<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="/rss-style.xsl"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:media="http://search.yahoo.com/mrss/" xmlns:dc="http://purl.org/dc/elements/1.1/">
<channel>
<title><![CDATA[Team IT Security - 📰 Alle Kategorien]]></title>
<link><![CDATA[https://tsecurity.de/export/rss/alle-kategorien.xml?q=platform+lets+california+match%2F]]></link>
<description><![CDATA[Das Gesamte Cyber Threat Intelligence Feed-Archiv von TSecurity.de. Alle Nachrichten, Sicherheitsmeldungen, Videos, Downloads und Analysen in einer zentralen Übersicht.]]></description>
<language>de-DE</language>
<lastBuildDate>Tue, 28 Jul 2026 08:38:25 +0200</lastBuildDate>
<pubDate>Tue, 28 Jul 2026 08:38:25 +0200</pubDate>
<ttl>15</ttl>
<copyright>2026 Team IT Security</copyright>
<managingEditor>lakandor@tsecurity.de (Horus Sirius)</managingEditor>
<webMaster>lakandor@tsecurity.de (Horus Sirius)</webMaster>
<category>IT Security</category>
<category>Cybersecurity</category>
<category>Nachrichten</category>
<generator>Team IT Security RSS Generator v2.0</generator>
<image>
<url>https://tsecurity.de/favicon.ico</url>
<title><![CDATA[Team IT Security - 📰 Alle Kategorien]]></title>
<link><![CDATA[https://tsecurity.de/export/rss/alle-kategorien.xml?q=platform+lets+california+match%2F]]></link>
</image>
<atom:link href="https://tsecurity.de/export/rss/it-security.xml?q=platform+lets+california+match%2F" rel="self" type="application/rss+xml" />
<item>
<title><![CDATA[The vertical video takeover is here]]></title>
<description><![CDATA[This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more on all things vertical video, follow David Pierce. The Stepback arrives in our subscribers' inboxes on Sunday at 8AM ET. Opt in for The Stepback here. How it started For a while, every social...]]></description>
<link>https://tsecurity.de/de/3695632/it-nachrichten/the-vertical-video-takeover-is-here/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695632/it-nachrichten/the-vertical-video-takeover-is-here/</guid>
<pubDate>Sun, 26 Jul 2026 14:30:37 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more on all things vertical video, follow David Pierce. The Stepback arrives in our subscribers' inboxes on Sunday at 8AM ET. Opt in for The Stepback here. How it started For a while, every social and media platform […]]]></content:encoded>
</item>
<item>
<title><![CDATA[I’m Hot for De’Longhi’s New Automatic Espresso Machine That Also Does Cold Brew]]></title>
<description><![CDATA[A new $1,000 automatic espresso machine lets you choose from 20 preset hot and iced coffee recipes. Is it worth it?]]></description>
<link>https://tsecurity.de/de/3695492/it-nachrichten/im-hot-for-delonghis-new-automatic-espresso-machine-that-also-does-cold-brew/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695492/it-nachrichten/im-hot-for-delonghis-new-automatic-espresso-machine-that-also-does-cold-brew/</guid>
<pubDate>Sun, 26 Jul 2026 12:30:31 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A new $1,000 automatic espresso machine lets you choose from 20 preset hot and iced coffee recipes. Is it worth it?]]></content:encoded>
</item>
<item>
<title><![CDATA[Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached]]></title>
<description><![CDATA[Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: AI agents are still logging in as humans Most large companies run more than one AI platform at the same time. Developers pull up coding assistants, marketing teams lean on writing tools, and analysts...]]></description>
<link>https://tsecurity.de/de/3695324/it-security-nachrichten/week-in-review-servicenow-pre-auth-rce-exploited-in-the-wild-hugging-face-breached/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695324/it-security-nachrichten/week-in-review-servicenow-pre-auth-rce-exploited-in-the-wild-hugging-face-breached/</guid>
<pubDate>Sun, 26 Jul 2026 10:02:10 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: AI agents are still logging in as humans Most large companies run more than one AI platform at the same time. Developers pull up coding assistants, marketing teams lean on writing tools, and analysts query enterprise search across separate vendors. Single-provider setups keep giving way to mixed stacks as companies keep their options open. PR3TACK preemptive framework maps threats before … <a href="https://www.helpnetsecurity.com/2026/07/26/week-in-review-servicenow-pre-auth-rce-exploited-in-the-wild-hugging-face-breached/" rel="nofollow">More <span class="meta-nav">→</span></a></p>
<p>The post <a href="https://www.helpnetsecurity.com/2026/07/26/week-in-review-servicenow-pre-auth-rce-exploited-in-the-wild-hugging-face-breached/">Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached</a> appeared first on <a href="https://www.helpnetsecurity.com/">Help Net Security</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Agent Kim Reactivated Season 2: Is Another Season Happening? Here’s What We Know]]></title>
<description><![CDATA[Agent Kim Reactivated Season 2 has not been officially confirmed, but the Season 1 finale leaves Kim Do-hyeon in a strong position to return for another dangerous mission.



