+0x81/0xd0 [ 5.384903] ? __pfx_mutex_unlock+0x10/0x10 [ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10 [ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0 [ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 The crash offset 296 corresponds to skb2->cb within skbuff_fclones: - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 - offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 = 272 + 24 (inside sock_exterr_skb.ee) This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure. [1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885 [2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104 [3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566 [4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491 [5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-489 Active Debug Code

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-23025

In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0 CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT 8cc09ef94dcec767faa911515ce9e609c45db470 Call Trace: __dump_stack (lib/dump_stack.c:95) dump_stack_lvl (lib/dump_stack.c:123) dump_stack (lib/dump_stack.c:130) spin_dump (kernel/locking/spinlock_debug.c:71) do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?) _raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138) __free_frozen_pages (mm/page_alloc.c:2973) ___free_pages (mm/page_alloc.c:5295) __free_pages (mm/page_alloc.c:5334) tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290) ? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289) ? rcu_core (kernel/rcu/tree.c:?) rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861) rcu_core_si (kernel/rcu/tree.c:2879) handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623) __irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725) irq_exit_rcu (kernel/softirq.c:741) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052) RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) free_pcppages_bulk (mm/page_alloc.c:1494) drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632) __drain_all_pages (mm/page_alloc.c:2731) drain_all_pages (mm/page_alloc.c:2747) kcompactd (mm/compaction.c:3115) kthread (kernel/kthread.c:465) ? __cfi_kcompactd (mm/compaction.c:3166) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork (arch/x86/kernel/process.c:164) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) Matthew has analyzed the report and identified that in drain_page_zone() we are in a section protected by spin_lock(&pcp->lock) and then get an interrupt that attempts spin_trylock() on the same lock. The code is designed to work this way without disabling IRQs and occasionally fail the trylock with a fallback. However, the SMP=n spinlock implementation assumes spin_trylock() will always succeed, and thus it's normally a no-op. Here the enabled lock debugging catches the problem, but otherwise it could cause a corruption of the pcp structure. The problem has been introduced by commit 574907741599 ("mm/page_alloc: leave IRQs enabled for per-cpu page allocations"). The pcp locking scheme recognizes the need for disabling IRQs to prevent nesting spin_trylock() sections on SMP=n, but the need to prevent the nesting in spin_lock() has not been recognized. Fix it by introducing local wrappers that change the spin_lock() to spin_lock_iqsave() with SMP=n and use them in all places that do spin_lock(&pcp->lock). [vbabka@suse.cz: add pcp_ prefix to the spin_lock_irqsave wrappers, per Steven]

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-23026

In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() Fix a memory leak in gpi_peripheral_config() where the original memory pointed to by gchan->config could be lost if krealloc() fails. The issue occurs when: 1. gchan->config points to previously allocated memory 2. krealloc() fails and returns NULL 3. The function directly assigns NULL to gchan->config, losing the reference to the original memory 4. The original memory becomes unreachable and cannot be freed Fix this by using a temporary variable to hold the krealloc() result and only updating gchan->config when the allocation succeeds. Found via static analysis and code review.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-23030

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() The for_each_available_child_of_node() calls of_node_put() to release child_np in each success loop. After breaking from the loop with the child_np has been released, the code will jump to the put_child label and will call the of_node_put() again if the devm_request_threaded_irq() fails. These cause a double free bug. Fix by returning directly to avoid the duplicate of_node_put().

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-23031

In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak In gs_can_open(), the URBs for USB-in transfers are allocated, added to the parent->rx_submitted anchor and submitted. In the complete callback gs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In gs_can_close() the URBs are freed by calling usb_kill_anchored_urbs(parent->rx_submitted). However, this does not take into account that the USB framework unanchors the URB before the complete function is called. This means that once an in-URB has been completed, it is no longer anchored and is ultimately not released in gs_can_close(). Fix the memory leak by anchoring the URB in the gs_usb_receive_bulk_callback() to the parent->rx_submitted anchor.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-23032

In the Linux kernel, the following vulnerability has been resolved: null_blk: fix kmemleak by releasing references to fault configfs items When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk driver sets up fault injection support by creating the timeout_inject, requeue_inject, and init_hctx_fault_inject configfs items as children of the top-level nullbX configfs group. However, when the nullbX device is removed, the references taken to these fault-config configfs items are not released. As a result, kmemleak reports a memory leak, for example: unreferenced object 0xc00000021ff25c40 (size 32): comm "mkdir", pid 10665, jiffies 4322121578 hex dump (first 32 bytes): 69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f init_hctx_fault_ 69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00 inject.......... backtrace (crc 1a018c86): __kmalloc_node_track_caller_noprof+0x494/0xbd8 kvasprintf+0x74/0xf4 config_item_set_name+0xf0/0x104 config_group_init_type_name+0x48/0xfc fault_config_init+0x48/0xf0 0xc0080000180559e4 configfs_mkdir+0x304/0x814 vfs_mkdir+0x49c/0x604 do_mkdirat+0x314/0x3d0 sys_mkdir+0xa0/0xd8 system_call_exception+0x1b0/0x4f0 system_call_vectored_common+0x15c/0x2ec Fix this by explicitly releasing the references to the fault-config configfs items when dropping the reference to the top-level nullbX configfs group.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-23033

In the Linux kernel, the following vulnerability has been resolved: dmaengine: omap-dma: fix dma_pool resource leak in error paths The dma_pool created by dma_pool_create() is not destroyed when dma_async_device_register() or of_dma_controller_register() fails, causing a resource leak in the probe error paths. Add dma_pool_destroy() in both error paths to properly release the allocated dma_pool resource.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-23037

In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: allow partial RX URB allocation to succeed When es58x_alloc_rx_urbs() fails to allocate the requested number of URBs but succeeds in allocating some, it returns an error code. This causes es58x_open() to return early, skipping the cleanup label 'free_urbs', which leads to the anchored URBs being leaked. As pointed out by maintainer Vincent Mailhol, the driver is designed to handle partial URB allocation gracefully. Therefore, partial allocation should not be treated as a fatal error. Modify es58x_alloc_rx_urbs() to return 0 if at least one URB has been allocated, restoring the intended behavior and preventing the leak in es58x_open().

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-23038

In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails, the function jumps to the out_scratch label without freeing the already allocated dsaddrs list, leading to a memory leak. Fix this by jumping to the out_err_drain_dsaddrs label, which properly frees the dsaddrs list before cleaning up other resources.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-23111

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically required. nft_map_catchall_activate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that are already active (they don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite: it skips inactive elements and processes active ones. Compare the non-catchall activate callback, which is correct: nft_mapelem_activate(): if (nft_set_elem_active(ext, iter->genmask)) return 0; /* skip active, process inactive */ With the buggy catchall version: nft_map_catchall_activate(): if (!nft_set_elem_active(ext, genmask)) continue; /* skip inactive, process active */ The consequence is that when a DELSET operation is aborted, nft_setelem_data_activate() is never called for the catchall element. For NFT_GOTO verdict elements, this means nft_data_hold() is never called to restore the chain->use reference count. Each abort cycle permanently decrements chain->use. Once chain->use reaches zero, DELCHAIN succeeds and frees the chain while catchall verdict elements still reference it, resulting in a use-after-free. This is exploitable for local privilege escalation from an unprivileged user via user namespaces + nftables on distributions that enable CONFIG_USER_NS and CONFIG_NF_TABLES. Fix by removing the negation so the check matches nft_mapelem_activate(): skip active elements, process inactive ones.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-23112

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2026-23220

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths The problem occurs when a signed request fails smb2 signature verification check. In __process_request(), if check_sign_req() returns an error, set_smb2_rsp_status(work, STATUS_ACCESS_DENIED) is called. set_smb2_rsp_status() set work->next_smb2_rcv_hdr_off as zero. By resetting next_smb2_rcv_hdr_off to zero, the pointer to the next command in the chain is lost. Consequently, is_chained_smb2_message() continues to point to the same request header instead of advancing. If the header's NextCommand field is non-zero, the function returns true, causing __handle_ksmbd_work() to repeatedly process the same failed request in an infinite loop. This results in the kernel log being flooded with "bad smb2 signature" messages and high CPU usage. This patch fixes the issue by changing the return value from SERVER_HANDLER_CONTINUE to SERVER_HANDLER_ABORT. This ensures that the processing loop terminates immediately rather than attempting to continue from an invalidated offset.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-23222

In the Linux kernel, the following vulnerability has been resolved: crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly The existing allocation of scatterlists in omap_crypto_copy_sg_lists() was allocating an array of scatterlist pointers, not scatterlist objects, resulting in a 4x too small allocation. Use sizeof(*new_sg) to get the correct object size.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-23228

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter. Replace free_transport() with ksmbd_tcp_disconnect().

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-23229

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add spinlock protection with virtqueue notification When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32 openssl processes will hangup and there is error reported like this: virtio_crypto virtio0: dataq.0:id 3 is not a head! It seems that the data virtqueue need protection when it is handled for virtio done notification. If the spinlock protection is added in virtcrypto_done_task(), openssl benchmark with multiple processes works well.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-820 Missing Synchronization

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-23230

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lease=1, on_list=1) CPU2: clear both flags (store 0) CPU1: RMW store (old | IS_OPEN) -> reintroduces cleared bits To avoid this class of races, convert these flags to separate bool fields.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-23231

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_register_hook() then fails, the error path calls nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy() with no RCU grace period in between. This creates two use-after-free conditions: 1) Control-plane: nf_tables_dump_chains() traverses table->chains under rcu_read_lock(). A concurrent dump can still be walking the chain when the error path frees it. 2) Packet path: for NFPROTO_INET, nf_register_net_hook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nft_do_chain() via the transient IPv4 hook can still be dereferencing chain->blob_gen_X when the error path frees the chain. Add synchronize_rcu() between nft_chain_del() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2026-23236

In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx: properly copy ioctl memory to kernelspace The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from userspace to kernelspace, and instead directly references the memory, which can cause problems if invalid data is passed from userspace. Fix this all up by correctly copying the memory before accessing it within the kernel.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.3 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

CVE-2026-23238

In the Linux kernel, the following vulnerability has been resolved: romfs: check sb_set_blocksize() return value romfs_fill_super() ignores the return value of sb_set_blocksize(), which can fail if the requested block size is incompatible with the block device's configuration. This can be triggered by setting a loop device's block size larger than PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs filesystem on that device. When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the device has logical_block_size=32768, bdev_validate_blocksize() fails because the requested size is smaller than the device's logical block size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and continues mounting. The superblock's block size remains at the device's logical block size (32768). Later, when sb_bread() attempts I/O with this oversized block size, it triggers a kernel BUG in folio_set_bh(): kernel BUG at fs/buffer.c:1582! BUG_ON(size > PAGE_SIZE); Fix by checking the return value of sb_set_blocksize() and failing the mount with -EINVAL if it returns 0.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-20 Improper Input Validation

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2026-24515

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-476 NULL Pointer Dereference

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 2.9 LOW CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2026-25210

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-190 Integer Overflow or Wraparound

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.9 MEDIUM CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CVE-2026-26157

A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives that when extracted, and under specific conditions, may write to files outside the intended directory. This can lead to arbitrary file overwrite, potentially enabling code execution through the modification of sensitive system files.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-73 External Control of File Name or Path

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-26158

A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting a malicious tar archive containing unvalidated hardlink or symlink entries. If the tar archive is extracted with elevated privileges, this flaw can lead to privilege escalation, enabling an attacker to gain unauthorized access to critical system files.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-73 External Control of File Name or Path

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7 HIGH CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-35535

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-271 Privilege Dropping / Lowering Errors

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.4 HIGH CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2026-41918

The affected applications stores sensitive information in the browser cache when an authenticated user modify specific configurations. This could allow an authenticated attacker to access sensitive data stored in the browser.

View CVE Details

Affected Products

Siemens SINEC OS
Vendor:
Siemens
Product Version:
RUGGEDCOM RST2428P (6GK6242-6PA00)
Product Status:
known_affected
Remediations

Vendor fix
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/

Relevant CWE: CWE-525 Use of Web Browser Cache Containing Sensitive Information

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.7 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Acknowledgments

  • Siemens ProductCERT reported these vulnerabilities to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-253495 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-06-02
Date Revision Summary
2026-06-02 1 Publication Date
2026-07-07 2 Initial CISA Republication of Siemens ProductCERT SSA-253495 advisory

Legal Notice and Terms of Use

]]> <![CDATA[Hydro-QuĂ©bec Le Circuit Electrique charging station backend]]> https://tsecurity.de/de/3652270/it-security-nachrichten/hydro-qubec-le-circuit-electrique-charging-station-backend/ https://tsecurity.de/de/3652270/it-security-nachrichten/hydro-qubec-le-circuit-electrique-charging-station-backend/ Tue, 07 Jul 2026 18:55:47 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could lead to privilege escalation, or result in a denial-of-service attack.

The following versions of Hydro-Québec Le Circuit Electrique charging station backend are affected:

  • Le Circuit Electrique charging station backend
CVSS Vendor Equipment Vulnerabilities
v3 9.8 Hydro-Québec Hydro-Québec Le Circuit Electrique charging station backend Improper Access Control, Improper Restriction of Excessive Authentication Attempts, Insufficient Session Expiration

Background

  • Critical Infrastructure Sectors: Transportation Systems
  • Countries/Areas Deployed: Canada
  • Company Headquarters Location: Canada

Vulnerabilities

Expand All +

CVE-2026-20744

The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

View CVE Details

Affected Products

Hydro-Québec Le Circuit Electrique charging station backend
Vendor:
Hydro-Québec
Product Version:
Hydro-Québec Le Circuit Electrique charging station backend: <June_2026
Product Status:
known_affected
Remediations

Mitigation
Hydro-Québec has updated the majority of charging stations to disable OCPP, mitigating the risk of exploitation. Hydro-Québec has also implemented authentication systems to mitigate the issue for certain charging stations which are still reliant on OCPP. Contact Hydro-Québec with any additional questions.

Relevant CWE: CWE-284 Improper Access Control

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-42952

Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a Denial-of-Service attack.

View CVE Details

Affected Products

Hydro-Québec Le Circuit Electrique charging station backend
Vendor:
Hydro-Québec
Product Version:
Hydro-Québec Le Circuit Electrique charging station backend: <June_2026
Product Status:
known_affected
Remediations

Mitigation
Hydro-Québec has updated the majority of charging stations to disable OCPP, mitigating the risk of exploitation. Hydro-Québec has also implemented authentication systems to mitigate the issue for certain charging stations which are still reliant on OCPP. Contact Hydro-Québec with any additional questions.

Relevant CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVE-2026-44383

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.

View CVE Details

Affected Products

Hydro-Québec Le Circuit Electrique charging station backend
Vendor:
Hydro-Québec
Product Version:
Hydro-Québec Le Circuit Electrique charging station backend: <June_2026
Product Status:
known_affected
Remediations

Mitigation
Hydro-Québec has updated the majority of charging stations to disable OCPP, mitigating the risk of exploitation. Hydro-Québec has also implemented authentication systems to mitigate the issue for certain charging stations which are still reliant on OCPP. Contact Hydro-Québec with any additional questions.

Relevant CWE: CWE-613 Insufficient Session Expiration

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • An anonymous researcher reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-07
Date Revision Summary
2026-07-07 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Labcenter Proteus 9]]> https://tsecurity.de/de/3652269/it-security-nachrichten/labcenter-proteus-9/ https://tsecurity.de/de/3652269/it-security-nachrichten/labcenter-proteus-9/ Tue, 07 Jul 2026 18:55:46 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could disclose information and allow a malicious user to execute arbitrary code on affected installations.

The following versions of Labcenter Proteus 9 are affected:

  • Proteus 9.1_SP4_Build_42914
CVSS Vendor Equipment Vulnerabilities
v3 7.8 Labcenter Electronics Labcenter Proteus 9 Out-of-bounds Write, Stack-based Buffer Overflow, Use After Free

Background

  • Critical Infrastructure Sectors: Communications, Critical Manufacturing, Defense Industrial Base, Energy, Healthcare and Public Health, Transportation Systems, Water and Wastewater
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United Kingdom

Vulnerabilities

Expand All +

CVE-2026-42953

The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution.

View CVE Details

Affected Products

Labcenter Proteus 9
Vendor:
Labcenter Electronics
Product Version:
Labcenter Electronics Proteus: 9.1_SP4_Build_42914
Product Status:
known_affected
Remediations

Vendor fix
Labcenter recommends ensuring you are using the latest version (9.2 SPO) of the software. Version can be found by looking at the bottom left of the Proteus home page (Version 8 or higher) or by selecting the About ISIS or About ARES option from the Help menu. Update notifications appear in the new and information section of the home page where you can activate the download and installation directly.

Mitigation
If you have questions or need help please contact Labcenter or your local distributor.

Relevant CWE: CWE-787 Out-of-bounds Write

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 8.4 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-49033

The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code.

View CVE Details

Affected Products

Labcenter Proteus 9
Vendor:
Labcenter Electronics
Product Version:
Labcenter Electronics Proteus: 9.1_SP4_Build_42914
Product Status:
known_affected
Remediations

Vendor fix
Labcenter recommends ensuring you are using the latest version (9.2 SPO) of the software. Version can be found by looking at the bottom left of the Proteus home page (Version 8 or higher) or by selecting the About ISIS or About ARES option from the Help menu. Update notifications appear in the new and information section of the home page where you can activate the download and installation directly.

Mitigation
If you have questions or need help please contact Labcenter or your local distributor.

Relevant CWE: CWE-121 Stack-based Buffer Overflow

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 8.4 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2026-42958

The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files. This could allow an attacker to execute arbitrary code in the context of the current process.

View CVE Details

Affected Products

Labcenter Proteus 9
Vendor:
Labcenter Electronics
Product Version:
Labcenter Electronics Proteus: 9.1_SP4_Build_42914
Product Status:
known_affected
Remediations

Vendor fix
Labcenter recommends ensuring you are using the latest version (9.2 SPO) of the software. Version can be found by looking at the bottom left of the Proteus home page (Version 8 or higher) or by selecting the About ISIS or About ARES option from the Help menu. Update notifications appear in the new and information section of the home page where you can activate the download and installation directly.

Mitigation
If you have questions or need help please contact Labcenter or your local distributor.

Relevant CWE: CWE-416 Use After Free

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 8.4 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Michael Heinzl reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

Revision History

  • Initial Release Date: 2026-07-07
Date Revision Summary
2026-07-07 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Hitachi Energy e-mesh EMS]]> https://tsecurity.de/de/3652268/it-security-nachrichten/hitachi-energy-e-mesh-ems/ https://tsecurity.de/de/3652268/it-security-nachrichten/hitachi-energy-e-mesh-ems/ Tue, 07 Jul 2026 18:55:45 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Hitachi Energy is aware of a buffer overflow vulnerability that affects e-mesh EMS product versions listed in this document. Successful exploitation of this vulnerability could lead to a buffer overflow condition, potentially resulting in application outages (denial of service) and possible arbitrary code execution. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

The following versions of Hitachi Energy e-mesh EMS are affected:

  • Hitachi Energy e-mesh EMS 4.1.6, 4.4.2, 4.7.0
CVSS Vendor Equipment Vulnerabilities
v3 8.1 Hitachi Energy Hitachi Energy e-mesh EMS Heap-based Buffer Overflow

Background

  • Critical Infrastructure Sectors: Energy
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Switzerland

Vulnerabilities

Expand All +

CVE-2026-42945

NGINX Plus and NGINX Open Source used in e-mesh EMS have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. e-mesh EMS versions using NGINX v1.30.0 and below are affected.

View CVE Details

Affected Products

Hitachi Energy e-mesh EMS
Vendor:
Hitachi Energy
Product Version:
e-mesh EMS versions 4.1.6, e-mesh EMS versions 4.4.2, e-mesh EMS versions 4.7.0
Product Status:
known_affected
Remediations

Vendor fix
Apply hotfix for respective e-mesh EMS versions to update NGINX to either v1.30.2 or latest

Mitigation
Ensure rewrite configuration does not contain "?" to replace unnamed captures, and ensure ASLR is set to active (value=2) across all deployment targets covering all 3 versions.