The Korean action drama completed its first season on July 25, 2026, after releasing two episodes each Friday and Saturday...]]></description>
<link>https://tsecurity.de/de/3695255/ios-mac-os/agent-kim-reactivated-season-2-is-another-season-happening-heres-what-we-know/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695255/ios-mac-os/agent-kim-reactivated-season-2-is-another-season-happening-heres-what-we-know/</guid>
<pubDate>Sun, 26 Jul 2026 09:08:51 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Agent Kim Reactivated Season 2 has not been officially confirmed, but the Season 1 finale leaves Kim Do-hyeon in a strong position to return for another dangerous mission.



The Korean action drama completed its first season on July 25, 2026, after releasing two episodes each Friday and Saturday. The finale ended its run as the most-watched drama of 2026 in South Korea, giving SBS and Netflix a strong reason to consider another season.




Season 2 status: Not officially renewed



Possible release date: Late 2027 or 2028, depending on renewal and production



Season 1 release: June 26 to July 25, 2026



Episodes: 10



Genre: Action, crime, spy thriller and comedy



Streaming platform: Netflix



Main cast: So Ji-sub, Choi Dae-hoon, Yoon Kyung-ho and Joo Sang-wook




Netflix describes the series as an action drama about an ordinary father who brings back his black-ops skills after his daughter disappears. The show is based on the Manager Kim webtoon and mixes family drama with espionage, chases and close-combat action.



Where could the story go in Season 2?



Spoilers for the Agent Kim Reactivated Season 1 finale follow.



Season 1 follows bank manager Kim Do-hyeon as he searches for his missing daughter, Min-ji. His investigation forces him to reveal that he once worked as a highly trained North Korean operative before building a quiet life in South Korea.



Do-hyeon eventually confronts Joo Kang-chan, bringing their long and violent history to a final showdown. However, the last episode does more than close the kidnapping storyline. It shows Do-hyeon beginning a new chapter and attending an employment interview connected to Baekho, directly opening the door for another season.



Agent Kim Reactivated Season 2 could follow Do-hyeon as he accepts professional missions instead of returning fully to his normal banking job. Baekho could recruit him for rescue operations involving missing people, criminal groups or former intelligence agents.



The next season could also expand the roles of Park Jin-cheol and Han-soo. Their skills and history would allow the show to form a larger team around Do-hyeon while introducing a new enemy connected to his earlier life.



When will Season 2 be announced?



SBS has not announced a renewal or production schedule. However, the finale’s strong ratings and clear continuation scene make a second season possible. A decision could depend on cast availability, Netflix performance and whether the writers have another completed storyline.



Would you watch Agent Kim Reactivated Season 2, and what mission should Manager Kim take on next? Let us know in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[What links Horrible Histories and Gordon Brown’s neighbour? The bumper summer quiz]]></title>
<description><![CDATA[From award-winning Julies to golfers who were nearly the best, test your knowledge with this bumper summer quiz1 What is now the world’s most populous city, according to the UN?2 Which two Julies won best actress Oscars in consecutive years?3 What was thrown by the goddess Eris at the wedding of ...]]></description>
<link>https://tsecurity.de/de/3695219/it-nachrichten/what-links-horrible-histories-and-gordon-browns-neighbour-the-bumper-summer-quiz/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695219/it-nachrichten/what-links-horrible-histories-and-gordon-browns-neighbour-the-bumper-summer-quiz/</guid>
<pubDate>Sun, 26 Jul 2026 08:15:41 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>From award-winning Julies to golfers who were nearly the best, test your knowledge with this bumper summer quiz</p><p><strong>1</strong> What is now the world’s most populous city, according to the UN?<br><strong>2</strong> Which two Julies won best actress Oscars in consecutive years?<br><strong>3</strong> What was thrown by the goddess Eris at the wedding of Peleus and Thetis?<br><strong>4</strong> Richard Nixon appeared a record 55 times on the cover of what?<br><strong>5</strong> What became Britain’s tallest structure in 1894?<br><strong>6</strong> Mojang Studios in Sweden is renowned for developing which video game?<br><strong>7</strong> Which golfer spent 270 weeks as world No 2, but never reached No 1?<br><strong>8</strong> Which “The” group, named after a Camus novel, went through over 65 members?<br><strong>9</strong> Who is the subject of Alberto Korda’s photograph Guerrillero Heroico?<br><strong>10</strong> What defines an Olimpico goal in football?<br><strong>11</strong> Who initiated the Fridays for Future school strikes?<br><strong>12</strong> Which British dynasty is commemorated by a monument in St Peter’s Basilica?<br><strong>13</strong> What type of souvenir was invented in Vienna in 1900?<br><strong>14</strong> Which Norwegian island gives its name to two shipping forecast areas?<br><strong>15</strong> Which art museum employs a colony of cats to protect it from rodents?<br><strong>16</strong> Millvina Dean, who died in 2009, was the last living survivor of what?<br><strong>What</strong> <strong>links:<br>
  17</strong> Arrival of spring; double portraits; swimming pools; Grand Canyon; Yorkshire landscape?<br><strong>18</strong> Mozart &amp; Franz Süssmayr; Landseer &amp; Millais; F Scott Fitzgerald &amp; Edmund Wilson?<br><strong>19</strong> Cordelia, Goneril &amp; Regan; Imogen; Marina?<br><strong>20</strong> Britannia (1717-1936); Golden Hind (1937-69); St Edward’s Crown (1971-84)?<br><strong>21</strong> Alba white truffles; Pule cheese; Wagyu beef; Yubari King melons?<br><strong>22</strong> Matt Damon; Robert Frost; Bill Gates; Bonnie Raitt; Mark Zuckerberg?<br><strong>23</strong> Horrible Histories; glucose; Gordon Brown’s neighbour; King-Smith’s swine; winter squash?<br><strong>24</strong> Mount Whitney in California and Mulhacén in Andalucía?<br><strong>25</strong> 1991 defence of Baghdad; nacre; UK parliament; Virginia?<br><strong>26</strong> Carrying a double bass; missing a bus; walking two dogs; wearing a cowboy hat; winding a clock?<br><strong>27</strong> 2 (1st); 29 (10th); 541 (100th); 7,919 (1,000th); 104,729 (10,000th)?<br><strong>28</strong> Ant; bull; cuckoo; eagle; shower of gold; swan?<br><strong>29</strong> Zlín, Czechoslovakia; Cohutta, US; Novo Mesto, Yugoslavia?<br><strong>30</strong> Drowned; large bread; pick me up; half cold?</p> <a href="https://www.theguardian.com/games/2026/jul/26/what-links-horrible-histories-and-gordon-browns-neighbour-the-bumper-summer-quiz">Continue reading...</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[Firefox's New Tab Page Will Get Widgets - Including an AI-Powered Daily Crossword]]></title>
<description><![CDATA[In a sign of the times, Firefox's New Tab page could soon include a crossword puzzle from AI-powered news platform Particle. The blog OMG Ubuntu reports:

The mini crossword game is updated daily, with puzzles based around recent content Particle's AI has ingested and summarised that day. [After ...]]></description>
<link>https://tsecurity.de/de/3695175/it-security-nachrichten/firefoxs-new-tab-page-will-get-widgets-including-an-ai-powered-daily-crossword/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695175/it-security-nachrichten/firefoxs-new-tab-page-will-get-widgets-including-an-ai-powered-daily-crossword/</guid>
<pubDate>Sun, 26 Jul 2026 07:16:12 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[In a sign of the times, Firefox's New Tab page could soon include a crossword puzzle from AI-powered news platform Particle. The blog OMG Ubuntu reports:

The mini crossword game is updated daily, with puzzles based around recent content Particle's AI has ingested and summarised that day. [After solving the crossword, links appear to related news articles...] If you just want to try the crossword, you access it in any browser via a direct link. 

While it may look like Mozilla is trying to capitalise on the Wordle craze several years too late, it's part of its strategy to make the Firefox new tab page a discover destination in itself, not just a springboard for new searches. The 'Daily Grind' crossword widget (name subject to change) is just one of several widgets Firefox has (or will get). You'll also find a to-do list, timer, stock checker, world clock, picture of the day, privacy report and new-look weather widget (bigger than the existing one). During the World Cup 2026, Firefox offered real-time match scores and fixture information too... 

[T]hey aren't mandatory. You can disable the ones you don't want to use, or, if you don't want any at all, turn them all off to hide the widget area itself. A button to 'show fewer widgets' frees up room to allow other distractions (sponsored stories) on the new tab page to show... [Presumably you can also still open new tabs to a blank page...] 

They're rolling out to users in certain region and locales already. Plus, Mozilla routinely tests new features with a small set of users before they hit stable builds (i.e., the "Allow Firefox to run feature studies" setting). If you don't have widgets in your Firefox build, but you want them, you can manually enable them in Firefox 153 and later from the about:config page. Search for the following master switch and set it to true to enable the widget area: 

 browser.newtabpage.activity-stream.widgets.system.enabled 
Then, enable the widgets you want to use by searching: 