Mitigation
Underlying Ubuntu Server 20.04 LTS is End of Life. For e-mesh EMS versions 4.1.6/4.4.2 using Ubuntu 20.04 LTS, upgrade to Ubuntu Server 22.04, or 24.04, or activate Ubuntu Pro/ESM as an interim measure.

Relevant CWE: CWE-122 Heap-based Buffer Overflow

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Hitachi Energy Internal Team

Notice

The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.

Support

For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.

General Mitigation Factors

Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification. [1]

SSVC

SSVCv2/E:N/A:N/2026-06-29T17:00:59Z/

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000253 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-06-30
Date Revision Summary
2026-06-30 1 Initial public release
2026-07-07 2 Initial CISA Republication of Hitachi Energy PSIRT 8DBD000253 advisory

Legal Notice and Terms of Use

]]> <![CDATA[Digi International PortServer TS, Digi One SP IA]]> https://tsecurity.de/de/3652267/it-security-nachrichten/digi-international-portserver-ts-digi-one-sp-ia/ https://tsecurity.de/de/3652267/it-security-nachrichten/digi-international-portserver-ts-digi-one-sp-ia/ Tue, 07 Jul 2026 18:55:44 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and gain access to restricted resources, obtain credentials, and inject malicious scripts.

The following versions of Digi International PortServer TS, Digi One SP IA are affected:

  • PortServer TS
  • Digi One SP
  • Digi One SP IA
  • Digi One IA
CVSS Vendor Equipment Vulnerabilities
v3 5.9 Digi International Digi International PortServer TS, Digi One SP IA Incorrect Authorization, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Communications, Information Technology, Transportation Systems
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-12352

The vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device.

View CVE Details

Affected Products

Digi International PortServer TS, Digi One SP IA
Vendor:
Digi International
Product Version:
Digi International PortServer TS: <Firmware_2025, Digi International Digi One SP: <Firmware_2025, Digi International Digi One SP IA: <Firmware_2025, Digi International Digi One IA: <Firmware_2025
Product Status:
known_affected
Remediations

Mitigation
Digi International recommends users upgrade to Digi Connect EZ or Digi Connect EZ TS as a long term solution. If users are not able to upgrade at this time, the following actions should be taken:

Vendor fix
For Digi PortServer TS: Enable HTTPS on the web server.

Mitigation
Alternatively, disable the web server when it is not actively being used for configuration.

Mitigation
Compensating control: If you cannot apply the HTTPS configuration, restrict access via firewall or VPN.

Vendor fix
For Digi One SP / Digi One SP IA / Digi One IA: Disable the web server. If you cannot apply the HTTPS configuration, restrict access via firewall or VPN.

Mitigation
The following deployment practices are the recommended means of reducing exposure: Deploy the device on a trusted network segment, not exposed to untrusted or public networks.

Mitigation
Place the device behind a firewall or VPN and restrict access to the web management interface to trusted administrative hosts only.

Mitigation
Safeguard administrator credentials, since exploitation requires authenticated administrator access to write the affected fields.

Mitigation
For assistance users should contact Digi International's support team https://www.digi.com/support.
https://www.digi.com/support

Relevant CWE: CWE-863 Incorrect Authorization

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 8.2 HIGH CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVE-2026-12948

A stored cross-site scripting (XSS) vulnerability in the web management interface of the Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA allows a remote, authenticated administrator to inject script into certain system configuration fields. The script subsequently executes in the browser of a user who views the affected pages.

View CVE Details

Affected Products

Digi International PortServer TS, Digi One SP IA
Vendor:
Digi International
Product Version:
Digi International PortServer TS: <Firmware_2025, Digi International Digi One SP: <Firmware_2025, Digi International Digi One SP IA: <Firmware_2025, Digi International Digi One IA: <Firmware_2025
Product Status:
known_affected
Remediations

Mitigation
Digi International recommends users upgrade to Digi Connect EZ or Digi Connect EZ TS as a long term solution. If users are not able to upgrade at this time, the following actions should be taken:

Vendor fix
For Digi PortServer TS: Enable HTTPS on the web server.

Mitigation
Alternatively, disable the web server when it is not actively being used for configuration.

Mitigation
Compensating control: If you cannot apply the HTTPS configuration, restrict access via firewall or VPN.

Vendor fix
For Digi One SP / Digi One SP IA / Digi One IA: Disable the web server. If you cannot apply the HTTPS configuration, restrict access via firewall or VPN.

Mitigation
Digi International recommends users perform the following actions regarding XSS: Digi International will not provide a firmware fix for products affected by CVE-2026-12948, which are approaching end-of-life. Digi International recommends users upgrade to the Digi Connect EZ or Digi Connect EZ TS as a long-term solution.

Mitigation
The following deployment practices are the recommended means of reducing exposure: Deploy the device on a trusted network segment, not exposed to untrusted or public networks.

Mitigation
Place the device behind a firewall or VPN and restrict access to the web management interface to trusted administrative hosts only.

Mitigation
Safeguard administrator credentials, since exploitation requires authenticated administrator access to write the affected fields.

Mitigation
For assistance users should contact Digi International's support team https://www.digi.com/support.
https://www.digi.com/support

Relevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 3.8 LOW CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
4.0 4.8 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Acknowledgments

  • nviCloud reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-07
Date Revision Summary
2026-07-07 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Siemens Mendix Studio Pro]]> https://tsecurity.de/de/3652266/it-security-nachrichten/siemens-mendix-studio-pro/ https://tsecurity.de/de/3652266/it-security-nachrichten/siemens-mendix-studio-pro/ Tue, 07 Jul 2026 18:55:42 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Mendix Studio Pro versions before V11.12 are affected by a file parsing vulnerability that could be triggered when the application reads specially crafted malicious project during the build pipeline. This could allow an attacker to execute arbitrary code in the context of that user. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

The following versions of Siemens Mendix Studio Pro are affected:

  • Mendix Studio Pro 10.11 vers:all/*
  • Mendix Studio Pro 10.12 vers:all/* 
  • Mendix Studio Pro 10.13 vers:all/*
  • Mendix Studio Pro 10.14 vers:all/* 
  • Mendix Studio Pro 10.15 vers:all/* 
  • Mendix Studio Pro 10.16 vers:all/* 
  • Mendix Studio Pro 10.17 vers:all/* 
  • Mendix Studio Pro 10.18 vers:all/* 
  • Mendix Studio Pro 10.19 vers:all/* 
  • Mendix Studio Pro 10.20 vers:all/* 
  • Mendix Studio Pro 10.21 vers:all/* 
  • Mendix Studio Pro 10.22 vers:all/* 
  • Mendix Studio Pro 10.23 vers:all/* 
  • Mendix Studio Pro 10.24 vers:intdot/<10.24.21
  • Mendix Studio Pro 11.0 vers:all/* 
  • Mendix Studio Pro 11.1 vers:all/* 
  • Mendix Studio Pro 11.10 vers:all/* 
  • Mendix Studio Pro 11.11 vers:all/* 
  • Mendix Studio Pro 11.2 vers:all/* 
  • Mendix Studio Pro 11.3 vers:all/* 
  • Mendix Studio Pro 11.4 vers:all/* 
  • Mendix Studio Pro 11.5 vers:all/* 
  • Mendix Studio Pro 11.6 vers:intdot/<11.6.7 
  • Mendix Studio Pro 11.7 vers:all/* 
  • Mendix Studio Pro 11.8 vers:all/*
  • Mendix Studio Pro 11.9 vers:all/* 
CVSS Vendor Equipment Vulnerabilities
v3 5.4 Siemens Siemens Mendix Studio Pro Improper Control of Generation of Code ('Code Injection')

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Energy
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

Expand All +

CVE-2026-48192

Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline. This could allow an attacker who tricks a user into opening and running a specially crafted malicious project locally on their system to execute arbitrary code in the context of that user.

View CVE Details

Affected Products

Siemens Mendix Studio Pro
Vendor:
Siemens
Product Version:
Mendix Studio Pro 10.11, Mendix Studio Pro 10.12, Mendix Studio Pro 10.13, Mendix Studio Pro 10.14, Mendix Studio Pro 10.15, Mendix Studio Pro 10.16, Mendix Studio Pro 10.17, Mendix Studio Pro 10.18, Mendix Studio Pro 10.19, Mendix Studio Pro 10.20, Mendix Studio Pro 10.21, Mendix Studio Pro 10.22, Mendix Studio Pro 10.23, Mendix Studio Pro 10.24 < V10.24.21, Mendix Studio Pro 11.0, Mendix Studio Pro 11.1, Mendix Studio Pro 11.10, Mendix Studio Pro 11.11, Mendix Studio Pro 11.2, Mendix Studio Pro 11.3, Mendix Studio Pro 11.4, Mendix Studio Pro 11.5, Mendix Studio Pro 11.6 < V11.6.7, Mendix Studio Pro 11.7, Mendix Studio Pro 11.8, Mendix Studio Pro 11.9
Product Status:
known_affected
Remediations

No fix planned
Currently no fix is planned

Vendor fix
Update to V10.24.21 or later version
https://docs.mendix.com/releasenotes/studio-pro/10.24/

Vendor fix
Update to V11.6.7 or later version
https://docs.mendix.com/releasenotes/studio-pro/11.6/

Relevant CWE: CWE-94 Improper Control of Generation of Code ('Code Injection')

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N

Acknowledgments

  • Siemens ProductCERT reported this vulnerability to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-779310 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-06-30
Date Revision Summary
2026-06-30 1 Publication Date
2026-07-07 2 Initial CISA Republication of Siemens ProductCERT SSA-779310 advisory

Legal Notice and Terms of Use

]]> <![CDATA[DynaMiCS: Fine-Tuning LLMs with Performance Constraints Using Dynamic Mixtures]]> https://tsecurity.de/de/3651917/ai-nachrichten/dynamics-fine-tuning-llms-with-performance-constraints-using-dynamic-mixtures/ https://tsecurity.de/de/3651917/ai-nachrichten/dynamics-fine-tuning-llms-with-performance-constraints-using-dynamic-mixtures/ Tue, 07 Jul 2026 16:48:53 +0200 🔧 AI Nachrichten tsecurity.de <![CDATA[[$] Faster RCUs and lockless memory allocation]]> https://tsecurity.de/de/3651740/linux-tipps/faster-rcus-and-lockless-memory-allocation/ https://tsecurity.de/de/3651740/linux-tipps/faster-rcus-and-lockless-memory-allocation/ Tue, 07 Jul 2026 15:53:17 +0200 🐧 Linux Tipps tsecurity.de Puranjay Mohan shared some of the work he's been doing recently on improving the performance of read-copy-update (RCU) at the 2026 Linux Storage, Filesystem, Memory-Management, and BPF Summit; his talk would have been nice context to have earlier in the day when Harry Yoo and Alexei Starovoitov led a session about the new kmalloc_nolock() function that allows for lockless allocation from any kernel context, and which interacts with the RCU subsystem to allow that. This article therefore covers the two sessions together and in the reverse order, to provide that missing context.

]]> <![CDATA[Talk, talk, talk: The rise of AI dictation tools at work]]> https://tsecurity.de/de/3651342/it-nachrichten/talk-talk-talk-the-rise-of-ai-dictation-tools-at-work/ https://tsecurity.de/de/3651342/it-nachrichten/talk-talk-talk-the-rise-of-ai-dictation-tools-at-work/ Tue, 07 Jul 2026 13:32:41 +0200 📰 IT Nachrichten tsecurity.de

For workers who routinely spend hours a day interacting with various AI assistants, banging out prompts on a keyboard can quickly become a chore. 

“Whether it’s a coding task, helping write a document or think about strategy — there’s just so much typing and typing and typing you do as a part of that,” said Chris Patalano, chief technology officer at Thumbtack, an online marketplace for professional services.

With that in mind, Patalano and other senior colleagues last year began experimenting with new ways to interact with AI systems within Thumbtack. The idea was to test AI-assisted dictation tools developed by startups such as Monologue, Superwhisper, Willow Voice, and Wispr. 

Unlike previous generations of dictation apps that aimed to produce a verbatim transcript, newer tools rely on large language models (LLMs) to craft polished, edited text. The companies behind them claim users can produce text several times faster than typing, with greater accuracy than voice tools built into other apps.

That has sparked renewed interest in using voice prompts to carry out routine tasks in the workplace.

After one of Thumbtack’s principal engineers suggested Wispr Flow, Patalano kicked off a small pilot project with a handful of colleagues over a couple of months. The pilot was a success, and Wispr Flow is now available to more than 200 IT and engineering staffers; they use it for a variety of tasks, including interactions with AI assistants and drafting Slack messages to colleagues. 

Although Patalano said he still prefers typing for certain apps, Wispr Flow’s AI dictation tool has become a part of his daily workflow. “It’s becoming the primary interface that I have for any AI tools. It’s just so much more effective and efficient than having to type,” he said. 

“I’ve used it to help me build prototypes, explore the code base, help me explore my own technical strategy. I’ve used it to do analytics across data sets — even very specific acute things, like ‘What do I need to make sure is on my to-do list this week?’”

A new generation of dictation tools

Software that translates spoken words into text isn’t new to the workplace. Speech-to-text dictation tools have been around in various forms for decades. The earliest example dates back to 1952, when Bell Labs created Audrey, widely regarded as the first automatic speech recognition system. (Audrey could recognize the spoken digits 0-9 with 90% accuracy when used by the machine’s developer, HK Davis.) 

Commercial products appeared in the 1980s, with broader adoption in the 1990s via software such as Dragon Dictate. These were specialized — and expensive — applications with limited functionality, appealing mostly to professionals for whom dictation was already a part of their workflow, such as doctors and lawyers, rather than a wide range of office workers. 

In recent years, speech-to-text software has become more accessible, especially  with the integration of speech recognition into smartphones and computers by Apple, Google, Microsoft, and others. Deep learning has also significantly improved accuracy.

That’s made voice input more common in the workplace and an important accessibility tool for people who find typing difficult — even though the systems can still be “quite brittle,” said Benjamin Cowan, professor at the School of Information and Communication Studies at University College Dublin. That’s especially true of early voice input technology.

“Not only did they get things wrong all the time, they wrote everything you said — even if you didn’t want it to,” he said. “This meant that a lot of time was taken editing the notes after they were dictated.” 

Now, several startups offering AI dictation tools, including Wispr, aim to make voice a viable alternative to typing for everyday computer tasks. The key difference from earlier iterations of tools is the use of AI models to edit text in near-real-time, removing disfluencies such as “umms,” “ahhs” and filler words to create a polished sentence. 

Whispr Flow snippets

Whispr Flow offers shortcuts, or “snippets” with its voice tool.

Whispr Flow snippets

In most cases, users can invoke an AI dictation tool across mobile and desktop applications with a text field – whether that’s a document editor, email client, a vibe-coding app or anything else – by pressing and holding a designated key or button while talking. Users can add words to the app’s dictionary so it can pick up on uncommon names, abbreviations, and industry jargon.

“The technology itself has improved dramatically” compared to previous tools that sought to transcribe speech verbatim and could be frustratingly inaccurate, said Maria Bell, senior research analyst at CCS Insight.  

“These modern systems are much more contextual; they understand your intent, they can help structure your thoughts and rewrite while you speak. They function more like writing assistants rather than just dictation.”

Wispr is among the best-funded startups in the market, having raised $81 million to date. Bloomberg reported in May that the company was in talks to raise a further $260 million at a $2 billion valuation. Other vendors have also attracted investor backing, with Willow Voice announcing a $4.2 million funding round last year.

The software is typically available via a freemium model, with a free tier offering basic functionality and usage limits alongside paid premium versions. Superwhisper Pro is $8.49 per user each month; Willow Voice’s Team Pro and Individual Pro are $10 and $12 per user each month, respectively; and Wispr Flow Pro costs $12 per user each month. Enterprise pricing is not publicly available from these vendors.

Larger tech firms have also invested in AI-assisted voice functionality. Apple, for instance, recently announced AI-powered dictation for its revamped Siri AI assistant, while Google is building in similar functionality for the Gboard keyboard on Android devices. Google is also developing a standalone AI dictation tool – Edge Eloquent – although its approach differs from that of startups in the space because the tool is not available across separate applications.

Why use AI dictation?

The key promise of AI dictation is that it can increase a knowledge worker’s words-per-minute (wpm) output versus typing. 

According to Superwhisper, most office workers can knock out between 40 and 70 words a minute on a  keyboard, though some can be much faster. (New York Times reporters vary from 36 to 134 wpm, according to a Times article earlier this year.) People talk much faster, at a rate of 160 to 180 wpm, and AI dictation app vendors promise low latency processing to turn speech into edited text (usually less than a second; some claim under 200 milliseconds).

It’s not just about speed: Willow Voice, for instance, claims its app is three times more accurate than dictation tools built into other applications. 

The prospect of accelerating routine writing and communication tasks has obvious appeal, particularly as AI threatens to increase rather than reduce the burden on office workers. “We all feel like we’re working faster – we have to do more with less time,” said Bell. 

“Employees are overloaded with communication work, and they’re spending huge amounts of time every day writing emails, messaging colleagues, using generative AI,” she said. “Voice tools are appealing because some feel they can do wor] faster. It reduces friction around all the tasks they’re being asked to do.”

The technology is potentially suited to a variety of jobs, said Cowan — not only those that require dictation — helping with tasks such as writing to-do lists and documents, or sending messages and emails. 

Accessibility is important, too. “These dictation tools also mean that people who find it hard to type or cannot type now have much better apps to help them with writing,” said Cowan. 

What’s holding the technology back?

Despite these potential benefits, the idea of talking to a laptop or smartphone throughout the day might not be appealing for a lot of people, particularly those in a busy office. 

“Some might find it embarrassing or uncomfortable, they’ll be worried about distracting colleagues or creating a disruption,” said Bell. “That’s still a major behavioral barrier that you have to overcome. 

“The technology is ready, but maybe workplace etiquette and culture is not necessarily there yet,” she said.

Working remotely, Patalano said he and his team can side-step some of this awkwardness. But it still took time to adjust to voice inputs. 

“Because we’re fully remote, we don’t have the challenge of everybody sitting side by side in an office talking into their computers, which would be more challenging, I suspect. But even getting comfortable with talking out loud alone in a room took a minute,” he said. 

As with any AI tool, there’s also the question of accuracy. 

Even if vendors promise a low error rate, LLM outputs can still have errors, requiring users to check the results. “They can still mis-recognize what’s being said,” said Cowan. Those in high-risk sectors such as healthcare still need to go through the AI-edited text and “double- and triple-check” the dictation. 

This friction means extra steps for a user working with the technology. 

It doesn’t take much to dissuade workers from adopting a new tool, said Jon Arnold, research analyst at J Arnold & Associates. “There’s definitely a lot of use cases where it would have a lot of value, but you’ve got to trust it — if it’s not giving what you think it will, you’re either going to fine tune it or go back to the keyboard and do it the old-fashioned way,” he said.

There are also privacy concerns. Because some tools send voice data to the cloud for processing, organizations in heavily regulated industries such as finance, healthcare and government might move cautiously.

Bell points to two types of privacy: social, such as “having colleagues overhear what you’re saying,” and digital privacy, which relates to who else can access the conversation data. 

App providers take different approaches; some process voice data on device, others send it to the cloud. That’s an important distinction for organizations with strict data protection requirements, said Bell. 

“Where’s the voice data processed? Where is it stored? How can it be accessed? Enterprises are very, very focused on governance and data security and data privacy,” she said.

Rusty keyboard on the ground
Evan Yang

Too soon to ditch the keyboard?

Despite growing interest in the technology, it’s still unclear whether a large number of workers will choose talking over typing. And remains to be seen whether startups that offer a best-of-breed AI dictation app can gain traction, or fade if the technology simply becomes embedded within the software ecosystems of larger tech firms.  

Workers are more familiar with voice technology, thanks to AI assistants in smartphones and smart speakers at home. That, said Bell, could improve the prospects of wider use in business settings. 

“Voice interaction feels less niche than it did about five years ago,” she said. “Overall, the technology is improving quickly
, but how we’re really going to determine success is whether we can change human behavior.”

Arnold is bullish about the use of voice technology in the workplace: “Five or 10 years [from now], we won’t think twice about it. It’ll just be the norm.”

Bell is more cautious.She sees potential for AI dictation as a supplementary tool for communication-heavy work. “I don’t think it’s going to replace the keyboard, but I do think it could become a secondary interface,” she said.