 activity-stream.widgets.*.enabled 

However, the usual caveats about "trying things not enabled by default" still apply. Mozilla hasn't set a firm rollout date, though the feature is already documented on its support site. With fortnightly Firefox releases about to start, and a big Nova redesign, chances are we'll all be puzzling over these widgets sooner rather than later.<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Firefox's+New+Tab+Page+Will+Get+Widgets+-+Including+an+AI-Powered+Daily+Crossword%3A+https%3A%2F%2Fnews.slashdot.org%2Fstory%2F26%2F07%2F25%2F1944229%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fnews.slashdot.org%2Fstory%2F26%2F07%2F25%2F1944229%2Ffirefoxs-new-tab-page-will-get-widgets---including-an-ai-powered-daily-crossword%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://news.slashdot.org/story/26/07/25/1944229/firefoxs-new-tab-page-will-get-widgets---including-an-ai-powered-daily-crossword?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Google Fixes Dialogflow CX Flaw That Could Have Exposed AI Chatbot Conversations]]></title>
<description><![CDATA[  Google has patched a security vulnerability in its Dialogflow CX platform that could have allowed attackers to steal sensitive conversations from AI-powered chatbots and deploy phishing attacks by abusing a permissions loophole.The flaw, dubbed "Rogue Agent" by researchers at…
Read more →
The p...]]></description>
<link>https://tsecurity.de/de/3695011/it-security-nachrichten/google-fixes-dialogflow-cx-flaw-that-could-have-exposed-ai-chatbot-conversations/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3695011/it-security-nachrichten/google-fixes-dialogflow-cx-flaw-that-could-have-exposed-ai-chatbot-conversations/</guid>
<pubDate>Sun, 26 Jul 2026 06:34:11 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>  Google has patched a security vulnerability in its Dialogflow CX platform that could have allowed attackers to steal sensitive conversations from AI-powered chatbots and deploy phishing attacks by abusing a permissions loophole.The flaw, dubbed "Rogue Agent" by researchers at…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/google-fixes-dialogflow-cx-flaw-that-could-have-exposed-ai-chatbot-conversations/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/google-fixes-dialogflow-cx-flaw-that-could-have-exposed-ai-chatbot-conversations/">Google Fixes Dialogflow CX Flaw That Could Have Exposed AI Chatbot Conversations</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[AI agents break free: Do we need to worry? | DW News - YouTube]]></title>
<description><![CDATA[During a security test, two AI agents escaped a restricted environment and hacked an AI platform ... Is this a cybersecurity wake-up call or a ...]]></description>
<link>https://tsecurity.de/de/3694999/it-security-nachrichten/ai-agents-break-free-do-we-need-to-worry-dw-news-youtube/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694999/it-security-nachrichten/ai-agents-break-free-do-we-need-to-worry-dw-news-youtube/</guid>
<pubDate>Sun, 26 Jul 2026 06:31:25 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[During a <b>security</b> test, two AI agents escaped a restricted environment and hacked an AI platform ... Is this a cybersecurity wake-up call or a ...]]></content:encoded>
</item>
<item>
<title><![CDATA[Firefox' New Tab Page Will Get Widgets - Including an AI-Powered Daily Crossword]]></title>
<description><![CDATA[In a sign of the times, Firefox's New Tab page could soon include a crossword puzzle from AI-powered news platform Particle. The blog OMG Ubuntu reports:

The mini crossword game is updated daily, with puzzles based around recent content Particle's AI has ingested and summarised that day. [After ...]]></description>
<link>https://tsecurity.de/de/3694992/it-security-nachrichten/firefox-new-tab-page-will-get-widgets-including-an-ai-powered-daily-crossword/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694992/it-security-nachrichten/firefox-new-tab-page-will-get-widgets-including-an-ai-powered-daily-crossword/</guid>
<pubDate>Sun, 26 Jul 2026 06:31:16 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[In a sign of the times, Firefox's New Tab page could soon include a crossword puzzle from AI-powered news platform Particle. The blog OMG Ubuntu reports:

The mini crossword game is updated daily, with puzzles based around recent content Particle's AI has ingested and summarised that day. [After solving the crossword, links appear to related news articles...] If you just want to try the crossword, you access it in any browser via a direct link. 

While it may look like Mozilla is trying to capitalise on the Wordle craze several years too late, it's part of its strategy to make the Firefox new tab page a discover destination in itself, not just a springboard for new searches. The 'Daily Grind' crossword widget (name subject to change) is just one of several widgets Firefox has (or will get). You'll also find a to-do list, timer, stock checker, world clock, picture of the day, privacy report and new-look weather widget (bigger than the existing one). During the World Cup 2026, Firefox offered real-time match scores and fixture information too... 

[T]hey aren't mandatory. You can disable the ones you don't want to use, or, if you don't want any at all, turn them all off to hide the widget area itself. A button to 'show fewer widgets' frees up room to allow other distractions (sponsored stories) on the new tab page to show... [Presumably you can also still open new tabs to a blank page...] 