Even Patalano doesn’t expect AI-assisted voice dictation to entirely replace typing “Your speaking voice and your written voice will always, to some degree, be different, and that’s okay: we should probably lean into that,” he said.

“I think there will always be a place for wordsmithing, crafting, writing – and the same with coding, too. There’s going to be lots of cases where every single word matters.”

He plans to continue using AI dictation, whether with Wispr Flow or other similar tools that might emerge in the future.  

While a lack of accuracy slowed adoption in the past, continued advances could open the door to wider workplace uptake.  

“When I try to use a voice tool and it misses even once, you kind of throw up your hands and walk away, because the cost of having to correct it is way more than the benefit of using it versus typing,” Patalano said. “But, especially with the improvements in LLMs and AI models generally, the accuracy of these is going to keep getting better and better. 

“I’m already looking for more and more opportunities to use voice instead of having to type.” 

]]> <![CDATA[Why Is a Cybersecurity Policy Important?]]> https://tsecurity.de/de/3651104/it-security-nachrichten/why-is-a-cybersecurity-policy-important/ https://tsecurity.de/de/3651104/it-security-nachrichten/why-is-a-cybersecurity-policy-important/ Tue, 07 Jul 2026 12:08:35 +0200 📰 IT Security Nachrichten tsecurity.de Cybersecurity Policy

A cybersecurity policy is important because it defines how an organisation protects its systems, data and users from cyber threats. It establishes clear security rules, assigns responsibilities, supports regulatory compliance and helps employees make safer security decisions. A well-designed cybersecurity policy also strengthens cyber resilience by reducing risk and improving consistency across the organisation.

]]> <![CDATA[Why trusted context is becoming the currency for enterprise AI]]> https://tsecurity.de/de/3650969/ai-nachrichten/why-trusted-context-is-becoming-the-currency-for-enterprise-ai/ https://tsecurity.de/de/3650969/ai-nachrichten/why-trusted-context-is-becoming-the-currency-for-enterprise-ai/ Tue, 07 Jul 2026 11:04:23 +0200 🔧 AI Nachrichten tsecurity.de

AI is getting most of the attention in enterprise technology. Governance, ownership, and data quality do most of the heavy lifting behind the scenes. And yet, as organizations move from AI experiments to production deployments, trusted context is becoming a key factor in determining whether agents create business value — or operational risk.

That shift is reshaping how Salesforce, Microsoft, Snowflake, Databricks, SAP, Oracle, and others are positioning their data, governance, metadata, and integration services. The conversation is no longer just about models. It’s about whether AI systems can operate against trusted, governed, and business-relevant information.

Trusted context has become the new currency, and Salesforce has made a strategic commitment to it.

Agentic AI is exposing the problems master data management was designed to solve

Master data management (MDM) spent much of the last decade as an important but often overlooked infrastructure. AI is changing that. Agentic systems can identify duplicate records, inconsistent definitions, fragmented ownership, and poor governance the moment AI begins interacting with enterprise data and processes.

I recently wrote about Salesforce’s State of Data and Analytics research, which found that 84% of data leaders believe their organizations need significant changes to their data strategies before AI can succeed at scale. That finding shows what many enterprises are now experiencing. AI often exposes data and governance issues that have existed for years.

Manouj Tahiliani, senior vice president for MDM at Informatica, now part of Salesforce, said, “Trusted context is becoming the new currency in enterprise AI.” His argument is that trusted context is the connected, governed view of customers, products, and suppliers that lets an agent act like a tenured employee. Models and agents will commoditize. Differentiation comes from how well an agent understands the enterprise, which depends on the data underneath. AI is not a model problem. It is a data foundation problem with an agent interface bolted on top.

Salesforce is expanding its definition of the data layer

Salesforce completed its acquisition of Informatica in November 2025. The acquisition strengthens Salesforce’s position around data quality, governance, metadata, lineage, and MDM. It also reflects the market reality. Every major enterprise platform provider is trying to create a trusted layer that connects operational systems, business context, and AI.

Marc Benioff, CEO of Salesforce, summarized the rationale when the deal closed. Organizations need trusted, connected, and governed data before they can expect meaningful outcomes from AI. While that statement may sound obvious, it reflects one of the biggest challenges organizations continue to face as AI moves into production.

The combined strategy brings together Tableau for analytics, MuleSoft for integration and Agent Fabric, Data 360 (formerly Data Cloud) for data unification, and Informatica for governance, quality, stewardship, and MDM. The goal is not simply data consolidation. The goal is creating a consistent layer of business context that can be used across applications, workflows, and AI systems.

Salesforce is not alone. Microsoft, for example, is building around Fabric, OneLake, Purview, and Fabric IQ. Snowflake continues expanding governance, semantic, and catalog capabilities. Databricks is advancing Unity Catalog and its broader Data Intelligence Platform strategy. SAP and Oracle are pursuing similar objectives through business applications and industry-specific data models. The competitive landscape is increasingly shifting from data storage and analytics toward trusted context, governance, and operational execution.

Early adoption metrics suggest the strategy is gaining traction, although long-term success will be measured by customer outcomes, implementation timelines, and operational value. Data 360 has grown within Salesforce, Agentforce adoption continues to expand, and deeper integration between Informatica, Data 360, and Agent Fabric is expected throughout 2026.

Informatica extends governance into the agent era

The Intelligent Data Management Cloud (IDMC) remains the foundation underneath Informatica’s data management strategy. It provides metadata-aware connectivity, governance, stewardship, matching, merging, and master data capabilities across applications, databases, files, and streaming sources.

For most enterprises, the number of connectors is less important than whether governance, ownership, quality, and lineage remain consistent across systems. Connectivity alone rarely solves data problems. Operational discipline does.

What is changing is how those capabilities are being exposed to AI systems. Salesforce and Informatica are positioning governance and data management services as capabilities that agents can access directly through Model Context Protocol and related interfaces. The value is not the protocol itself. The value is allowing AI systems to interact with governed enterprise information while maintaining lineage, governance, ownership, and security controls.

Headless data management is also becoming more important. Organizations want agents, applications, and workflows to access trusted services without custom integrations for every use case. If executed effectively, that approach could simplify how AI systems consume enterprise data while preserving governance standards.

Why many data programs continue to struggle

Industry research has consistently shown that many MDM initiatives struggle to achieve their original business objectives. Governance arrives too late. Executive sponsorship is weak. Ownership remains unclear. Business units maintain competing definitions. Technology is expected to solve organizational problems.

One of the recurring issues I see across enterprises is that technology decisions often move faster than governance models. Organizations frequently deploy tools before establishing ownership, stewardship, and accountability. AI tends to expose those gaps very quickly.

The challenge becomes more complicated as enterprises deploy agents across ERP, CRM, finance, supply chain, and operational systems simultaneously. Visibility, accountability, and governance become increasingly important as AI systems move beyond recommendations and begin to influence business processes.

This is where Informatica’s Agent Fabric Context Catalog becomes relevant. The concept is less about cataloging technology and more about providing visibility into how agents are deployed, governed, monitored, and controlled.

Tahiliani offered advice that aligns with what I often tell clients. Start with business priorities. Translate those priorities into a data strategy. Then select the architecture and technology required to support it. Many organizations still approach the process in reverse, struggling to generate business value.

The competitive landscape extends beyond traditional MDM

MDM is not a single-vendor market. Gartner’s 2026 Magic Quadrant leaders include Salesforce (Informatica), Profisee, Reltio, Semarchy, and Stibo Systems. Each vendor approaches the market differently. Profisee remains closely aligned with Microsoft environments. Reltio, which SAP acquired in May 2026, continues to differentiate through graph-oriented architecture and API-first design. Semarchy brings strengths where integration and MDM converge. Stibo maintains a strong position in product information management and retail-focused environments.

Informatica’s key strengths continue to be its broad capabilities, mature governance, and growing alignment with Salesforce. The larger question is execution. Enterprises will want evidence that implementation timelines, governance complexity, and time-to-value improve as the roadmap evolves.

Historically, Informatica implementations have required significant investment, governance discipline, and organizational commitment. Salesforce will need to demonstrate that the combined strategy can simplify adoption while maintaining the governance rigor many customers expect.

Yum Brands and TELUS show what trusted context looks like in practice

Yum Brands, the parent company of KFC, Pizza Hut, Taco Bell, and Habit Burger Grill, operates more than 63,000 restaurant locations globally. According to company leadership, significant effort was being spent consolidating and cleansing location data before it could be used effectively across the business. Informatica MDM became a central component of the company’s modernization effort.

TELUS represents a different use case. The Canadian telecommunications and health services provider uses Informatica MDM Cloud Edition and Customer 360 to improve customer visibility across the organization. Integrating acquisition data into a unified customer view enabled more effective measurement of marketing performance and improved opportunities for targeted cross-sell initiatives.

Neither example proves the broader strategy on its own. Both illustrate a pattern that continues to emerge across enterprise AI initiatives. Data management investments create value when they improve operational execution, decision-making, and business outcomes rather than simply improving data quality metrics.

The common theme is that trusted information is becoming a foundational requirement for organizations attempting to scale AI, analytics, and operational decision-making.

What Salesforce and enterprise buyers still need to prove

The questions that separate successful data programs from costly tech projects are straightforward. Is there clear ownership for each data domain? Is governance embedded from the beginning rather than added later? Can governance and data management services be consumed directly by AI systems? Can compliance, security, and operational controls scale alongside AI adoption?

These questions matter more than any individual AI feature announcement. For Salesforce, the next phase requires measurable proof points. Customer references are encouraging, but enterprises will want audited outcomes, implementation metrics, and long-term operational results. I believe that success in enterprise AI won’t come from having the best model. Instead, it will come from the team with the clearest, best-governed data to support their efforts. This reflects how ERP systems are evolving, not being replaced, with an emphasis on enhancing the core data rather than just updating the technology.

Salesforce has made a decisive commitment to making trusted context essential to enterprise AI, setting a high standard that all other vendors must meet. The proof will not be in the keynotes. It will be in the stores Yum can finally report on, the households TELUS can finally sell into, and the next 10 customer stories about successful AI integration.

—

Disclosure: KramerERP offers paid services to technology companies, similar to those provided by other technology research and analyst firms. These services include research, analysis, advisory services, consulting, benchmarking, acquisition matchmaking, video sponsorships, speaking sponsorships and other related activities. KramerERP has worked with, or is currently working with, companies mentioned in this article.

]]> <![CDATA[Five tips for developing data products]]> https://tsecurity.de/de/3650966/ai-nachrichten/five-tips-for-developing-data-products/ https://tsecurity.de/de/3650966/ai-nachrichten/five-tips-for-developing-data-products/ Tue, 07 Jul 2026 11:04:19 +0200 🔧 AI Nachrichten tsecurity.de

Data products help standardize how raw data sets, data warehouse views, and data lake logical views are combined and used to deliver analytics and AI capabilities. By developing data products, teams can streamline much of the upfront data pipelines, governance, and management needed to deliver trusted data assets that people, tools, and AI can then use for different purposes.

The way you cook a meal can serve as a helpful analogy. You can choose to purchase only raw ingredients like tomatoes, wheat flour, eggs, and fresh herbs to make a favorite pasta dish. The approach works well when you have the time and skills to cook from scratch or want to prepare a nice meal for a small family. Otherwise, you may want to buy canned tomatoes, your favorite box of pasta, and a spice mix to cook the same meal, especially if you are time-constrained, are cooking for many people, or want a consistent finished product.  

Like the not-from-scratch pasta meal, data products provide a similar level of time-saving effort, so that analytics and AI capabilities start with consistent, streamlined ingredients. Here are five questions teams should consider as they develop data products and their standards.

When to build a data product?

Most organizations can’t afford to develop data products as intermediaries for every data visualization, machine learning model, or AI agent. There’s cost and time to develop data products, and once they’re deployed or “on the shelves,” their product managers must oversee their ongoing support and life-cycle management. So when should agile data teams develop data products, and how should they prioritize which ones are more important? One starting point is to consider data products built from a single data set and what it means to productize them.

“A data set should really become a data product when multiple teams start relying on it to make decisions or to power applications,” says Danielle Ben-Gera, vice president of engineering at Crunchbase. “Developing proper governance, clear ownership, versioning, and a managed life cycle for changes becomes important, or you’ll just be shipping fragile pipelines that break downstream work.”

A second consideration is treating the use of ungoverned data sets as a form of data debt. Establishing a data product can be a tactical approach to standardize usage and address risks.

“Organizations should build a data product when data sets are being used across teams without strong governance, well-defined processes, or clear ownership,” says Yaad Oren, managing director at SAP Labs US and global head of research and innovation at SAP. “When anchored in a unified data foundation, data products eliminate silos, create shared understanding, and establish secure, standardized access that enables teams to leverage the same assets with confidence.”

A third consideration is to apply manufacturing principles by building data products for defined customers, driving reuse, and creating efficiencies. Drafting the data product’s vision statement and qualifying its business value is particularly important when a data product requires combining multiple data sources. It raises the question of how standardization delivers efficiencies, improves quality, reduces data security risks, and provides other benefits.

Christopher Zangrilli, vice president of technology strategy at Vertex, says, “Leaders should ask whether the data will reduce cycle time, improve decision accuracy, or mitigate compliance risk as a lens on the business impact. When governance, change management for adoption, quality, and value measurement are embedded from the start, data products transform from experimental tools to strategic assets.”

Why define standards for data products?

The products at the grocery store have packaging with a detailed list of ingredients, an expiration date, and a price. Data governance leaders should also standardize how data products are defined, cataloged, and managed. 

“Any modern data product should answer four questions clearly: where the data originates, how it transforms across systems, who or what is consuming it, and what governance obligations apply at every step,” says Abhi Sharma, cofounder and CEO at Relyance AI. “Without that end-to-end context, teams are building features on top of data they don’t fully understand.”

Although food products publish their ingredients and label them for dietary restrictions, few document the sourcing of raw ingredients and the logistics of the path from farm to grocer. But when building data products, capturing data lineage may be required in regulated industries and is particularly important when standardizing data sources for AI applications. 

“Without lineage, teams operate blind, and governance becomes reactive cleanup,” says Carter Page, executive vice president of research and development at Astronomer. “When teams can see where data originated, how it was transformed, and every system that relies on it, updates become predictable, the right pipelines get tested, the target stakeholders are notified, and breaking changes are documented before they cause incidents.”

What is a data product’s life cycle?

Life-cycle management of an API, application, or AI model requires defining a release schedule for delivering improvements, fixes, and other required upgrades. Data product life-cycle management involves several similar disciplines. Ulf Viney, executive vice president of engineering, support, and operations at Precisely, says, “Life-cycle management must include versioning, testing, structured deployment, and stakeholder communication.”

One fundamental difference with data products is that their life-cycle management is closely linked to how their underlying data sets grow or undergo structural changes. Having a data product that works today but isn’t resilient to changes or doesn’t generate alerts when fixes are necessary can break downstream use cases and erode stakeholders’ and users’ trust in the data.     

“Managing data as a product means that data consumers can trust the data from the outset, which requires a sustainable and scalable governance framework that ensures data is easy to find, understand, and use,” says Bethany Sehon, senior director of enterprise data at Capital One. “By embedding observability, quality checks, and interoperability from day one, you can manage the full data life cycle from versioning and testing to measuring adoption and performance.”

Teams managing mission-critical, real-time data products that feed multiple downstream analytics and AI use cases should consider the following devops and data governance practices.

How to encourage adoption?

Unfortunately, building a data product doesn’t guarantee adoption. Think back to the challenges of getting code reuse, API adoption, or standardizing in-house-developed devops tools. These are all examples of intermediary products aimed at reducing developer toil and improving quality, yet many teams adopted “not-invented-here” postures and do-it-yourself practices rather than learning and adopting standards developed by other teams.

Data products face even greater challenges, especially when they aim to consolidate data silos or eliminate spreadsheets. Product managers overseeing data products must develop a change management program to grow adoption and gather feedback.

“A data product earns its place when it drives a real business decision and can be trusted at scale,” says Quais Taraki, CTO at EnterpriseDB. “Treat data products like software, with versioning, testing, and controlled releases, not one-off pipelines. That discipline securely delivers the right data to the right place and turns data into measurable value through adoption, speed, and risk reduction.”

Product managers can accelerate adoption by communicating how a data product aligns with the business’s AI strategy and culture transformation. For example, show how the data product improves AI literacy, democratizes AI through the right business use cases, or prepares the workforce to use AI agents.

How to measure business value?

The value delivered by a customer-facing product is often measured through revenue impact, usage metrics, and customer satisfaction (CSat). Internal, employee-facing products can be measured in terms of workflow efficiency, productivity improvement, and employee satisfaction (ESat). Data products are intermediaries, so quantifying their value can be more challenging.   

“Too many organizations still treat data products as technical outputs instead of strategic assets,” says Daniel Ziv, global vice president of AI and analytics at Verint. “Their true value becomes clear when assessing how uniquely the data is generated, how much measurable impact it can drive across decisions, and how you can safely extract insight while managing risk. When every organization has access to the same AI models, competitive advantage comes from your unique data and how quickly you turn it into action.”

Sunil Kalra, head of the Databricks center of excellence at LatentView Analytics, adds, “Value should be measured through adoption, usage, and outcomes such as faster insights, reduced manual work, and improved revenue or cost performance.”

A best practice is to use digital transformation velocity metrics such as time to data, time to decision, time to innovation, and time to value. As more organizations seek to deliver business value from AI agents, creating data products will be seen as a path to accelerate delivery, reuse data assets, reduce risks, and manage costs.

]]> <![CDATA[iOS 27 Introduces RAW 9 for Sharper and Cleaner RAW Photos]]> https://tsecurity.de/de/3650639/ios-mac-os/ios-27-introduces-raw-9-for-sharper-and-cleaner-raw-photos/ https://tsecurity.de/de/3650639/ios-mac-os/ios-27-introduces-raw-9-for-sharper-and-cleaner-raw-photos/ Tue, 07 Jul 2026 08:11:37 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[iOS 27 Beta 3: Here Are All the New Features Apple Added]]> https://tsecurity.de/de/3650459/ios-mac-os/ios-27-beta-3-here-are-all-the-new-features-apple-added/ https://tsecurity.de/de/3650459/ios-mac-os/ios-27-beta-3-here-are-all-the-new-features-apple-added/ Tue, 07 Jul 2026 06:08:51 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[MacOS Golden Gate 27 Beta 3 Available to Download]]> https://tsecurity.de/de/3649691/ios-mac-os/macos-golden-gate-27-beta-3-available-to-download/ https://tsecurity.de/de/3649691/ios-mac-os/macos-golden-gate-27-beta-3-available-to-download/ Mon, 06 Jul 2026 21:09:39 +0200 🍏 iOS / Mac OS tsecurity.de The third beta version of MacOS Golden Gate 27 has been released to users enrolled in the developer beta testing program for Apple system software. MacOS 27 beta 3 carries build 26A5378j, and is available to download now through Software Update, a package installer, or IPSW. MacOS Golden Gate 27 has an emphasis on improving ... Read More

The post MacOS Golden Gate 27 Beta 3 Available to Download appeared first on OS X Daily.

]]> <![CDATA[visionOS 26.4 Developer Beta 4 Now Available: Features, Fixes, and More]]> https://tsecurity.de/de/3649690/ios-mac-os/visionos-264-developer-beta-4-now-available-features-fixes-and-more/ https://tsecurity.de/de/3649690/ios-mac-os/visionos-264-developer-beta-4-now-available-features-fixes-and-more/ Mon, 06 Jul 2026 21:09:37 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[macOS 27 Developer Beta 3 Now Available for Developers]]> https://tsecurity.de/de/3649565/ios-mac-os/macos-27-developer-beta-3-now-available-for-developers/ https://tsecurity.de/de/3649565/ios-mac-os/macos-27-developer-beta-3-now-available-for-developers/ Mon, 06 Jul 2026 20:10:43 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[iOS 26.6 Beta 4 Now Available: Here’s What’s New]]> https://tsecurity.de/de/3649528/ios-mac-os/ios-266-beta-4-now-available-heres-whats-new/ https://tsecurity.de/de/3649528/ios-mac-os/ios-266-beta-4-now-available-heres-whats-new/ Mon, 06 Jul 2026 19:55:08 +0200 🍏 iOS / Mac OS tsecurity.de <![CDATA[Playing to win at the AI casino]]> https://tsecurity.de/de/3648396/it-security-nachrichten/playing-to-win-at-the-ai-casino/ https://tsecurity.de/de/3648396/it-security-nachrichten/playing-to-win-at-the-ai-casino/ Mon, 06 Jul 2026 12:08:17 +0200 📰 IT Security Nachrichten tsecurity.de

Most executives approach AI cautiously, like people trying to stretch one bankroll across an entire night on the casino floor. They spread their chips, hedge every move, celebrate the occasional small win, and tell themselves they played wisely because they didn’t lose much. It feels disciplined and responsible. But in a market shifting this quickly, it can become managed irrelevance.