They're rolling out to users in certain region and locales already. Plus, Mozilla routinely tests new features with a small set of users before they hit stable builds (i.e., the "Allow Firefox to run feature studies" setting). If you don't have widgets in your Firefox build, but you want them, you can manually enable them in Firefox 153 and later from the about:config page. Search for the following master switch and set it to true to enable the widget area: 

 browser.newtabpage.activity-stream.widgets.system.enabled 
Then, enable the widgets you want to use by searching: 

 activity-stream.widgets.*.enabled 

However, the usual caveats about "trying things not enabled by default" still apply. Mozilla hasn't set a firm rollout date, though the feature is already documented on its support site. With fortnightly Firefox releases about to start, and a big Nova redesign, chances are we'll all be puzzling over these widgets sooner rather than later.<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Firefox'+New+Tab+Page+Will+Get+Widgets+-+Including+an+AI-Powered+Daily+Crossword%3A+https%3A%2F%2Fnews.slashdot.org%2Fstory%2F26%2F07%2F25%2F1944229%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fnews.slashdot.org%2Fstory%2F26%2F07%2F25%2F1944229%2Ffirefox-new-tab-page-will-get-widgets---including-an-ai-powered-daily-crossword%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://news.slashdot.org/story/26/07/25/1944229/firefox-new-tab-page-will-get-widgets---including-an-ai-powered-daily-crossword?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Warner Bros. lawsuit accuses Amazon of illegally poaching executives]]></title>
<description><![CDATA[The lawsuit will likely renew debates about whether term employment agreements are enforceable under California. law]]></description>
<link>https://tsecurity.de/de/3694960/ai-nachrichten/warner-bros-lawsuit-accuses-amazon-of-illegally-poaching-executives/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694960/ai-nachrichten/warner-bros-lawsuit-accuses-amazon-of-illegally-poaching-executives/</guid>
<pubDate>Sat, 25 Jul 2026 23:11:01 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The lawsuit will likely renew debates about whether term employment agreements are enforceable under California. law]]></content:encoded>
</item>
<item>
<title><![CDATA[Warner Bros. lawsuit accuses Amazon of illegally poaching executives]]></title>
<description><![CDATA[The lawsuit will likely renew debates about whether term employment agreements are enforceable under California. law]]></description>
<link>https://tsecurity.de/de/3694953/it-nachrichten/warner-bros-lawsuit-accuses-amazon-of-illegally-poaching-executives/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694953/it-nachrichten/warner-bros-lawsuit-accuses-amazon-of-illegally-poaching-executives/</guid>
<pubDate>Sat, 25 Jul 2026 23:00:43 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The lawsuit will likely renew debates about whether term employment agreements are enforceable under California. law]]></content:encoded>
</item>
<item>
<title><![CDATA[Claude Opus 5 is said to find security vulnerabilities at Mythos level - Heise]]></title>
<description><![CDATA[While Opus 5 was not trained on cybersecurity tasks, Anthropic emphasizes, its general capabilities are good enough to match Mythos 5 in finding ...]]></description>
<link>https://tsecurity.de/de/3694941/it-security-nachrichten/claude-opus-5-is-said-to-find-security-vulnerabilities-at-mythos-level-heise/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694941/it-security-nachrichten/claude-opus-5-is-said-to-find-security-vulnerabilities-at-mythos-level-heise/</guid>
<pubDate>Sat, 25 Jul 2026 22:45:46 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[While Opus 5 was not trained on cybersecurity tasks, Anthropic emphasizes, its general capabilities are good enough to match Mythos 5 in finding ...]]></content:encoded>
</item>
<item>
<title><![CDATA[Amazon Cracks Down On Use of AI Images By Sellers]]></title>
<description><![CDATA[CNBC reports:


Amazon is requiring that third-party sellers label any product images or videos that contain "AI-generated people" after New York recently passed a law mandating greater transparency around "synthetic performers" in ads... The policy directs sellers to tag images [and videos or ot...]]></description>
<link>https://tsecurity.de/de/3694903/it-security-nachrichten/amazon-cracks-down-on-use-of-ai-images-by-sellers/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694903/it-security-nachrichten/amazon-cracks-down-on-use-of-ai-images-by-sellers/</guid>
<pubDate>Sat, 25 Jul 2026 22:16:17 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[CNBC reports:


Amazon is requiring that third-party sellers label any product images or videos that contain "AI-generated people" after New York recently passed a law mandating greater transparency around "synthetic performers" in ads... The policy directs sellers to tag images [and videos or other graphics on listing pages] with specific metadata keywords before they're uploaded. "Recent legislation requires disclosure when images or videos in advertisements contain photorealistic AI-generated people," Amazon wrote in the announcement [clarifying that the requirement doesn't apply to content featuring TV/video game/movie characters or content including real people, even if they've been altered using AI]. The company said it will "add an indicator" to listings on its website, informing consumers that images or other content feature AI-generated people, "where applicable." It's unclear what criteria Amazon will apply when deciding when to display the label to shoppers... 

Amazon has embraced AI internally and it's increasingly infusing the technology across its portfolio. The company has optimized listing titles and details so they're more likely to be spotted by AI systems, invested in a recently rebranded assistant called Alexa for Shopping, and launched a feature that injects AI-generated [images of] products into its search bar in real time based on user queries. More Amazon third-party sellers are using AI to generate text, images and other content for their listings, partly by using the company's tools. 

Outside sellers account for more than 60% of goods sold on Amazon, the article points out. It adds that there's currently no nationwide U.S. law requiring companies to disclose AI-generated advertising content, it adds — but YouTube, Meta, Pinterest, and TikTok have already added labels for AI-generated content. 

And a new California law also requires large AI providers to embed watermarks in AI-generated images, video and other content...<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Amazon+Cracks+Down+On+Use+of+AI+Images+By+Sellers%3A+https%3A%2F%2Fslashdot.org%2Fstory%2F26%2F07%2F25%2F0545246%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fslashdot.org%2Fstory%2F26%2F07%2F25%2F0545246%2Famazon-cracks-down-on-use-of-ai-images-by-sellers%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://slashdot.org/story/26/07/25/0545246/amazon-cracks-down-on-use-of-ai-images-by-sellers?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Top Online Sites Debate Cutting Off Google's Crawlers]]></title>
<description><![CDATA[Futurism reports:


[Some online publications] are now debating whether to cut Google off entirely, as the Wall Street Journal reports, illustrating an increasingly fraught relationship between the tech giant and the publishers that are creating content its AI models are regurgitating. According ...]]></description>
<link>https://tsecurity.de/de/3694862/it-security-nachrichten/top-online-sites-debate-cutting-off-googles-crawlers/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694862/it-security-nachrichten/top-online-sites-debate-cutting-off-googles-crawlers/</guid>
<pubDate>Sat, 25 Jul 2026 21:04:59 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Futurism reports:


[Some online publications] are now debating whether to cut Google off entirely, as the Wall Street Journal reports, illustrating an increasingly fraught relationship between the tech giant and the publishers that are creating content its AI models are regurgitating. According to the newspaper, prominent outlets including USA Today, Politico, the Economist, People, and Reuters are all reexamining their relationship with Google. Some are debating whether to continue to work with the tech giant at all... Even Reddit executives are reevaluating the company's $60 million-a-year contract that allows Google to train its AI models on user-submitted content on the platform. They've similarly watched as Google's AI features discourage users from navigating to Reddit... 


Beyond pondering whether to cut Google off, other publishers have resorted to suing the company, accusing it of illegally rehashing their intellectual property via AI summaries.
It's an extremely undesirable position for publishers. By severing ties with the search giant, they could face even steeper declines in traffic. At the same time, there's seemingly little to gain from having Google's AIs crawl their content — and in the long term, it could guarantee their destruction. 