The real question is how to win so decisively that the house starts treating you differently, says Nimesh Mehta. As EVP and chief information and strategy officer at National Life Group, one of the nation’s largest life insurers, Mehta sees AI less as a controlled technology program and more as a sequence of bets that reveal how leadership thinks about risk, conviction, and competitive advantage. In his view, the organizations that pull ahead are the ones willing to place smarter, more consequential bets that reshape how the business operates, competes, and grows.

Stop insuring every move

Mehta’s framing exposes a trap many leadership teams still don’t recognize. A surprising number of organizations believe they’re being strategic with AI when they’re actually over-insuring every decision. They hedge every initiative, over-govern every experiment, over-analyze every downside, and under-commit to anything that might actually matter.

As a result, they reduce the upside to the point of insignificance. Mehta argues that many companies insure the bet so thoroughly that even when they win, the upside is negligible and moves are designed to eliminate discomfort, not win.

That’s what makes the casino analogy useful. In a casino, sitting on your chips can feel safe. In business, that same instinct creates drift. Markets move, competitors learn, and capabilities compound whether you’re ready or not. “Sometimes not betting can, in itself, become a losing strategy,” says Mehta, which strikes the heart of the moment facing CIOs. Waiting may feel like discipline in the short term, but over time it becomes a tax on relevance. The organizations creating separation are those that understand uncertainty, contain it, and move anyway.

Trade certainty for probability

The deeper leadership shift Mehta is calling for is about changing the mental model from deterministic thinking to probabilistic thinking. Most enterprises still want AI to behave like a traditional technology investment. If we spend X, we should get Y. If the model isn’t fully accurate, it’s not ready, and if meaningful risk remains, deployment should wait. That logic made sense in a world built on structured systems and predictable workflows. But it becomes far less useful in a world where advantage comes from learning faster than rivals and improving in motion.

Most organizations still treat AI decisions like fixed equations rather than probabilistic plays, says Mehta. That distinction matters because it changes the questions leaders ask. A deterministic mindset looks at a customer service use case and asks whether the model is accurate enough to be trusted in every case. A probabilistic mindset asks whether the model can handle enough interactions well enough to free human judgment for the moments that matter most. A deterministic leader wants guaranteed ROI before scaling copilots. A probabilistic leader sees that modest improvements, repeated across marketing, operations, distribution, and service, can produce a compounding advantage long before any single use case looks perfect on paper. In that sense, imperfection may be leverage.

Nobody goes to a casino expecting certainty. The energy comes from reading the table, understanding the odds, and knowing that context changes the right move. AI operates in much the same way. “Leaders don’t need to become reckless gamblers,” says Mehta, “They need to become more fluent in uncertainty, more comfortable making directional decisions, and more disciplined about learning from each hand they play.”

When you’re holding 17

Mehta’s blackjack metaphor captures the exact moment where many enterprises stall. With a 17, the dealer will ask if you want to hit or stand. It’s paralyzing, but it’s the position many CIOs are in with AI today. The use case works as it produces value, but it isn’t perfect. The organization can see the upside, but it can still see the gaps, too. So many leaders choose to stand. They wait for better accuracy, cleaner governance, stronger confidence, or a more complete business case. They tell themselves that holding is the responsible move.

“The real risk, however, isn’t the hit but standing still while the table evolves around you,” says Mehta. That line reframes what prudence means in an AI environment. Hitting means understanding the odds well enough to act, not being careless. It means asking what the downside of moving forward actually is, what guardrails are needed, and what the cost of waiting might be if others are learning faster.

The strongest leaders understand that a good but not perfect hand can still be the right time to lean in. They know that learning in production, within bounds, often reveals more than another quarter spent polishing the slide deck.

Bet where the upside compounds

How should CIOs decide where to place bigger bets? Mehta’s answer is to look for asymmetry, where the upside is meaningfully larger than the downside, where learning compounds even if the first outcome is imperfect, and where speed creates an advantage competitors can’t easily copy. Those are better to address than asking which use cases feel safest. Mehta also emphasizes proximity to the business, arguing that the closer an AI use case sits to revenue, customer experience, or core operations, the more valuable the learning becomes. That’s why some of the most important bets may initially feel uncomfortable. But they matter because they produce insight that isolated pilots never can.

This isn’t a call for indiscriminate betting, though. Discipline still matters, and not every initiative deserves to scale, and not every model belongs in production. Good leaders know when to leave the table, reallocate chips, and avoid the sunk-cost logic that keeps weaker organizations trapped in bad hands. At National Life, that means thinking about AI as a portfolio of bets — some exploratory ones, some scaled with intent, and all assessed not only on immediate return but on how they expand capabilities. Positioning the enterprise for its next move is an important lesson for CIOs. “The goal isn’t to win every hand, but build a system to place better bets over time,” says Mehta.

Lessons for CIOs playing to win

For CIOs, the takeaway is clear. Stop defining success as the absence of loss and define it as the presence of disproportionate upside. Shift your decision model from deterministic certainty to probabilistic advantage. Build a portfolio of bets tied closely to the business with enough governance to manage risk, but not so much that governance becomes an excuse for inaction.

Know when to press on emerging momentum and walk away from bets that don’t compound value. Most of all, recognize that AI leadership is about demonstrating you can read the table, understand the odds, and move with conviction before the rest of the market catches up, not just proving you can keep the lights on while experimenting at the edges.

]]> <![CDATA[Why AI agents will make your governance playbook obsolete]]> https://tsecurity.de/de/3648232/it-nachrichten/why-ai-agents-will-make-your-governance-playbook-obsolete/ https://tsecurity.de/de/3648232/it-nachrichten/why-ai-agents-will-make-your-governance-playbook-obsolete/ Mon, 06 Jul 2026 11:03:53 +0200 📰 IT Nachrichten tsecurity.de

Large Australian banks have started implementing agentic AI at scale this year. The same is happening across the country’s larger enterprises. These are not pilots, but production systems that are the tip of a global trend. Research company Gartner expects 40% of enterprises to embed AI agents in applications by the end of 2026, up from less than 5% in 2025 — an eightfold jump in 12 months.

Most governance teams at enterprises are responding to these changes by building playbooks as they always have: through committees, policies, approval gates and periodic audits. It’s a model that assumes humans review most decisions and that governance is a central function that sets and enforces all the rules. None of those assumptions holds for AI agents. The playbook most organisations are drafting at this moment is already obsolete before it is even finished.

In our view, three central changes must happen together for AI governance to work in environments where agents are used at scale:

  • Enterprises need agents’ behavioural telemetry, which they currently lack, to better understand what the bots are doing from a quality, compliance and cost perspective.
  • They need controls that operate at the speed of the systems they govern, which means AI helping govern AI.
  • They must distribute accountability across the organisation, because no centralised system can keep up with what is happening.

Find it and measure it

“You cannot govern what you cannot measure” sounds like a platitude, but most enterprises do not yet know how to measure AI agents’ actions. For instance, what counts as normal agent behaviour? What telemetry tells you that an agent is drifting from its original scope? What does an incident look like when it is not a single breach but four hundred micro-decisions, each individually defensible, that add up to an outcome you would never have approved or anticipated?

Businesses are still working this out. In the meantime, they are building and deploying agents without the capacity to see or understand in detail what they are doing.

A 2026 Gravitee survey found that only 24.4% of organisations report having full visibility into how AI agents communicate with one another. Almost nine in ten (88%) have reported “confirmed or suspected” agent security incidents in the past year. Despite that, 82% of executives say they are confident that existing policies protect against unauthorised agent actions.

These numbers indicate a widening gap between confidence and risk whenever AI agents are deployed. In my experience working with enterprise clients across the region, this gap is not a matter of negligence. Most governance teams are doing what they have always done well. The problem is that the systems they are now responsible for are behaving in ways their existing tools were never designed to detect.

Visibility matters because policy, control frameworks and ethics boards are all scaffolding that collapses without behavioural data that can be analysed and acted upon. You cannot write a meaningful policy for a system whose normal actions and performance you have never characterised or audit an agent whose decisions you cannot investigate or understand.

In this context, observability means instrumentation, baselines, anomaly detection on agent behaviour and telemetry that humans can interpret.

Governance at machine speed

Once you can see and understand what agents are doing, the next problem is how to manage them at scale. When the average enterprise runs 12 agents, as Salesforce’s 2026 Connectivity Report suggests, human oversight is still feasible. When leading deployments are already running into the hundreds — IQVIA has deployed more than 150 agents, for example — that approach stops working.

We don’t necessarily need a completely new security framework, but the updated model must allow companies to operate non-human interactions at scale with confidence. And the only way to ensure this is to use AIs to govern other AIs, because it is not economical to rely solely on humans to do the work.

This agentic AI governance model needs to monitor agentic behaviour and respond within milliseconds when needed. It must provide situational awareness and key insights to support informed decision-making.

Humans are responsible for establishing the parameters and guardrails, but they only intervene on demand and spend most of their focus on continuously improving their AI governance capabilities and the governance agents.

Distributed accountability

If governance must be observed continuously at machine speed and at a high level of complexity, no single function can do it all. That is why another essential change is organisational, with accountability distributed by design.

Today, most businesses use a centralised model that no longer works. Legal owns policy; security focuses on runtime monitoring and response; developers build controls into the agents themselves. The problem is that each function is limited in its own way.

Security can monitor telemetry data, for instance, but lacks insight into what each agent is supposed to do and therefore cannot develop customised anomaly-detection controls.

Closing the gaps in the overall systems requires understanding a specific approach to building agents. Developers cannot simply ship unmanaged agents that operate in stealth mode. They need to send key metrics to a centralised AI governance layer. To enable this layer, a clear shared responsibility model between the developer and governance functions must be defined. Developers are required to implement reporting hooks that generate data to create key metrics and task-specific insights and detect anomalies across clearly defined governance domains.

The centralised AI governance layer analyses this incoming data from the agents and provides situation awareness across all deployed AI agents. Guardrails that are baked into AI agents can’t be trusted, as they have proven to be vulnerable to prompt injection attacks. That is why an independent AI-powered governance layer is required to supervise all agent behaviour and provide insights and key metrics to key stakeholders.

Distributed accountability like this is hard to set up. It requires an understanding of the reasons behind the changes and an agreement between many stakeholders on how the new model must operate and where different responsibilities lie. It also needs a shared language across functions that have not historically worked together at this pace and clarity about who decides what when something goes wrong. But it is the only model that survives an environment with AI agents deployed at scale.

Faster decisions, new mindset

One way to think about these changes is to reflect on cloud adoption over time. That experience showed us that investing in governance and assurance early reduced risks and created a competitive advantage for the businesses that understood why they should do it. The same dynamic is playing out with AI agents, only faster, more distributed and very likely at a much larger scale.

Managing security, compliance, privacy, responsible AI, quality and cost in an agentic world at machine speed hasn’t been done before. Vendors help innovate on the customer’s behalf and can offer building blocks for this governance layer. But organisations also need to consider creating AI-powered custom capabilities to fill their processes and observability gaps. AI governance teams, therefore, require engineering capabilities and an agentic development environment that is tightly integrated with out-of-the-box AI security and compliance solutions.

What I see across the market right now is that the professionals responsible for governance have the expertise and experience to lead this shift. What they need is the confidence to rethink their operating model and recognise that the centralised control they are accustomed to will not scale for agentic environments. Good governance practices that consider people, processes and technology have always paid off in the long run. Now is the time to define the individual North Star for your AI governance layer, because retrofitting these capabilities will carry high risk and cost.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

]]> <![CDATA[Building self-improving tax agents with Codex]]> https://tsecurity.de/de/3647671/ai-nachrichten/building-self-improving-tax-agents-with-codex/ https://tsecurity.de/de/3647671/ai-nachrichten/building-self-improving-tax-agents-with-codex/ Mon, 06 Jul 2026 05:03:49 +0200 🔧 AI Nachrichten tsecurity.de <![CDATA[Improving health intelligence in ChatGPT]]> https://tsecurity.de/de/3647632/ai-nachrichten/improving-health-intelligence-in-chatgpt/ https://tsecurity.de/de/3647632/ai-nachrichten/improving-health-intelligence-in-chatgpt/ Mon, 06 Jul 2026 05:02:53 +0200 🔧 AI Nachrichten tsecurity.de <![CDATA[EV Batteries Defy Expectations, Last Hundreds of Thousands of Miles]]> https://tsecurity.de/de/3646727/it-security-nachrichten/ev-batteries-defy-expectations-last-hundreds-of-thousands-of-miles/ https://tsecurity.de/de/3646727/it-security-nachrichten/ev-batteries-defy-expectations-last-hundreds-of-thousands-of-miles/ Sun, 05 Jul 2026 14:53:26 +0200 📰 IT Security Nachrichten tsecurity.de

Read more of this story at Slashdot.

]]> <![CDATA[AdversaryGraph v5.0: From CTI Mapping to Attack Simulation and SIEM Validation]]> https://tsecurity.de/de/3646308/hacking/adversarygraph-v50-from-cti-mapping-to-attack-simulation-and-siem-validation/ https://tsecurity.de/de/3646308/hacking/adversarygraph-v50-from-cti-mapping-to-attack-simulation-and-siem-validation/ Sun, 05 Jul 2026 08:22:34 +0200 đŸ•”ïž Hacking tsecurity.de A self-hosted CTI-to-detection workbench for ATT&CK mapping, IOC investigation, malware analysis, asset attack-surface mapping, attack simulation, and detection engineering validation.

Introduction

AdversaryGraph started as a practical question:

How can a security team move from threat intelligence to detection engineering without losing the evidence trail?

Most CTI workflows produce useful text, but the next steps are often manual. An analyst reads a report, extracts behaviors, maps them to MITRE ATT&CK, compares them with known actors, enriches IOCs, writes detection ideas, and then asks a detection engineer to validate whether telemetry actually exists in the SIEM.

That gap is where a lot of defensive work slows down.

AdversaryGraph v5.0 is my attempt to make that workflow more operational. It is not only a CTI visualization project. It is a self-hosted analyst workbench that connects:

  • Report and telemetry analysis.
  • ATT&CK technique mapping.
  • Group, campaign, and report similarity.
  • IOC enrichment and investigation.
  • Malware analysis workflows.
  • Asset attack-surface mapping.
  • Attack simulation.
  • SIEM forwarding and validation.
  • Analyst-ready documentation and reports.

The main addition in release 5.0 is Attack Simulation: a controlled ATT&CK validation workspace where an analyst can select a technique, run approved lab scenarios, inspect target-side telemetry, forward logs to a SIEM collector, and use an AI assistant to generate coherent multi-phase attack-chain drills.

This article explains what is new in v5.0, how the architecture works, what the platform can do today, and how I expect analysts and detection engineers to use it.

Project links:

Table of Contents

The Problem: CTI Often Stops Before Validation

A typical CTI-to-detection workflow looks like this:

  1. Read an external report, internal incident report, malware note, or intelligence summary.
  2. Extract behaviors: PowerShell, scheduled tasks, credential dumping, public-facing application exploitation, exfiltration, persistence, discovery, and so on.
  3. Map those behaviors to MITRE ATT&CK.
  4. Compare them with known actor and campaign profiles.
  5. Identify relevant IOCs.
  6. Write hunting hypotheses and detection logic.
  7. Ask whether the SIEM actually receives the required telemetry.
  8. Test rules with sample logs, lab traffic, or purple-team activity.

The hard part is not just mapping. The hard part is preserving the chain from evidence to technique to telemetry to detection validation.

If the SIEM parser is broken, the detection will not fire.

If the event structure is wrong, the rule will not match.

If the test event is too synthetic, the validation result is misleading.

If the ATT&CK mapping is not tied back to evidence, the report becomes hard to defend.

AdversaryGraph v5.0 focuses on this full chain.

What AdversaryGraph Is

AdversaryGraph is a self-hosted CTI-to-detection platform. It combines a public research interface with a Docker-based private platform.

The public site is useful for exploration: ATT&CK matrix navigation, group research, public technique context, and project documentation.

The self-hosted platform is where private work belongs: AI-assisted report analysis, stored investigations, IOC enrichment, malware-analysis workflows, asset inventories, attack simulation, SIEM validation, and API-driven workflows.

The high-level workflow is:

  1. Ingest reports, logs, IOCs, malware findings, asset inventory, or feed data.
  2. Map behaviors to ATT&CK with evidence and confidence.
  3. Enrich IOCs, actors, campaigns, malware families, and references.
  4. Validate coverage using lab telemetry and SIEM forwarding.
  5. Report findings in analyst-ready form.

Core Capabilities Before v5.0

Release 5.0 builds on a broader platform. The major existing modules are still part of the release and matter because Attack Simulation is designed to connect to them.

All capabilities here:

Platform Capabilities | AdversaryGraph Documentation - CTI-to-Detection Workbench | 1200km

AI-Assisted ATT&CK Mapping

Analysts can paste text or upload reports and ask the configured LLM provider to extract ATT&CK candidates. The platform supports multiple provider options, including Claude, OpenAI, Gemini, MiniMax, and local OpenAI-compatible gateways.

The important part is not simply “ask AI for TTPs.” The useful part is that mappings are treated as analyst-assistance data:

  • Techniques are shown with evidence.
  • Confidence is visible.
  • Output can be reviewed before operational use.
  • Extracted TTPs can be pushed into the Navigator.
  • Results can be compared with groups, campaigns, and stored reports.

ATT&CK Navigator and Group Context

The Navigator is the central workspace for technique review. It supports Enterprise, Mobile, ICS, and ATLAS-style workflows. Analysts can search techniques, build layers, overlay group context, import/export layers, and move selected TTPs into comparison and reporting workflows.

This matters because many teams already think in ATT&CK, but their toolchain is split between reports, spreadsheets, diagrams, SIEM rules, and ticketing systems. AdversaryGraph tries to keep the matrix connected to the rest of the investigation.

Group, Campaign, and Report Similarity

AdversaryGraph uses TTP overlap as a way to generate hypotheses. It compares selected behavior against ingested group profiles, campaigns, and stored report libraries.

This is intentionally framed as similarity, not attribution.

TTP overlap can help prioritize research. It can suggest which actor profiles or campaigns deserve review. It is not proof that a specific actor is responsible for an intrusion.

IOC Investigation

The IOC workflow lets analysts pivot from observable data into reputation and relationship context. IPs, domains, URLs, hashes, and other observables can be investigated with feed context and ATT&CK leads.

Malware Analysis

The Malware Analysis module connects static triage, hash checks, unpacking, strings, decompilation/debug views, runtime-gated analysis, and AI summaries back to the CTI workflow.

The point is not to replace a reverse engineer. The point is to help analysts preserve malware-derived evidence and map it into ATT&CK, IOCs, and investigation outputs.

Asset Attack-Surface Mapping

AdversaryGraph can ingest asset inventory input, normalize assets, score exposure, propose likely entry points, and map asset-driven ATT&CK candidates.

This is useful when the question is not “what did the attacker do?” but “what could an attacker realistically try against my exposed environment?”

Examples:

  • Public web applications.
  • VPN and identity services.
  • Exposed admin panels.
  • Cloud assets.
  • Remote management services.
  • High-value internal systems.
  • Scanner and CMDB exports.

What Is New in v5.0

The headline feature is Attack Simulation.

Attack Simulation is designed for defensive validation and detection engineering. It lets analysts work from a TTP-first interface, run safe simulations, inspect telemetry, and forward events to a SIEM.

This is not an exploitation framework. It does not run malware. It does not execute arbitrary commands against arbitrary user targets. It is a controlled validation workspace for authorized lab scenarios and source-shaped telemetry drills.

The v5.0 release adds:

  • A new Attack Simulation workspace.
  • ATT&CK-style matrix selection for runnable simulations.
  • Dedicated configuration pages per selected TTP.
  • Built-in lab web target for web-focused scenarios.
  • Target-side real-time log viewing.
  • SIEM forwarding to HTTP(S) collectors.
  • Saved recent SIEM destinations.
  • AI Attack Assistant.
  • “Challenge Me” mode.
  • Complicated multi-source attack-chain scenarios.
  • 25 named coherent scenario templates.
  • Attack-chain graph.
  • Explain Attack panel.
  • Source-shaped Windows, Sysmon, EDR, DNS, proxy, firewall, web, and WAF event generation for SIEM parser and rule validation.

TTP-First Simulation Workflow

The workflow starts with the ATT&CK matrix.

Runnable simulation cells are visible directly in the matrix, and related TTP pages can link back into the simulation workflow. This keeps the analyst oriented around ATT&CK instead of hiding simulations behind unrelated forms.

The basic flow is:

  1. Open Attack Simulation.
  2. Choose a TTP from the matrix.
  3. Open the dedicated simulation page.
  4. Review what the scenario does.
  5. Review telemetry source and event structure.
  6. Run the lab scenario or AI-assisted telemetry drill.
  7. Inspect logs in real time.
  8. Forward selected logs to the SIEM.
  9. Confirm whether detections fired.
  10. Record validation gaps.

Each scenario explains:

  • What happens.
  • What adversary behavior is represented.
  • Which system emits telemetry.
  • Which event structures are expected.
  • What the detection should focus on.
  • Which telemetry is production-like and which is a lab canary.
  • What the validation gaps are.

That explanation is important. A simulation without context is just noise. A simulation with context becomes a detection-engineering exercise.

Real Lab Telemetry for Web Scenarios

One major design goal was to avoid fake “log generation” for web scenarios where a real lab target can safely produce logs.

For web-focused simulations, the Docker deployment includes an attack-lab-web target. The AdversaryGraph API sends real HTTP requests to that lab web server over the Docker network. The target server writes its own logs.

The analyst can then inspect real target-side telemetry such as:

  • NGINX access logs.
  • NGINX error logs.
  • Application authentication logs.
  • WAF/security-style logs.
  • Structured web JSONL telemetry.
  • Run-specific JSONL logs.
  • Merged attacked-server events.

This is different from simply printing a row that looks like an access log. The request is sent to the lab server, and the server emits the log.

Supported web-focused scenarios include:

  • HTTP and TLS service fingerprinting.
  • Public application probing.
  • Path discovery.
  • Sensitive file and configuration path access.
  • Directory traversal canaries.
  • SQL injection-shaped requests.
  • XSS-shaped requests.
  • SSRF-shaped requests.
  • Command-injection-shaped requests.
  • Web-shell access canaries.
  • Upload and download scenarios.
  • Failed-login flows.
  • Brute-force patterns.
  • Password spray.
  • User enumeration.
  • Beacon-like web traffic.
  • Exfiltration-shaped traffic.

The key phrase is “attack-shaped canary.” The goal is to generate realistic defensive telemetry without exploiting a real target or executing harmful payloads.

SIEM Forwarding

Validation is incomplete if the event never reaches the SIEM.

The v5.0 SIEM forwarding panel sends selected Attack Simulation telemetry to HTTP(S) collectors. This can be used with Logstash HTTP input, Splunk HEC-style collectors, XpoLog/Logeye listeners, or custom webhook receivers.

Supported controls include:

  • Full URL or raw host:port/path destination.
  • Direct destination mode.
  • Docker host gateway routing.
  • Automatic route selection.
  • Raw original line per request.
  • JSON event per request.
  • JSON Lines.
  • Batch envelope.
  • No auth.
  • Bearer token auth.
  • Token auth.
  • Basic auth.
  • Custom token header.
  • Source selection: access, auth, endpoint, WAF/security, error, structured JSONL, run JSONL, or all attacked-server events.

The platform also keeps the last 10 non-secret SIEM destinations for reuse. This is useful during repeated parser testing, rule tuning, and dashboard validation.

Credentials are not stored as part of the saved destination history. The saved address is intended to reduce typing friction, not to become a secret store.

AI Attack Assistant

The AI Attack Assistant is one of the main additions in v5.0.

It helps generate detection-engineering drills by building correlated telemetry stories around selected behavior.

The assistant supports three modes:

  1. Selected TTP: generate a focused validation flow around the technique currently selected in the Attack Simulation page.
  2. Threat actor: generate a scenario inspired by a threat actor’s known behavior and ATT&CK profile.
  3. Challenge Me: generate a blind multi-phase detection challenge for the analyst.

There is also a Complicated attack option. When enabled, the assistant builds longer multi-source flows across telemetry types such as:

  • Windows Security Event Log.
  • Sysmon.
  • EDR process and file telemetry.
  • DNS logs.
  • Proxy logs.
  • Firewall traffic logs.
  • Web access logs.
  • WAF/security logs.
  • Authentication logs.

The goal is not to normalize everything into one generic schema. For complicated scenarios, the assistant should preserve source/vendor-shaped event patterns so the SIEM parser and rule logic are tested more realistically.

Coherent Kill Chains, Not Random Events

A detection drill should not be a random list of suspicious events.

In v5.0, complicated scenarios are built as coherent attack chains. The chain has ordered phases, each phase has a reason, and each phase emits events that should correlate with the surrounding activity.

For example, a password-spray-to-foothold scenario may include:

  1. Username enumeration.
  2. Multiple failed authentication attempts.
  3. One successful logon after failures.
  4. Endpoint discovery from the authenticated host.
  5. Suspicious tool transfer.
  6. Persistence or lateral discovery.

That is much more useful than a single failed-login event.

The Attack Chain Graph makes this visible.

Each phase can show:

  • Phase number.
  • ATT&CK technique.
  • Telemetry source.
  • Event format.
  • Event count.
  • Detection goal.
  • Supporting tags.

This helps the analyst understand whether the generated activity is a plausible kill chain or just a bag of indicators.

Explain Attack

When “Challenge Me” or a complex AI-generated scenario is used, the platform includes an Explain Attack action.

This panel explains:

  • What the scenario is trying to simulate.
  • Why each phase appears in the chain.
  • Which telemetry sources matter.
  • What the analyst should search for.
  • What detections should fire.
  • Which false positives or tuning points should be considered.
  • What success criteria should be used.

This is useful for training and validation. It turns generated events into an exercise that a SOC analyst, detection engineer, or CTI analyst can actually follow.

Named Scenario Library

Release 5.0 includes a library of named coherent scenarios.

Examples include:

  • Web App to Endpoint Compromise.
  • Password Spray to Valid Account Foothold.
  • SQL Injection to Data Theft.
  • Recon to Web Shell Persistence.
  • Valid Account to LSASS Access.
  • Password Spray to Exfiltration.
  • XSS Canary to Session Abuse.
  • SSRF Metadata Probe to C2.
  • Ransomware Precursor Chain.
  • Living-off-the-Land Transfer and Execution.
  • Internal Discovery After Foothold.
  • Web Enumeration to Password Spray.
  • Public App Exploit to Persistence.
  • Credential Dump to Cloud Upload.
  • Signed Binary Proxy to C2.
  • FIN7-style web, identity, and persistence flow.
  • APT29-style identity and PowerShell flow.
  • Lazarus-style delivery and exfiltration flow.
  • Noisy red-team drill.
  • Stealthy low-volume intrusion chain.
  • WAF bypass retry chain.
  • Service account abuse.
  • External recon to credential access.
  • C2 telemetry validation.
  • Persistence control validation.

These are not meant to prove that a real actor attacked you. They are templates for detection validation and training. They help answer questions like:

  • Does my SIEM parse this source?
  • Does my correlation rule see the sequence?
  • Does the detection alert only on one event or on the chain?
  • Can analysts reconstruct the story from logs?
  • Which telemetry source is missing?
  • Where do false positives appear?

Safety Boundaries

Attack Simulation must be safe by design.

The v5.0 module follows several boundaries:

  • It does not execute malware.
  • It does not run arbitrary commands.
  • It does not exploit arbitrary external targets.
  • Web simulation traffic is limited to predefined benign canaries against the local lab target.
  • SIEM forwarding sends generated Attack Simulation telemetry.
  • Unsafe URL schemes and metadata/link-local destinations are blocked.
  • Credentials used for forwarding are used only for the current request and are not stored.

This matters because the target user is a defender. The feature is built for detection engineering, parser validation, SOC drills, and authorized lab workflows.

How This Fits Detection Engineering

Detection engineering is not only writing rules. It is a lifecycle:

  1. Understand the adversary behavior.
  2. Map it to ATT&CK or another behavior model.
  3. Identify required telemetry.
  4. Confirm that telemetry exists.
  5. Confirm that parsing works.
  6. Write detection logic.
  7. Test the logic with realistic events.
  8. Tune false positives.
  9. Document assumptions and gaps.
  10. Re-test when infrastructure or parsers change.

AdversaryGraph v5.0 tries to support this lifecycle directly.

The CTI modules help with steps 1 and 2.

IOC and malware modules help enrich the investigation context.

Asset attack-surface mapping helps identify relevant entry points.

Attack Simulation helps with steps 3 through 8.

Reports and docs help with steps 9 and 10.

Architecture Overview

The self-hosted platform is built around a browser frontend and API backend.

At a high level:

  • Frontend: React/Vite user interface.
  • Backend: FastAPI service.
  • Database: PostgreSQL for stored investigations and platform data.
  • Background jobs: Redis/Celery where needed.
  • ATT&CK data: synchronized from MITRE sources.
  • AI providers: operator-configured providers such as Claude, OpenAI, Gemini, MiniMax, or local OpenAI-compatible services.
  • Malware workflow: MalwareGraph-backed analysis components.
  • Attack lab: Docker-based target services for controlled telemetry generation.
  • SIEM forwarding: HTTP(S) delivery to configured collectors.

For the v5.0 web simulation flow, the important architectural distinction is:

AdversaryGraph does not simply invent an access log line for the UI. It sends real HTTP requests to the lab web target, and the lab web target emits server-side logs.

For AI-generated complicated scenarios, the goal is different. The assistant generates source-shaped telemetry for SIEM parser and detection validation. This is not proof of compromise, and it is not a replacement for live lab execution. It is a defensive validation tool for testing ingestion, parsers, correlation, dashboards, and analyst workflows.

Example Use Case: Password Spray Detection

A common detection engineering task is password spray validation.

The analyst wants to know:

  • Do we ingest authentication failures?
  • Are usernames parsed correctly?
  • Can we count failures across many users?
  • Can we detect one source trying one password against many accounts?
  • Can we correlate a later successful login?
  • Can we connect the successful login to endpoint activity?

With AdversaryGraph v5.0, the workflow becomes:

  1. Select a credential-access or brute-force related TTP.
  2. Choose the password spray scenario.
  3. Run the lab or AI-assisted flow.
  4. Observe authentication-related events.
  5. Forward the events to the SIEM.
  6. Confirm the parser.
  7. Confirm the rule.
  8. Review the chain graph.
  9. Use Explain Attack to document what should have happened.
  10. Record gaps.

The important part is the chain. A single 4625-like event is not enough. A realistic validation should include many failures, many users, timing, source consistency, and possibly one later success.

Example Use Case: Web Recon to Exploit-Shaped Telemetry

For a web application detection scenario, the analyst may want to test:

  • Path discovery.
  • Sensitive file probing.
  • SQL injection-shaped requests.
  • XSS-shaped requests.
  • SSRF-shaped requests.
  • WAF canary classification.
  • Access-log parser behavior.
  • SIEM dashboards for web attacks.

AdversaryGraph can run approved web canaries against the lab web target, then show the real target-side logs in the UI.

This lets the detection engineer validate more than a rule. It validates whether the web tier emits usable logs and whether the SIEM receives enough context to detect the behavior.

Example Use Case: Malware Findings to Detection Validation

The malware module can produce findings such as:

  • Suspicious imports.
  • Strings.
  • Packed sample indicators.
  • Function-level behavior.
  • Potential IOCs.
  • ATT&CK candidates.
  • AI-assisted summaries.

Those findings can feed detection engineering:

  • Which API calls should we monitor?
  • Which command lines or process patterns matter?
  • Which persistence mechanisms appear?
  • Which network indicators are useful?
  • Which behaviors should become validation scenarios?

AdversaryGraph’s value is that malware findings do not stay isolated in a reverse-engineering note. They can be connected back to ATT&CK and validation planning.

Example Use Case: Asset Inventory to Attack Surface

Asset inventories often live in spreadsheets, CMDB exports, or scanner output. The security team may know what exists, but not how to translate that into likely ATT&CK entry points.

The Asset Attack Surface module helps with:

  • Normalizing assets.
  • Identifying exposed services.
  • Scoring exposure.
  • Mapping likely entry points.
  • Proposing ATT&CK candidates.
  • Creating saved cases.

This connects directly to Attack Simulation because a high-risk public web application or VPN service should map to validation scenarios around external discovery, exploitation attempts, credential attacks, and logging coverage.

What This Release Is Not

It is important to define what v5.0 is not.

It is not an autonomous attack platform.

It is not a malware execution system.

It is not a replacement for a full cyber range.

It is not attribution proof.

It is not a guarantee that a detection works in production.

It is an analyst-assistance and validation platform. Its output should be reviewed by qualified analysts and detection engineers before operational use.

What Makes v5.0 Different

The main difference is the connection between CTI and validation.

Many tools stop at one of these points:

  • Visualize ATT&CK.
  • Extract TTPs.
  • Store IOCs.
  • Generate sample logs.
  • Run a lab attack.
  • Forward events.

AdversaryGraph tries to connect these into one workflow:

  1. Understand the behavior.
  2. Map it.
  3. Enrich it.
  4. Simulate it safely.
  5. Observe telemetry.
  6. Send it to the SIEM.
  7. Explain what happened.
  8. Document what passed and what failed.

That is the direction I want the platform to continue moving.

Getting Started

If you want to explore the public interface:

AdversaryGraph Web - Public ATT&CK Workspace for AdversaryGraph | 1200km

If you want the full private platform:

git clone https://github.com/anpa1200/adversarygraph.git
cd adversarygraph
cp .env.example .env
docker compose up

Then open:

http://localhost:3000

Read the full documentation here:

AdversaryGraph Documentation - CTI-to-Detection Workbench | 1200km

Attack Simulation guide:

Attack Simulation | AdversaryGraph Documentation - CTI-to-Detection Workbench | 1200km

Project page:

AdversaryGraph AI - CTI-to-Detection Platform

GitHub release:

Release AdversaryGraph v5.0.0 · anpa1200/adversarygraph

Final Thoughts

AdversaryGraph v5.0 is a step toward a more complete CTI-to-detection workflow.

The platform is still built around a simple idea: intelligence should not end as a static report. It should become a mapped, enriched, validated, and explainable defensive workflow.

With Attack Simulation, SIEM forwarding, real lab telemetry, AI-assisted scenario generation, and attack-chain explanation, v5.0 moves AdversaryGraph closer to that goal.

The next challenge is to continue improving realism: more telemetry sources, more lab targets, better parser validation, stronger scenario libraries, and deeper connections between malware analysis, asset exposure, and detection engineering.

If you work in CTI, SOC operations, detection engineering, malware analysis, or purple-team validation, I would be glad to hear feedback.

Project:

https://github.com/anpa1200/adversarygraph

Documentation:

https://1200km.com/adversarygraph-docs/

Live workspace:

AdversaryGraph Web - Public ATT&CK Workspace for AdversaryGraph | 1200km

Main page:

Andrey Pautov - CTI & Detection Engineering

AdversaryGraph v5.0: From CTI Mapping to Attack Simulation and SIEM Validation was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

]]> <![CDATA[NVIDIA AI Introduces ASPIRE: A Self-Improving Robotics Framework Reaching 31% Zero-Shot on LIBERO-Pro Long Tasks]]> https://tsecurity.de/de/3644899/ai-nachrichten/nvidia-ai-introduces-aspire-a-self-improving-robotics-framework-reaching-31-zero-shot-on-libero-pro-long-tasks/ https://tsecurity.de/de/3644899/ai-nachrichten/nvidia-ai-introduces-aspire-a-self-improving-robotics-framework-reaching-31-zero-shot-on-libero-pro-long-tasks/ Sat, 04 Jul 2026 08:33:19 +0200 🔧 AI Nachrichten tsecurity.de NVIDIA's ASPIRE writes and refines robot control programs, then distills validated repairs into a reusable skill library. It gains up to 77 points on LIBERO-Pro and transfers zero-shot to unseen long-horizon tasks.

The post NVIDIA AI Introduces ASPIRE: A Self-Improving Robotics Framework Reaching 31% Zero-Shot on LIBERO-Pro Long Tasks appeared first on MarkTechPost.

]]> <![CDATA[How to use Copilot Podcasts in Windows 11]]> https://tsecurity.de/de/3644612/windows-tipps/how-to-use-copilot-podcasts-in-windows-11/ https://tsecurity.de/de/3644612/windows-tipps/how-to-use-copilot-podcasts-in-windows-11/ Sat, 04 Jul 2026 03:38:43 +0200 đŸȘŸ Windows Tipps tsecurity.de use copilot podcasts windows 11In this tutorial, we will show you how to use Copilot Podcasts in Windows 11. Copilot Podcasts is a new feature that generates on-demand audio content on a topic of your interest. You can prompt Copilot to create a podcast about any topic, such as black holes, space travel, house marketing trends, improving sleep quality, [
]

This article How to use Copilot Podcasts in Windows 11 first appeared on TheWindowsClub.com.

]]> <![CDATA[Meta’s AI chief says new Muse Spark update will sharpen coding, agentic AI]]> https://tsecurity.de/de/3643414/ai-nachrichten/metas-ai-chief-says-new-muse-spark-update-will-sharpen-coding-agentic-ai/ https://tsecurity.de/de/3643414/ai-nachrichten/metas-ai-chief-says-new-muse-spark-update-will-sharpen-coding-agentic-ai/ Fri, 03 Jul 2026 13:33:31 +0200 🔧 AI Nachrichten tsecurity.de

Meta is set to launch a new Muse Spark model with stronger coding and agentic capabilities, as Chief AI Officer Alexandr Wang touted the update as a step toward closing the gap with rival AI platforms and expanding the company’s enterprise AI ambitions.

“..Our next Muse Spark update is coming soon. Big improvements in coding and agentic capabilities to be more competitive with other leading models,” Wang wrote in a post on X in an attempt to clarify CEO Mark Zuckerberg’s comments about the slow progress in AI agent development made during a company townhall.

In the same townhall, Wang said that the next Muse Spark update, codenamed Watermelon, which uses far more compute than its predecessor, has already caught up with OpenAI’s flagship GPT 5.5 model, according to a Business Insider report that cited anonymous sources.

What the update means for enterprises

The stronger coding and agentic capabilities in Watermelon, according to Pareekh Jain, principal analyst at Pareekh Consulting, could benefit enterprises.

“A strong Meta model would increase competition, lower AI costs, and give enterprises another alternative to OpenAI and Anthropic,” Jain said.

“If offered as an open-weight or low-cost model, it could make AI coding assistants more affordable while improving data control and reducing vendor lock-in,” Jain added.

The analyst was referring to a broader shift in enterprise software development, where wider adoption of AI coding assistants has coincided with mounting cost and availability pressures, as GPU shortages, high model licensing fees, and inference costs make access to the most capable coding models increasingly expensive.

The timing of the Muse Spark update and Meta’s recent acquisitions, including its efforts to acquire Manus, has fueled speculation that Meta might introduce its own AI-assisted application development platform or vibe coding tool.

“It seems, especially with these updates, Meta wants to move beyond foundation models and become a platform for building AI-native applications and agents,” said Charlie Dai, principal analyst at Forrester.

“While the status of Manus remains uncertain due to reported regulatory challenges, initiatives such as Pocket, although consumer-facing, indicate Meta’s interest in lowering the barriers to creating AI-native software. The more important opportunity, however, is enterprise adoption: enabling business users to build workflow automations, agents, and lightweight applications with less technical expertise,” Dai added.

The analyst’s comments also align with Meta’s broader push into the enterprise AI market.

Meta is reportedly developing plans for new cloud infrastructure business lines that would sell access to AI computing power and models.

Enterprise opportunity comes with execution hurdles

However, enterprise adoption might not come easy for Meta, analysts cautioned.

“Meta must prove superior real-world coding quality, reliable agent execution, strong security and governance, and a vibrant developer ecosystem,” Dai said.

“In addition, outside North America, geopolitical and regulatory considerations are increasingly shaping model choices and creating opportunities for alternatives. Meta needs compelling customer outcomes, strong local partnerships, and sustained innovation that resonates with developers and enterprises,” Dai added. The new model, according to Wang, will be rolled out soon via Meta AI and a new API.

]]> <![CDATA[Meta’s AI chief says new Muse Spark update will sharpen coding, agentic AI]]> https://tsecurity.de/de/3643403/it-nachrichten/metas-ai-chief-says-new-muse-spark-update-will-sharpen-coding-agentic-ai/ https://tsecurity.de/de/3643403/it-nachrichten/metas-ai-chief-says-new-muse-spark-update-will-sharpen-coding-agentic-ai/ Fri, 03 Jul 2026 13:32:35 +0200 📰 IT Nachrichten tsecurity.de

Meta is set to launch a new Muse Spark model with stronger coding and agentic capabilities, as Chief AI Officer Alexandr Wang touted the update as a step toward closing the gap with rival AI platforms and expanding the company’s enterprise AI ambitions.

“..Our next Muse Spark update is coming soon. Big improvements in coding and agentic capabilities to be more competitive with other leading models,” Wang wrote in a post on X in an attempt to clarify CEO Mark Zuckerberg’s comments about the slow progress in AI agent development made during a company townhall.

In the same townhall, Wang said that the next Muse Spark update, codenamed Watermelon, which uses far more compute than its predecessor, has already caught up with OpenAI’s flagship GPT 5.5 model, according to a Business Insider report that cited anonymous sources.

What the update means for enterprises

The stronger coding and agentic capabilities in Watermelon, according to Pareekh Jain, principal analyst at Pareekh Consulting, could benefit enterprises.

“A strong Meta model would increase competition, lower AI costs, and give enterprises another alternative to OpenAI and Anthropic,” Jain said.

“If offered as an open-weight or low-cost model, it could make AI coding assistants more affordable while improving data control and reducing vendor lock-in,” Jain added.

The analyst was referring to a broader shift in enterprise software development, where wider adoption of AI coding assistants has coincided with mounting cost and availability pressures, as GPU shortages, high model licensing fees, and inference costs make access to the most capable coding models increasingly expensive.

The timing of the Muse Spark update and Meta’s recent acquisitions, including its efforts to acquire Manus, has fueled speculation that Meta might introduce its own AI-assisted application development platform or vibe coding tool.

“It seems, especially with these updates, Meta wants to move beyond foundation models and become a platform for building AI-native applications and agents,” said Charlie Dai, principal analyst at Forrester.

“While the status of Manus remains uncertain due to reported regulatory challenges, initiatives such as Pocket, although consumer-facing, indicate Meta’s interest in lowering the barriers to creating AI-native software. The more important opportunity, however, is enterprise adoption: enabling business users to build workflow automations, agents, and lightweight applications with less technical expertise,” Dai added.

The analyst’s comments also align with Meta’s broader push into the enterprise AI market.

Meta is reportedly developing plans for new cloud infrastructure business lines that would sell access to AI computing power and models.

Enterprise opportunity comes with execution hurdles

However, enterprise adoption might not come easy for Meta, analysts cautioned.

“Meta must prove superior real-world coding quality, reliable agent execution, strong security and governance, and a vibrant developer ecosystem,” Dai said.

“In addition, outside North America, geopolitical and regulatory considerations are increasingly shaping model choices and creating opportunities for alternatives. Meta needs compelling customer outcomes, strong local partnerships, and sustained innovation that resonates with developers and enterprises,” Dai added. The new model, according to Wang, will be rolled out soon via Meta AI and a new API.

The article originally appeared on InfoWorld.

]]> <![CDATA[Mozilla Privacy Blog: Mozilla Mornings comes to the UK: privacy-enhancing technologies and the questions they raise]]> https://tsecurity.de/de/3643339/tools/mozilla-privacy-blog-mozilla-mornings-comes-to-the-uk-privacy-enhancing-technologies-and-the-questions-they-raise/ https://tsecurity.de/de/3643339/tools/mozilla-privacy-blog-mozilla-mornings-comes-to-the-uk-privacy-enhancing-technologies-and-the-questions-they-raise/ Fri, 03 Jul 2026 13:10:32 +0200 đŸ’Ÿ Tools tsecurity.de During London Tech Week, Mozilla hosted the first UK edition of Mozilla Mornings, our breakfast-discussion series on the digital questions of the moment. We brought together technologists, policymakers, industry, civil society and researchers to ask how the UK can drive forward responsible innovation in privacy-enhancing technologies (PETs) in ways that protect people, strengthen trust and keep digital markets open.

The role of PETs in building a better internet

Protecting people’s privacy has always been central to Mozilla’s mission to build a better internet – one where privacy and security are fundamental, people have meaningful control over their data and online lives, and independent actors can compete on a level playing field. Privacy-enhancing technologies (PETs) are an important part of that vision. They help minimise the amount of personal data that needs to be collected and processed while enabling useful functionality. In Firefox, this work includes technologies such as Oblivious HTTP, differential privacy, the Distributed Aggregation Protocol and DNS over HTTPS.

PETs encompass a broad family of technical, architectural and product-design approaches where data analysis, measurement, collaboration, access and computation happen with lower privacy risk.

Advancing both privacy and competition together is key to a healthier internet ecosystem. Advertising illustrates both the challenge and the opportunity. It keeps most of the web free and accessible, but today’s dominant model leans on hidden data collection and opaque systems that work around people rather than with them. Solutions that simply hand more data, more infrastructure or more decision-making power to a handful of large companies do not fix that.

Importantly, PETs should not be viewed as a way to bypass privacy rules. Their value lies in reducing the amount of personal data that needs to be collected, shared or processed in the first place, while preserving useful functionality where appropriate. That is why we have been investing in and building around privacy-preserving advertising, recognising that PETs are not a silver bullet but an important part of a better model.

Responsible deployment of PETs depends not only on the technical design, but also on the governance, assurance, and market context around it. PETs should be grounded in open standards and interoperable architectures. Otherwise, they risk reinforcing walled gardens, limiting choice or creating new dependencies rather than supporting a more open and competitive ecosystem.

The discussion

The event opened with remarks from the Information Commissioner’s Office (ICO). This included the ICO’s work on PETs, online tracking, privacy-preserving attribution and the questions raised under Regulation 6 of the Privacy and Electronic Communications Regulations (PECR). Shortly before the event, the ICO had published advice to the government on possible online advertising exceptions to Regulation 6 PECR. As we set out in our submission to the ICO’s call for views on online advertising, we support reform that incentivises privacy-preserving practices while keeping consent the default for high-risk practices.

Gijs Kruitbosch, Principal Engineer at Mozilla, then gave a technical demonstration of how Mozilla uses PETs and privacy-preserving design in Firefox, including on New Tab, where relevance can be improved through approaches that reduce reliance on user identifiers and server-side user profiles.

The panel, moderated by Mozilla’s Kirsten Nelson-de BĂșrca, widened the lens well beyond advertising. Speakers from eyeo, OpenMined, the Open Data Institute and the Information Society Law Centre discussed how PETs are governed and used across sectors, and how their deployment could affect competition as well as privacy. The discussion explored public-interest examples, including federated rare-disease and genomic research that lets analysis happen without data leaving an institution or a country, and emerging routes for external researchers to study platform data.

A recurring theme was that successful deployment depends as much on governance and public trust as it does on mathematics. PETs have the potential to reduce the competitive advantages associated with large-scale personal data collection, but they could also entrench incumbents if the relevant infrastructure is closed, proprietary or expensive to audit. The discussion complicated the familiar trade-off between privacy and competition, arguing that it eases when PETs are built in the open, on shared standards, with interoperable and auditable implementations and real routes for smaller players and new entrants to take part.

What comes next

The most important questions were the ones we left without tidy answers. Who gets to set standards, and are they set in the open? How do smaller players actually participate, rather than being told they may? What forms of assurance or audit are needed before policymakers can rely on privacy claims? And how should PETs be built into the next generation of AI, where the most sensitive data and the strongest case for protection often sit together? These are the questions we want to keep working on with those who joined us and the wider community.

The post Mozilla Mornings comes to the UK: privacy-enhancing technologies and the questions they raise appeared first on Open Policy & Advocacy.

]]> <![CDATA[Honolulu Launches AI-Assisted Fast-Track Permit Review]]> https://tsecurity.de/de/3642337/ai-nachrichten/honolulu-launches-ai-assisted-fast-track-permit-review/ https://tsecurity.de/de/3642337/ai-nachrichten/honolulu-launches-ai-assisted-fast-track-permit-review/ Fri, 03 Jul 2026 00:03:56 +0200 🔧 AI Nachrichten tsecurity.de <![CDATA[Defense Gap in AI Security Race]]> https://tsecurity.de/de/3642336/it-security-video/defense-gap-in-ai-security-race/ https://tsecurity.de/de/3642336/it-security-video/defense-gap-in-ai-security-race/ Fri, 03 Jul 2026 00:03:39 +0200 đŸŽ„ IT Security Video tsecurity.de Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:0

AI is improving offensive security capabilities like vulnerability discovery and exploit generation at a rapid pace.

Offensive work can tolerate high error rates, since only occasional success is needed.

Defensive security cannot operate that way—detection, patching, and response must be consistently accurate.

This creates an imbalance where innovation and attention skew toward offense while defense remains more complex and unforgiving.

If AI continues to accelerate offensive capabilities faster than defensive reliability, how does security balance shift over time?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#BlueTeam #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec

]]> <![CDATA[Conformal Thinking: Risk Control for Reasoning on a Compute Budget]]> https://tsecurity.de/de/3642246/ai-nachrichten/conformal-thinking-risk-control-for-reasoning-on-a-compute-budget/ https://tsecurity.de/de/3642246/ai-nachrichten/conformal-thinking-risk-control-for-reasoning-on-a-compute-budget/ Thu, 02 Jul 2026 22:49:24 +0200 🔧 AI Nachrichten tsecurity.de <![CDATA[Improving security posture across the Microsoft partner ecosystem]]> https://tsecurity.de/de/3641932/it-security-nachrichten/improving-security-posture-across-the-microsoft-partner-ecosystem/ https://tsecurity.de/de/3641932/it-security-nachrichten/improving-security-posture-across-the-microsoft-partner-ecosystem/ Thu, 02 Jul 2026 19:38:50 +0200 📰 IT Security Nachrichten tsecurity.de Read how Microsoft strengthens partner ecosystem security with CSP vetting, least privilege access, monitoring, and risk management best practices.

The post Improving security posture across the Microsoft partner ecosystem appeared first on Microsoft Security Blog.

]]> <![CDATA[Improving security posture across the Microsoft partner ecosystem]]> https://tsecurity.de/de/3641794/it-security-nachrichten/improving-security-posture-across-the-microsoft-partner-ecosystem/ https://tsecurity.de/de/3641794/it-security-nachrichten/improving-security-posture-across-the-microsoft-partner-ecosystem/ Thu, 02 Jul 2026 18:51:53 +0200 📰 IT Security Nachrichten tsecurity.de Read how Microsoft strengthens partner ecosystem security with CSP vetting, least privilege access, monitoring, and risk management best practices. The post Improving security posture across the Microsoft partner ecosystem appeared first on Microsoft Security Blog. This article has been indexed


Read more →

The post Improving security posture across the Microsoft partner ecosystem appeared first on IT Security News.

]]> <![CDATA[CubeSpace CW0057 Reaction Wheel]]> https://tsecurity.de/de/3641716/it-security-nachrichten/cubespace-cw0057-reaction-wheel/ https://tsecurity.de/de/3641716/it-security-nachrichten/cubespace-cw0057-reaction-wheel/ Thu, 02 Jul 2026 18:25:21 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of this vulnerability could allow an attacker to upload arbitrary malicious firmware to the device.

The following versions of CubeSpace CW0057 Reaction Wheel are affected:

  • CW0057 Reaction Wheel
CVSS Vendor Equipment Vulnerabilities
v3 6.1 CubeSpace CubeSpace CW0057 Reaction Wheel Improper Verification of Cryptographic Signature

Background

  • Critical Infrastructure Sectors: Communications
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: South Africa

Vulnerabilities

Expand All +

CVE-2026-13743

CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. This could allow an attacker with physical access to the product to upload arbitrary malicious firmware to the device without authentication.

View CVE Details

Affected Products

CubeSpace CW0057 Reaction Wheel
Vendor:
CubeSpace
Product Version:
CubeSpace CW0057 Reaction Wheel: <firmware_5.0.20
Product Status:
known_affected
Remediations

Vendor fix
CubeSpace has released the following firmware versions for users to enable: Firmware version 5.0.20. Firmware version 5.0.20 introduces the capability for cryptographically verified secure boot; however, this protection is not enabled by default. Users must activate signed‑boot functionality, particularly the fully immutable mode, to achieve full security.

Mitigation
CubeSpace acknowledges the finding. The CW0057 reaction wheel authenticates firmware updates with a CRC-32 integrity check, which confirms image integrity but does not verify the source of an image. Exploitation requires direct physical access to the device and is not exploitable remotely. A device affected by this method remains recoverable: the bootloader operates independently of the application firmware and can reload known-good, CubeSpace-supplied images, so an affected unit cannot be permanently disabled by this method. Starting with firmware version 5.0.20, CubeSpace offers optional cryptographic secure boot of varying security levels which customers can enable. Given the physical-access prerequisite and the availability of recovery, CubeSpace assesses the practical risk as low.

Relevant CWE: CWE-347 Improper Verification of Cryptographic Signature

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 6.1 MEDIUM CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
4.0 3.3 LOW CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Acknowledgments

  • Anthony Rose reported this vulnerability to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

Revision History

  • Initial Release Date: 2026-07-02
Date Revision Summary
2026-07-02 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Gardyn IoT Hub]]> https://tsecurity.de/de/3641715/it-security-nachrichten/gardyn-iot-hub/ https://tsecurity.de/de/3641715/it-security-nachrichten/gardyn-iot-hub/ Thu, 02 Jul 2026 18:25:19 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could allow unauthenticated users to access and control IoT Hub managed devices.

The following versions of Gardyn IoT Hub are affected:

  • Home Firmware
  • Studio Firmware
  • Cloud API <2.12.2026 (CVE-2026-13768, CVE-2026-55726, CVE-2026-54477)
CVSS Vendor Equipment Vulnerabilities
v3 10 Gardyn Gardyn IoT Hub Use of Hard-coded Credentials, Exposure of Sensitive System Information to an Unauthorized Control Sphere, Improper Neutralization of HTTP Headers for Scripting Syntax

Background

  • Critical Infrastructure Sectors: Food and Agriculture
  • Countries/Areas Deployed: United States
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-13768

Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.

View CVE Details

Affected Products

Gardyn IoT Hub
Vendor:
Gardyn
Product Version:
Gardyn Home Firmware: <master.627, Gardyn Studio Firmware: <master.627, Gardyn Cloud API: <2.12.2026
Product Status:
known_affected
Remediations

Mitigation
Gardyn states that IoT Hub deployed infrastructure has been updated to fix the listed vulnerabilities.

Mitigation
Gardyn requests that users ensure their devices have Internet connectivity in order to automatically download needed firmware updates. Unconnected devices will automatically update when configured with a working Internet connection. Gardyn also recommends that users update their mobile application to the most recent version. The current versions of the Gardyn App and the Gardyn Home firmware can be checked in the Gardyn App.

Mitigation
Further information on Gardyn security can be found here: https://mygardyn.com/security/
https://mygardyn.com/security/

Mitigation
Further customer support can be obtained from Gardyn at: support@mygardyn.com
mailto:support@mygardyn.com

Relevant CWE: CWE-798 Use of Hard-coded Credentials

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 10 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
4.0 9.5 CRITICAL CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

CVE-2026-55726

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.

View CVE Details

Affected Products

Gardyn IoT Hub
Vendor:
Gardyn
Product Version:
Gardyn Home Firmware: <master.627, Gardyn Studio Firmware: <master.627, Gardyn Cloud API: <2.12.2026
Product Status:
known_affected
Remediations

Mitigation
Gardyn states that IoT Hub deployed infrastructure has been updated to fix the listed vulnerabilities.

Mitigation
Gardyn requests that users ensure their devices have Internet connectivity in order to automatically download needed firmware updates. Unconnected devices will automatically update when configured with a working Internet connection. Gardyn also recommends that users update their mobile application to the most recent version. The current versions of the Gardyn App and the Gardyn Home firmware can be checked in the Gardyn App.

Mitigation
Further information on Gardyn security can be found here: https://mygardyn.com/security/
https://mygardyn.com/security/

Mitigation
Further customer support can be obtained from Gardyn at: support@mygardyn.com
mailto:support@mygardyn.com

Relevant CWE: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVE-2026-54477

The admin panel lacks standard security headers, enabling clickjacking and cross-site scripting attacks.

View CVE Details

Affected Products

Gardyn IoT Hub
Vendor:
Gardyn
Product Version:
Gardyn Home Firmware: <master.627, Gardyn Studio Firmware: <master.627, Gardyn Cloud API: <2.12.2026
Product Status:
known_affected
Remediations

Mitigation
Gardyn states that IoT Hub deployed infrastructure has been updated to fix the listed vulnerabilities.

Mitigation
Gardyn requests that users ensure their devices have Internet connectivity in order to automatically download needed firmware updates. Unconnected devices will automatically update when configured with a working Internet connection. Gardyn also recommends that users update their mobile application to the most recent version. The current versions of the Gardyn App and the Gardyn Home firmware can be checked in the Gardyn App.

Mitigation
Further information on Gardyn security can be found here: https://mygardyn.com/security/
https://mygardyn.com/security/

Mitigation
Further customer support can be obtained from Gardyn at: support@mygardyn.com
mailto:support@mygardyn.com

Relevant CWE: CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
4.0 5.1 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Acknowledgments

  • Michael Groberman reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-02
Date Revision Summary
2026-07-02 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[ST Engineering iDirect iQ-Series Terminals]]> https://tsecurity.de/de/3641714/it-security-nachrichten/st-engineering-idirect-iq-series-terminals/ https://tsecurity.de/de/3641714/it-security-nachrichten/st-engineering-idirect-iq-series-terminals/ Thu, 02 Jul 2026 18:25:18 +0200 📰 IT Security Nachrichten tsecurity.de View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denial-of-service condition.

The following versions of ST Engineering iDirect iQ-Series Terminals are affected:

  • Evolution iQ‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057)
  • 3315‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057)
  • 9‑Series terminals <=4.5.2.1 (CVE-2026-38059, CVE-2026-38057)
CVSS Vendor Equipment Vulnerabilities
v3 8.1 ST Engineering iDirect ST Engineering iDirect iQ-Series Terminals Missing Authentication for Critical Function, Cross-Site Request Forgery (CSRF)

Background

  • Critical Infrastructure Sectors: Communications, Defense Industrial Base, Energy, Government Services and Facilities, Transportation Systems
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-38059

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, potentially enabling terminal impersonation and network reconnaissance.

View CVE Details

Affected Products

ST Engineering iDirect iQ-Series Terminals
Vendor:
ST Engineering iDirect
Product Version:
ST Engineering iDirect Evolution iQ‑Series terminals: <=4.5.2.1, ST Engineering iDirect 3315‑Series terminals: <=4.5.2.1, ST Engineering iDirect 9‑Series terminals: <=4.5.2.1
Product Status:
known_affected
Remediations

Mitigation
ST Engineering iDirect has fixed the vulnerabilities and recommend users update the software to version 4.5.2.2 or newer.

Mitigation
Registered users are able to download patches from the iDirect Support Portal https://support.idirect.net/s/login.
https://support.idirect.net/s/login

Mitigation
Restrict management interfaces to trusted networks (e.g., VPN, ACLs).

Mitigation
Avoid exposing administrative APIs to the public internet.

Mitigation
Enforce strong authentication practices.

Mitigation
Monitor for anomalous API activity and unexpected device reboots.

Relevant CWE: CWE-306 Missing Authentication for Critical Function

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVE-2026-38057

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.

View CVE Details

Affected Products

ST Engineering iDirect iQ-Series Terminals
Vendor:
ST Engineering iDirect
Product Version:
ST Engineering iDirect Evolution iQ‑Series terminals: <=4.5.2.1, ST Engineering iDirect 3315‑Series terminals: <=4.5.2.1, ST Engineering iDirect 9‑Series terminals: <=4.5.2.1
Product Status:
known_affected
Remediations

Mitigation
ST Engineering iDirect has fixed the vulnerabilities and recommend users update the software to version 4.5.2.2 or newer.

Mitigation
Registered users are able to download patches from the iDirect Support Portal https://support.idirect.net/s/login.
https://support.idirect.net/s/login

Mitigation
Restrict management interfaces to trusted networks (e.g., VPN, ACLs).

Mitigation
Avoid exposing administrative APIs to the public internet.

Mitigation
Enforce strong authentication practices.

Mitigation
Monitor for anomalous API activity and unexpected device reboots.

Relevant CWE: CWE-352 Cross-Site Request Forgery (CSRF)

Metrics

CVSS Version Base Score Base Severity Vector String
3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
4.0 7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Acknowledgments

  • Ahmed Alqahtani of Aramco reported these vulnerabilities to CISA

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-07-02
Date Revision Summary
2026-07-02 1 Initial Publication

Legal Notice and Terms of Use

]]> <![CDATA[Perimeter to posture: A roadmap to zero trust maturity]]> https://tsecurity.de/de/3641591/it-security-nachrichten/perimeter-to-posture-a-roadmap-to-zero-trust-maturity/ https://tsecurity.de/de/3641591/it-security-nachrichten/perimeter-to-posture-a-roadmap-to-zero-trust-maturity/ Thu, 02 Jul 2026 17:24:12 +0200 📰 IT Security Nachrichten tsecurity.de <p>As cybersecurity threats intensify and perimeter-based security models continue to fail, organizations must adopt zero trust as a strategic, long-term approach to reducing risk and improving resilience surrounding cloud adoption, hybrid work and supply-chain exposure.</p> <p>CISOs and IT decision-makers need


Read more →

The post Perimeter to posture: A roadmap to zero trust maturity appeared first on IT Security News.

]]> <![CDATA[Agentic AI puts $234B in enterprise SaaS spending at risk, Gartner says]]> https://tsecurity.de/de/3641147/it-nachrichten/agentic-ai-puts-234b-in-enterprise-saas-spending-at-risk-gartner-says/ https://tsecurity.de/de/3641147/it-nachrichten/agentic-ai-puts-234b-in-enterprise-saas-spending-at-risk-gartner-says/ Thu, 02 Jul 2026 14:33:32 +0200 📰 IT Nachrichten tsecurity.de

AI agents are poised to challenge traditional enterprise software business models, placing up to $234 billion in application software spending at risk by 2030 as they increasingly bypass human users and interact directly with business systems, according to Gartner.

“You are no longer buying software primarily for people; you are increasingly buying it for agents,” George Brocklehurst, managing vice president at Gartner, told CIO. “For a couple of decades, software has been evaluated on the interface, the user experience: usability, workflow, training. When AI agents become the primary user, all that depreciates.”

Gartner estimates that the exposed spending would account for about 20% of enterprise software-as-a-service (SaaS) spending by the end of the decade.

Gartner attributes the shift to what it calls “agentic arbitrage,” or the use of AI agents to complete business tasks across multiple enterprise systems, reducing the need for employees to interact directly with individual software interfaces.

Agentic AI changes the economics of software, Brocklehurst said, adding that these systems often bypass traditional software and deliver outcomes directly, breaking the link between user growth and revenue growth for many enterprise software vendors.

CIOs may need to rethink software procurement

The emergence of agentic AI will require CIOs to evaluate enterprise software differently, Brocklehurst said.

Instead of focusing primarily on user experience and interface design, organizations should assess whether AI agents can perform every business function through application programming interfaces (APIs) that human users can perform through application screens, he said.

“What really matters, as a starting point, is whether an agent can do everything—and more—through the system’s API that a human can do through a screen, and whether a vendor’s terms permit that,” he said.

That also changes how software contracts should be evaluated.

“Scrutinize the contract as much as you scrutinize the technology,” Brocklehurst said. “Vendors’ terms can prohibit or restrict — technically or financially — third-party autonomous use. CIOs may find their AI strategy blocked not by capability but by clauses they have already signed.”

He advised organizations to negotiate agent permissions into software agreements now because many existing contracts will remain in force when enterprise AI agents become mainstream.

Knowledge ownership becomes the next battleground

Beyond APIs and licensing, organizations should pay close attention to where AI systems retain operational learning, Brocklehurst said.

Every correction, exception, and workflow handled by an AI agent creates organizational knowledge, he said. Gartner refers to an organization’s ability to retain that knowledge as its Knowledge Retention Rate (KRR).

“If it accrues to the vendor’s shared models, your operational experience is improving a product your competitors also use,” Brocklehurst told CIO. “The most important clause in the next generation of software contracts is: ‘Who owns what the system learns from you?’”

According to Gartner, enterprises risk a new form of vendor lock-in if operational learning remains with software providers rather than the customer.

Traditional SaaS economics face disruption

According to Gartner, AI agents that execute work across multiple enterprise applications could reduce direct user interaction with traditional software interfaces, weakening the long-standing link between software usage and seat-based licensing.

Gartner said incumbent software providers should shift from interface-based value to outcome-based value, while embedding agentic capabilities directly into business processes and preserving customer-specific knowledge.

At the same time, AI-native startups and service providers could benefit by becoming the orchestration layer that coordinates work across multiple enterprise applications.

“While this shift is posing an existential threat for vendors who are defending legacy dashboards and seat-based models, it creates a substantial revenue opportunity for vendors who are enabling and developing services and platforms to support agentic-enabled cross-domain workflows,” Brocklehurst said.

Governance should evolve with autonomous systems

Gartner also urged CIOs to establish governance frameworks before autonomous AI agents become commonplace.

“Do not grant autonomy implicitly or unevenly,” Brocklehurst said. Organizations should treat agent autonomy as an explicit governance decision, defining where agents can operate independently, who authorizes those decisions, and how frequently those permissions should be reviewed.

“The companies that build that muscle now will move faster, and more safely, when the technology is ready for more,” he said.

Although Gartner described the transition as a redefinition of the long-discussed “Saaspocalypse,” Brocklehurst said SaaS itself would evolve rather than disappear. “This is less an apocalypse and more of a metamorphosis,” he said. “SaaS will not be destroyed; it will emerge in a different form.”

]]> <![CDATA[OWASP Top Ten Most Critical Web Application Attacks]]> https://tsecurity.de/de/3641025/it-security-nachrichten/owasp-top-ten-most-critical-web-application-attacks/ https://tsecurity.de/de/3641025/it-security-nachrichten/owasp-top-ten-most-critical-web-application-attacks/ Thu, 02 Jul 2026 13:54:04 +0200 📰 IT Security Nachrichten tsecurity.de The Open Web Application Security Project (OWASP) is a non-profit organization focused on improving software security. Its best-known resource is the OWASP Top 10, a regularly updated awareness document that summarizes the most critical web application security risks. The OWASP Top 10 2025 reflects how...

Read more

The post OWASP Top Ten Most Critical Web Application Attacks appeared first on Acunetix.

]]> <![CDATA[IT governance: Best practices for aligning IT and business strategy]]> https://tsecurity.de/de/3640726/it-nachrichten/it-governance-best-practices-for-aligning-it-and-business-strategy/ https://tsecurity.de/de/3640726/it-nachrichten/it-governance-best-practices-for-aligning-it-and-business-strategy/ Thu, 02 Jul 2026 12:03:40 +0200 📰 IT Nachrichten tsecurity.de

The unprecedented pace of AI’s evolution and its use have put a strain on organizations.

According to a 2026 study from the IBM Institute for Business Value study, 77% of organizations reported that AI adoption is outpacing their governance capabilities.

Although governance practices — including the discipline of IT governance — predate AI, the challenges presented by AI adoption and findings such as those in the IBM study show how important IT governance is to overall organizational outcomes.

“IT governance helps ensure that the organization is making good decisions versus making poor decisions, and it ensures that the ability to make good decisions is embedded in everyday work,” says Sharon Stufflebeme, managing director of CIO solutions at Protiviti.

Despite its proven value, adoption of IT governance is still not universal, according to governance experts. Large enterprises, public companies, and those in regulated industries generally have robust IT governance. Smaller entities and privately held ones are less likely to have a mature IT governance program or any at all.

Moreover, some organizations that have IT governance in place may find it ineffective due to siloed IT activities, miscommunication, and failure to enforce policies, experts add.

That doesn’t just hinder effective and efficient IT operations, it can hurt the organization itself, says Nehawa Ngundam Abam, an IT governance and risk analyst at insurance company Starr and a member of the Emerging Trends Working Group with governance association ISACA.

“IT governance is still highly relevant today, and arguably even more so than in the past, because in the modern enterprise there is so much more technology and technology risk than before,” Abam says. “And without effective governance, IT can easily become super fragmented and misaligned with business objectives, and it can introduce cybersecurity, compliance, and reputational risks.”

IT governance and its value

IT governance is a foundational framework for aligning IT implementations and investments with business strategy.

“At its core IT governance is about ensuring that IT supports and enables the business in a controlled, measurable, and strategic way,” Abam says.

By following a formal framework, organizations can produce measurable results tailored to achieve their strategic goals. A formal program also takes stakeholders’ interests into account, as well as the needs of staff and the processes they follow. In the big picture, IT governance is an integral part of overall enterprise governance.

“It’s how we think about the collection of investments we’re making,” says Bill Briggs, who as CTO of Deloitte Consulting advises executives on the impact that emerging technologies may have on their organizations and who serves as executive sponsor of Deloitte’s CIO program.

“It’s the intentionalizing of expected spend and returns, it’s investing for growth versus keeping the lights on, and it’s ensuring what’s promised is what’s delivered,” he adds.

Briggs says a strong IT governance program creates guidance for how investments get approved, how much autonomy each position should have, how to evaluate and select IT vendors and technical solutions, where and how to innovate, how to best deploy workers, and more.

The pillars of IT governance

IT governance has five domains or pillars. ISACA identifies them as:

  • Value delivery
  • Strategic alignment
  • Performance management
  • Resource management
  • Risk management

Stufflebeme identifies and lists them slightly differently as strategic alignment, value management, risk management, resource management, and performance management.

“I define them in that order because of the crucial order in which they need to be viewed today. That strategic alignment pillar is critical in this age of AI as is the value management,” she explains.

Furthermore, IT governance through its risk management pillar ensures that the IT department is also aligned with the organization’s overall governance, risk, and compliance (GRC) program, experts add.

As such, IT governance helps organizations adhere to the many regulations governing the protection of confidential information, financial accountability, data retention, disaster recovery, and business continuity.

IT governance also supports the organization’s efforts to meet the expectations of shareholders, stakeholders, and customers — expectations that often exceed regulatory requirements.

IT governance frameworks

To ensure they have an effective IT governance program in place and can mature it over time, CIOs typically use a framework of best practices and controls.

Frameworks include implementation guides to help organizations phase in an IT governance program with fewer speedbumps. They also provide roadmaps on how to improve and mature a governance program.

The most commonly used frameworks are:

  • COBIT: Published by ISACA, COBIT is a comprehensive framework of globally accepted practices, analytical tools and models (PDF) designed for governance and management of enterprise IT. With its roots in IT auditing, ISACA expanded COBIT’s scope over the years to fully support IT governance.
  • ITIL: Formerly an acronym for Information Technology Infrastructure Library, ITIL focuses on IT service management. It aims to ensure that IT services support core processes of the business. The five foundational stages of the ITIL lifecycle are service strategy, design, transition (such as change management), operation, and continual service improvement. ITIL is designed to bring “together business, product, and service perspectives around value, experience, and outcomes, supporting confident decision-making across strategy and delivery, with continual improvement at its core.”
  • ISO/IEC 38500: This international standard provides guiding principles for corporate governance of IT. It is designed to help board members, directors, and executives evaluate, direct, and monitor the use of IT across their organization. It is designed so that organizations of all sizes, regardless of the extent of their IT use, can use it.

Other notable frameworks include:

  • CMMI: The Capability Maturity Model Integration method, developed by the Software Engineering Institute, is an approach to performance improvement. CMMI uses a scale of 1 to 5 to gauge an organization’s performance, quality, and profitability maturity level. It allows for mixed mode and objective measurements to be inserted, which some view as critical for measuring risks that are qualitative in nature.
  • FAIR: Factor Analysis of Information Risk (FAIR) is a relatively new model that helps organizations quantify risk. The focus is on cyber security and operational risk, with the goal of making more well-informed decisions. Although it’s newer than other frameworks mentioned here, it has gained a lot of traction with Fortune 500 companies.

Most IT governance frameworks are designed to help CIOs evaluate how their IT department is functioning overall, what key metrics management needs, and what return IT is giving back to the business from its investments.

Where COBIT is used mainly for risk, ITIL helps to streamline service and operations. Although CMMI was originally intended for software engineering, it now involves processes in hardware development, service delivery, and purchasing. As previously mentioned, FAIR is squarely for assessing operational and cyber security risks.

Embed governance into everyday work and other best practices

Experts agree that frameworks are useful, but they also stress that adherence to the framework does not necessarily mean effective IT governance is in place.

“Using a framework is not good if it’s just for the sake of checking boxes,” Stufflebeme says. “It’s important to understand the value of each governance pillar and how you measure each pillar.”

“Frameworks are to guide but not replace critical thinking and business judgment and organizational adaptability,” Abam adds. “If it becomes a document exercise, then I think organizations create an appearance of maturity without truly improving their governance, risk management, and resilience.”

Abam and others say the most effective IT governance programs are those where the controls are embedded into everyday work and where workers know and are empowered to follow the policies established by the governance program.

“A lot of governance today can be done with controls that are built digitally into systems,” says Marco Bill, senior vice president and CIO at Red Hat. He uses AI and automation to make adherence to governance happen easily without slowing work and becoming a bottleneck.

Experts offer other best practices for building a strong IT governance discipline:

  • Engage business executives in the process. “It’s important that governance is business-driven and not purely IT-driven; it should be a balance between the two efforts,” Abam says. “That creates a tendency for governance to be more effective, when it’s positioned as an enterprisewide function tied to business operational resilience, customer trust, and business risk management.”
  • Treat governance as a continuous activity. “It’s not manual, static reporting or point-in-time audits and annual reports,” Abam explains. Rather, it needs real-time risk monitoring, the use of risk registers, dashboard reporting, and ongoing policy enforcements via automation and continuous monitoring. Embed governance early into transformation initiatives.
  • Ensure ongoing stakeholder buy-in. “Governance can’t operate in isolation. It has to have stakeholder buy-in and be collaborative and cross-functional, with ongoing conversations between IT, risk, legal, compliance and other teams, because when IT is disconnected from other leaders, actions become reactive rather than strategic,” Abam says
  • Establish clear accountability and ownership. Program components must be owned by leaders who have clear accountability for outcomes, Abam adds.
  • Create a distinct AI governance program. AI governance should be address separately, while also being part of the overall IT governance discipline, says Thomas Phelps, CIO and senior vice president of corporate strategy at Laserfiche and an advisory board member for the SIM Research Institute. “Because AI is so new, it’s worth having a separate effort. Plus, AI changes so fast, that you need to address [its governance needs] more often that IT governance,” he adds.
  • Integrate IT governance into the corporate governance program. “If it’s done right,” Briggs says, “it’s viewed as part of organizational governance, not IT shop governance or CIO governance.”

More on IT governance:

]]> <![CDATA[v2.1.198]]> https://tsecurity.de/de/3639665/downloads/v21198/ https://tsecurity.de/de/3639665/downloads/v21198/ Wed, 01 Jul 2026 22:46:47 +0200 đŸ’Ÿ Downloads tsecurity.de What's changed
  • Claude in Chrome is now generally available
  • Added background agent notifications in claude agents — sessions that need input or finish now fire the Notification hook (agent_needs_input / agent_completed)
  • Added /dataviz skill for chart and dashboard design guidance with a runnable color-palette validator
  • Gateway: added Claude Platform on AWS (anthropicAws) as an upstream provider; model-not-found responses now advance the failover chain
  • Background agents launched from claude agents now commit, push, and open a draft PR when they finish code work in a worktree, instead of stopping to ask
  • The built-in Explore agent now inherits the main session's model (capped at opus) instead of running on haiku
  • Subagents and context compaction now inherit the session's extended thinking configuration, improving output quality on delegated tasks
  • Fixed brief network drops mid-response aborting the turn — transient errors like ECONNRESET now retry with backoff instead of failing
  • Fixed excessive background classifier requests when sandboxed processes repeatedly accessed the same network host
  • Fixed background tasks in web, desktop, and VS Code task panels getting stuck on "Running" after they finish or after resuming a session
  • Fixed agent teams: a teammate that dies on an API error now reports "failed" to the lead, and messaging a stuck teammate wakes it to retry immediately
  • Fixed the /diff panel not refreshing when you switch branches or commit outside the session
  • Fixed markdown tables overflowing and wrapping their right border when rendered in fullscreen mode
  • Fixed Claude Platform on AWS and Mantle sessions dead-ending with "Please run /login" when the STS token expires — awsAuthRefresh now runs automatically
  • Fixed "no route to host" for local-network hosts in macOS background agent sessions by declaring Local Network entitlements
  • Fixed /desktop failing with "Cannot determine working directory" after entering and exiting a worktree
  • Fixed background agents repeatedly showing "Reconnecting
" every ~52 seconds on macOS while the agents view was open
  • Fixed pressing ← inside claude attach <id> exiting to the shell instead of opening the agent view
  • Fixed claude --bg silently creating an unattachable session when combined with --print/-p; the conflicting flags are now rejected up front
  • Fixed the workflow progress view dropping the earliest agents from the list while the phase counter stayed correct in SDK and desktop-app sessions
  • Fixed .claude/rules/ conditional rules not loading when the target file is reached via a symlinked path
  • Fixed Cmd+click not opening URLs in fullscreen mode in Warp on macOS
  • Fixed double-click word selection in fullscreen mode to select the entire URL including the scheme
  • Fixed plan mode not auto-allowing read-only tool calls when a session starts in plan mode
  • Fixed /branch deriving its default fork name from the compaction summary instead of the first real prompt
  • Improved focus mode: subagents launched in a turn now appear in its activity summary, and completed background notifications fold into a single count
  • Improved syntax highlighting accuracy in code blocks, diffs, and file previews by upgrading to highlight.js 11
  • Keyboard shortcut hints now show opt/cmd instead of alt/super when connected from a Mac over SSH
  • Improved API retry UX: the error reason is now shown after the second attempt, and a status page link replaces the spinner tip when the API is overloaded
  • /login now opens the sign-in dialog from the claude agents view instead of saying it isn't available
  • Subagents now treat messages from the agent that launched them as normal task direction; an agent's message is still never treated as the user's approval
  • Removed the /agents wizard; ask Claude to create or manage subagents, or edit .claude/agents/ directly
]]> <![CDATA[2026 BAIR Graduate Showcase]]> https://tsecurity.de/de/3639545/ai-nachrichten/2026-bair-graduate-showcase/ https://tsecurity.de/de/3639545/ai-nachrichten/2026-bair-graduate-showcase/ Wed, 01 Jul 2026 21:33:50 +0200 🔧 AI Nachrichten tsecurity.de

Congratulations to the Berkeley Artificial Intelligence Research (BAIR) Lab class of 2026! This year, BAIR celebrates another remarkable group of Ph.D. graduates whose curiosity, creativity, and perseverance have pushed the frontiers of artificial intelligence and machine learning.

Their work spans the breadth of modern AI — robotics and embodied intelligence, large language models and reasoning, computer vision, generative modeling, AI safety, human-AI interaction, AI for science and healthcare, and much more. Along the way, they have published influential research, built systems with real-world impact, mentored their peers, and shaped the BAIR community for the better.

Now they are headed everywhere ideas travel: to faculty and postdoctoral positions, to industry research labs, and to startups of their own founding — and several are still exploring what comes next and would love to hear from you.

Please join us in celebrating the achievements of these wonderful graduates. We are proud of everything they have accomplished at Berkeley, and we can’t wait to see what they do next!

Thank you to our friends at the Stanford AI Lab for this idea!

Baifeng Shi

Baifeng Shi


Email: baifeng_shi@berkeley.edu
Website: https://bfshi.github.io/
Advisor(s): Trevor Darrell
Research Blurb: I work on building generalist vision and robotic models.
What's next: Member of Technical Staff at Physical Intelligence
Charlie Snell

Charlie Snell


Email: csnell22@berkeley.edu
Website: https://sea-snell.github.io
Advisor(s): Dan Klein
Research Blurb: My work aims to understand when and how the different LLM scaling paradigms can be traded off and interchanged. In particular, test-time scaling treats each prompt independently, drawing long chains of inferences and then forgetting them entirely between prompts. This differs critically from pretraining, which instead learns a compressed representation from a large dataset. I believe bridging the gap between these methods of scaling computation, presents a key open challenge in the field: how can we develop methods which turn the inferences drawn at test-time back into learned representations that the model can hold onto across interactions.
Devin Guillory

Devin Guillory


Email: dguillory@berkeley.edu
Website: https://devinguillory.com
Advisor(s): Trevor Darrell
Research Blurb: Accounting for data shifts in computer vision models
What's next: Building collaborative AI systems, looking for conspirators.
Eve Fleisig

Eve Fleisig


Email: efleisig@berkeley.edu
Website: https://efleisig.com
Advisor(s): Dan Klein
Research Blurb: I design language models to work reliably and fairly for the broad range of real LLM users. First, my research leverages disagreement among user preferences as signal, in order to train and evaluate LLMs for entire populations of users. Second, I work on designing rigorous evaluations to extricate challenging LLM harms that diverse users face. Finally, I work on core technical failures of LLMs, like miscalibrated confidence, to reduce downstream risks when models are deployed to users with different needs. Combined, these interventions facilitate building LLMs that minimize societal harms, and maximize benefits to a wider range of real-world users.
What's next: Postdoctoral fellow at Princeton CITP
Grace Luo

Grace Luo


Email: graceluo@berkeley.edu
Website: https://graceluo.net
Advisor(s): Trevor Darrell
Research Blurb: My research is on interpreting and controlling generative models. For example, I've worked on re-purposing image generators for computer vision tasks, and meta-modeling language activations for better LLM probing and steering.
What's next: Research scientist in industry
Hanlin Zhu

Hanlin Zhu


Email: hanlinzhu@berkeley.edu
Website: https://hanlinzhu.com/
Advisor(s): Stuart Russell, Jiantao Jiao
Research Blurb: My research centers on understanding and improving the reasoning capabilities of large language models (LLMs).
What's next: Member of Technical Staff at OpenAI
Haozhi Qi

Haozhi Qi


Email: hqi@berkeley.edu
Website: https://haozhi.io/
Advisor(s): Jitendra Malik, Yi Ma
Research Blurb: Dexterous Manipulation and Robot Learning
What's next: Research scientist at Amazon; Faculty at University of Chicago
J.D. Zamfirescu-Pereira

J.D. Zamfirescu-Pereira


Email: zamfi@berkeley.edu
Website: https://zamfi.net
Advisor(s): Bjoern Hartmann
Research Blurb: My research focuses on effective human-AI co-design. I study the boundaries of language interfaces as a medium for interacting with AI, creating systems that blend language-focused interactions with structured user interfaces that draw on different levels of abstraction. I focus on language-oriented technologies, like LLMs and text-to-image models, that are powerful mediators of design processes. These technologies enable humans to describe their desires at almost any level of abstraction, from high-level goals vaguely specified (“I’d like a game to help my kid learn to read”) to low-level corrections of undesired outputs (“Don’t say ‘I know because I’ve tasted it’ when about a recipe substitution's taste”).
What's next: Assistant Professor, Computer Science, UCLA
Jiachen Lian

Jiachen Lian


Email: jiachenlian@berkeley.edu
Website: https://jlian2.github.io
Advisor(s): Gopala Anumanchipalli
Research Blurb: My research focuses on human-centered AI across speech, healthcare, and systems.
Looking for: Look for AI talents to join our startup
Josh Kang

Josh Kang


Email: minwoo_kang@berkeley.edu
Website: https://joshuaminwookang.github.io/
Advisor(s): John Canny
Research Blurb: I study language modeling and related topics in NLP; specific interests are human user simulation and building conversational, collaborative AI agents.
What's next: AI Scientist at Mistral AI
Junhao (Bear) Xiong

Junhao (Bear) Xiong


Email: junhao_xiong@berkeley.edu
Website: https://www.linkedin.com/in/junhao-bear-xiong
Advisor(s): Jennifer Listgarten, Yun Song
Research Blurb: Junhao (Bear) Xiong is a PhD candidate at UC Berkeley, advised by Jennifer Listgarten and Yun S. Song. His work focuses on machine learning methods for biology, with an emphasis on generative modeling for proteins. Previously, he studied Applied Math and Computer Science at Johns Hopkins.
Looking for: Research scientist
Kaylo Littlejohn

Kaylo Littlejohn


Email: kaylo_littlejohn@berkeley.edu
Website: https://kaylolittlejohn.com
Advisor(s): Gopala Anumanchipalli
Research Blurb: My research is focused on speech modeling and natural language processing. I co-led the development of multimodal AI tools to accurately translate brain activity into text, audible personalized speech, and a high-fidelity "digital talking avatar" (Nature 2023, Nature Neuroscience 2025). I am also tech lead for voice modeling at Roblox.
Looking for: Research Scientist / Engineer
Kent Chang

Kent Chang


Email: kentkchang@berkeley.edu
Website: https://kentkc.org
Advisor(s): David Bamman
Research Blurb: I work on NLP and multimodal machine learning, with a focus on evaluating large language models and building multimodal systems for understanding dialogue, narrative, and social interaction. My research includes benchmarks for LLM memorization, multimodal datasets sourced from feature films and television, and studies of model behavior. I'm interested in bridging computational methods with questions from the humanities and social sciences about whose voices get represented in AI systems, and about AI's broader impact. My work has appeared at EMNLP and ACL, among others.
Looking for: (teaching) faculty, Research Scientist, ML/AI SWE
Kevin Black

Kevin Black


Email: kvablack@berkeley.edu
Website: https://kevin.black
Advisor(s): Sergey Levine
Research Blurb: I work on large-scale robot learning: including imitation learning, reinforcement learning, generative modeling, real-time control, and whatever else it takes to make robots work in the real world!
What's next: Research Scientist of Physical Intelligence
Kunhe Yang

Kunhe Yang


Email: kunheyang@berkeley.edu
Website: https://www.kunheyang.com/
Advisor(s): Nika Haghtalab
Research Blurb: My research focuses on the theoretical foundations of designing and evaluating AI algorithms in environments shaped by human incentives and AI agency. My work spans human-centric policy learning, incentive-aware evaluation, and multi-agent collaboration and information transmission, drawing on tools from machine learning theory and computational economics.
What's next: Postdoc Research at Stanford
Lisa Dunlap

Lisa Dunlap


Email: lisabdunlap@berkeley.edu
Website: https://lisabdunlap.com
Advisor(s): Joseph Gonzalez, Trevor Darrell
Research Blurb: Auditing generative models.
What's next: Research Engineer at Anthropic
Long (Tony) Lian

Long (Tony) Lian


Email: longlian@berkeley.edu
Website: https://tonylian.com/
Advisor(s): Trevor Darrell, Adam Yala
Research Blurb: My research primarily focuses on developing real-time multi-modal multi-agent systems and parallel reasoning systems through end-to-end RL.
What's next: Member of Technical Staff at Thinking Machines Lab
Maulik Bhatt

Maulik Bhatt


Email: maulikbhatt@berkeley.edu
Website: https://maulikb.com
Advisor(s): Negar Mehr
Research Blurb: My research develops autonomous robots that can safely coordinate with humans and other robots in shared environments. I build scalable algorithms grounded in game theory and diffusion models that let agents reason about the intent and behavior of others around them. My work spans real-time multi-agent trajectory planning and imitation learning in the presence of multi-modality. I've validated these methods on hardware platforms ranging from quadrotors to manipulators, with the goal of making multi-agent coordination robust, interpretable, and deployable in the real world.
What's next: Joining Toyota Woven's end-to-end autonomous driving team.
Michael Psenka

Michael Psenka


Email: psenka@berkeley.edu
Website: https://www.michaelpsenka.io/
Advisor(s): Aditi Krishnapriyan
Research Blurb: Work in various domains (reinforcement learning, world models, AI+bio/chem), generally working on longer-horizon and out-of-distribution problems in planning and interpolation (e.g. robot manipulation from start state to goal, molecular dynamics of proteins between ground states). My thesis took a variational approach (think calculus of variations) directly from deep generative models of the environment, framing path-finding as minimizing a functional induced by the learned model itself (its score, its critic, or its dynamics). Through my research I've gained insight on how to properly handle dynamics in deep learning systems, and I plan to continue developing systems that are dynamic and adaptive.
What's next: Lead Research Scientist at Baseten
Nathan Lichtlé

Nathan Lichtlé


Email: nathan.lichtle@gmail.com
Website: https://nathanlichtle.com
Advisor(s): Alexandre M. Bayen
Research Blurb: RL for autonomous driving.
What's next: Chief Scientist & Co-founder at Yumi Health
Neerja Thakkar

Neerja Thakkar


Email: nthakkar@berkeley.edu
Website: https://neerja.me/
Advisor(s): Jitendra Malik
Research Blurb: My research focuses on scaling predictive world models to handle the complexity of in-the-wild motion. Using autoregressive and diffusion frameworks, I develop better representations for real-world prediction and propose methods to efficiently adapt these models to new domains.
Looking for: Research scientist
Nikita Mehandru

Nikita Mehandru


Email: nmehandru@berkeley.edu
Website: https://n-mehandru.github.io/
Advisor(s): Ahmed Alaa and David Bamman
Research Blurb: My research develops and applies machine learning methods for clinical reasoning and disease progression modeling using unstructured text and time series data from electronic health records. In collaboration with physicians at UCSF, I bridge method development and clinical validation with the intention to build reliable, interpretable AI systems in medicine.
Looking for: Research Scientist
Niklas Lauffer

Niklas Lauffer


Email: nlauffer@berkeley.edu
Website: https://niklaslauffer.github.io/
Advisor(s): Stuart Russell and Sanjit Seshia
Research Blurb: Niklas's research is focused on AI safety and reinforcement learning, particularly in the area of multi-agent interaction and LM agents. He's worked on enabling adversarial learning in cooperative and mixed-motive settings, solving issues of covariate shift in training LM agents on long-horizon tasks, as well as evaluating safety risks posed by LM agents in multi-agent settings.
What's next: Research Scientist at Google Deepmind
Qiyang Li

Qiyang Li


Email: qcli@berkeley.edu
Website: https://colinqiyangli.github.io/
Advisor(s): Sergey Levine
Research Blurb: Recent progress in robotic manipulation policy learning has been largely driven by (1) the increasing availability of large-scale prior datasets and (2) the success of action chunking, where the policy predicts a short sequence of future actions rather than a single one. However, most action chunking policies are trained via supervised imitation learning, because efficient online self-improvement with reinforcement learning (RL) remains challenging—limiting real-world applicability. My PhD research studied how we could leverage prior data to optimize action-chunking policies with RL, combining empirical results with theoretical insights.
Looking for: Post-doc/research scientist for RL in robotics and LLMs!
Sampada Deglurkar

Sampada Deglurkar


Email: sampada_deglurkar@berkeley.edu
Website: https://sdeglurkar.github.io/
Advisor(s): Prof Claire Tomlin
Research Blurb: My research is in providing safety assurances for AI-enabled autonomous systems, ranging from robots to autonomous vehicles to aviation systems. For this, I have worked with uncertainty quantification for machine learning models, decision-making under uncertainty algorithms, and tools for producing probabilistic guarantees on system operation.
Looking for: Research scientist, Research engineer
Vinamra Benara

Vinamra Benara


Email: vbenara@berkeley.edu
Website: https://cs.berkeley.edu/~vbenara
Advisor(s): Ion Stoica
Research Blurb: My research focuses on LLM post-training, including data curation, RLHF, RLVR with VLMs, evaluations, reasoning, agentic workflows, and interpretability. I also have strong expertise in systems infrastructure for distributed computing.
Looking for: Research scientist / Research Engineer
Vongani Maluleke

Vongani Maluleke


Email: vongani_maluleke@berkeley.edu
Website: https://people.eecs.berkeley.edu/~vongani_maluleke/
Advisor(s): Jitendra Malik and Angjoo Kanazawa
Research Blurb: Vongani Maluleke is a PhD candidate at UC Berkeley (BAIR, advised by Jitendra Malik and Angjoo Kanazawa), where she led the development of MAGNet, a unified multi-agent motion generation framework that supports a wide range of motion generation tasks without retraining or architectural changes, outperforming task-specialized state-of-the-art baselines. She is currently extending this work by deploying it on a Unitree G1 humanoid to make it embody social intelligence. Before her PhD, she was a Senior AI Consultant at Deloitte, awarded Exceptional Performer two consecutive years, leading AI system development across media, telecommunications, retail, and financial services.
Looking for: Research scientist
Wei-Jer Chang

Wei-Jer Chang


Email: weijer_chang@berkeley.edu
Website: https://weijer-chang.github.io/
Advisor(s): Masayoshi Tomizuka
Research Blurb: My research focuses on developing safe and intelligent autonomous systems for complex, human-centered environments. I work at the intersection of machine learning, generative models, and reinforcement learning, with applications in autonomy. My work addresses challenges in multi-agent interaction, interactive human behavior, and long-tail safety-critical scenarios at scale.
Looking for: Research Scientist, Applied Scientist, Roboticist
Xiuyu Li

Xiuyu Li


Email: xiuyu@berkeley.edu
Website: https://xiuyuli.com/
Advisor(s): Kurt Keutzer
Research Blurb: My research focuses on developing scalable and self-improving large language model agents, with emphasis on coding agents for complex, long-horizon tasks. This direction builds on my work in parallel reasoning, and on broader expertise in making generative models more efficient in training and inference across language and vision.
What's next: Member of Technical Staff at xAI
Yichen Xie

Yichen Xie


Email: yichenxie0928@gmail.com
Website: https://yichen928.github.io/
Advisor(s): Masayoshi Tomizuka
Research Blurb: My research focuses on building multimodal foundation models and world models that understand and interact with complex physical environments. I aim to develop unified representations across modalities, enabling AI systems to reason over space, time, and dynamics toward general-purpose embodied intelligence.
What's next: Research Scientist at Luma AI
Yigit Efe Erginbas

Yigit Efe Erginbas


Email: erginbas@berkeley.edu
Website: https://www.linkedin.com/in/erginbas/
Advisor(s): Kannan Ramchandran, Thomas A. Courtade
Research Blurb: My PhD research spans two threads: online learning in large-scale markets, and interpretability of large machine learning models. In the first, I work on sequential decision-making with applications to recommendation, pricing, and assortment selection. My focus is on designing algorithms with provable guarantees for welfare maximization, revenue maximization, and stability. In the second, I develop scalable attribution methods that exploit the sparse, low-degree structure of real-world interactions, using tools from signal processing and information theory. More recently, I have been exploring principled ways to evaluate the faithfulness of model self-explanations.
What's next: Researcher at Hudson River Trading's AI Labs (HAIL)
Yiheng Li

Yiheng Li


Email: yhli@berkeley.edu
Website: https://Yihengli.com
Advisor(s): Masayoshi Tomizuka
Research Blurb: I am working on vision world modeling, with prior experience in diffusion model's efficiency as well as in autonomous driving.
What's next: Research Scientist at Waymo
Zhe Fu

Zhe Fu


Email: zhefu@berkeley.edu
Website: https://fu-zhe.com/
Advisor(s): Alexandre Bayen
Research Blurb: My research focuses on physics-informed learning and control for mixed-autonomy systems, with applications in transportation. I design physics-informed neural networks to learn solutions of nonlinear partial differential equations, enabling accurate and data-efficient prediction of traffic dynamics. Building on these models, I develop both model-based and learning-based control strategies that coordinate automated vehicles to improve system-level performance. My work bridges machine learning, control, and real-world deployment, and has been validated in large-scale field experiments. More broadly, I aim to advance trustworthy, interpretable AI for decision-making in complex, real-world systems.
What's next: I will be an Energy Fellow at Stanford after graduation. Also looking for Faculty, or research scientist positions in AI, control, and autonomy.
]]> <![CDATA[Kyndryl: AI success hinges on workforce readiness]]> https://tsecurity.de/de/3639527/it-security-nachrichten/kyndryl-ai-success-hinges-on-workforce-readiness/ https://tsecurity.de/de/3639527/it-security-nachrichten/kyndryl-ai-success-hinges-on-workforce-readiness/ Wed, 01 Jul 2026 21:22:56 +0200 📰 IT Security Nachrichten tsecurity.de

Enterprise AI adoption is outpacing workforce readiness, according to new research from Kyndryl that found only 23% of leaders believe their organizations are prepared to support AI at scale.

The report discovered that 57% of organizations have broadly deployed AI or embedded it into core business processes, while 77% have scaled generative AI across multiple functions. According to Kyndryl’s 2026 People Readiness Report, a smaller set of participating organizations that are redesigning roles, investing in workforce readiness, and implementing formal change-management programs are more likely to achieve revenue growth and innovative outcomes from AI than their peers.

“This is a critical moment for global enterprises as they race to adopt AI, redesign workflows, and pursue innovation, yet they’re finding that their greatest assets—their people—need more attention,” Kim Basile, CIO at Kyndryl, said in a statement. “The data shows that the organizations investing in people—whether it’s rethinking roles and workflows, dedicating resources for upskilling and retraining, or guiding employees through change—are experiencing positive outcomes at a much higher rate.”

Enterprises organizations are sharing how prepared for AI they are across their infrastructure, organization, and workforce. Some highlights from the report include:

  • 35% say their IT infrastructure is ready for AI.
  • 25% say their organizational culture is ready.
  • 23% say governance and compliance functions are ready.
  • 36% expect workforce skills and role structures to be fully AI-ready by year-end.
  • 33% expect organizational culture and change-management capabilities to be fully AI-ready by year-end.

The report, based on a survey of 1,100 business and technology leaders across eight countries, suggests workforce readiness is becoming a key factor for success as organizations move beyond AI experimentation and focus on measurable business outcomes.

In its research, Kyndryl identified a small subset of organizations—just 9% of respondents—that it calls “pacesetters.” These companies invested in workforce readiness while redesigning jobs and workflows around AI. They were 1.5 times more likely to report AI-driven revenue growth and 1.6 times more likely to achieve innovation-related outcomes than other respondents.

Nearly 80% of respondents said the pace of AI adoption is likely to outstrip their organization’s ability to adapt its workforce, governance structures, and operating model. As Kyndryl notes in the report, most leaders believe addressing those challenges “will prove more arduous than those involving code and compute.”

Organizations are also struggling to achieve the outcomes they most want from AI. Improving operational efficiency and productivity remains the top AI priority for enterprises, cited by 34% of respondents, followed by IT modernization (27%), risk management and security improvements (25%), business innovation (25%), and AI-driven revenue growth (24%).

However, only 32% of organizations reported achieving even one of their top two desired outcomes, and just 11% said they had achieved both. Improved operational efficiency and productivity was the most frequently reported AI outcome, cited by 38% of respondents. By comparison, organizations were far less likely to report outcomes such as AI-driven revenue growth (14%), IT modernization (13%), or innovation in new products and services (11%).

Many organizations attribute those challenges to workforce and skills issues. Nearly half of respondents (49%) identified skills and talent gaps as a major obstacle to executing their AI strategies, second only to cybersecurity concerns (52%). In addition, 52% said it has become more difficult over the past year to find employees with the skills needed to support their organization’s AI strategy.

The Kyndryl report found that 94% of respondents believe AI will make upskilling current employees more effective than hiring external talent.

“AI’s ability to reshape work is challenging organizations to reshape their workforce more rapidly than ever before,” Mark Paulek, Kyndryl’s chief human resources officer, said in a statement. “The leaders pulling ahead are aligning skills, roles, and decision-making with how work is actually changing.”

]]>