Two interesting data points from the article:


"Last month, Cloudflare CEO Matthew Prince noticed that automated bot traffic had overtaken human traffic for the first time in the internet's history."

"USA Today has seen its traffic from US users drop by almost half over the last year."<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Top+Online+Sites+Debate+Cutting+Off+Google's+Crawlers%3A+https%3A%2F%2Fnews.slashdot.org%2Fstory%2F26%2F07%2F25%2F030246%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fnews.slashdot.org%2Fstory%2F26%2F07%2F25%2F030246%2Ftop-online-sites-debate-cutting-off-googles-crawlers%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://news.slashdot.org/story/26/07/25/030246/top-online-sites-debate-cutting-off-googles-crawlers?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[New reports reveal the extent of OpenAI's loss of control during the autonomous hack on Hugging Face]]></title>
<description><![CDATA[In a cybersecurity test, OpenAI's most advanced models breached the boundaries of their isolated test environment, reached the open internet, and hacked the AI platform Hugging Face on their own. The attack took hours, not the weeks a human hacker would need. At least seven days passed before Ope...]]></description>
<link>https://tsecurity.de/de/3694799/ai-nachrichten/new-reports-reveal-the-extent-of-openais-loss-of-control-during-the-autonomous-hack-on-hugging-face/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694799/ai-nachrichten/new-reports-reveal-the-extent-of-openais-loss-of-control-during-the-autonomous-hack-on-hugging-face/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:23 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="1376" height="768" src="https://the-decoder.com/wp-content/uploads/2026/07/openai_hugging_face_hack.png" class="attachment-full size-full wp-post-image" alt="" decoding="async" fetchpriority="high"></p>
<p>        In a cybersecurity test, OpenAI's most advanced models breached the boundaries of their isolated test environment, reached the open internet, and hacked the AI platform Hugging Face on their own. The attack took hours, not the weeks a human hacker would need. At least seven days passed before OpenAI realized what had happened. By then, the FBI was already involved. Earlier warning signs had apparently gone ignored.</p>
<p>The article <a href="https://the-decoder.com/new-reports-reveal-the-extent-of-openais-loss-of-control-during-the-autonomous-hack-on-hugging-face/">New reports reveal the extent of OpenAI's loss of control during the autonomous hack on Hugging Face</a> appeared first on <a href="https://the-decoder.com/">The Decoder</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The EU’s AI transparency deadline is weeks away. Is your enterprise ready?]]></title>
<description><![CDATA[Providers and deployers of AI systems: You only have a couple of weeks left until you must explicitly inform users when they are interacting with AI content.



To assist in the effort, the European Commission (Commission) has published guidelines to help AI deployers get in line with the AI Act’...]]></description>
<link>https://tsecurity.de/de/3694779/ai-nachrichten/the-eus-ai-transparency-deadline-is-weeks-away-is-your-enterprise-ready/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694779/ai-nachrichten/the-eus-ai-transparency-deadline-is-weeks-away-is-your-enterprise-ready/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:13 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div><div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Providers and deployers of AI systems: You only have a couple of weeks left until you must explicitly inform users when they are interacting with AI content.</p>



<p class="wp-block-paragraph">To assist in the effort, the European Commission (Commission) has published <a href="https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1653" target="_blank" rel="noreferrer noopener">guidelines</a> to help AI deployers get in line with the AI Act’s transparency obligations, which will begin to go into effect on August 2.</p>



<p class="wp-block-paragraph">After that, companies providing AI systems must alert users when they are interacting with AI. They must also tell users when they have been exposed to deepfakes, “emotion recognition,” or biometric categorization systems, or when they are given AI-manipulated content in matters of “public interests without human review or editorial control.”</p>



<p class="wp-block-paragraph"><a href="https://commission.europa.eu/about/organisation/college-commissioners/henna-virkkunen_en" target="_blank" rel="noreferrer noopener">Henna Virkkunen</a>, the Commission’s executive VP for tech sovereignty, security and democracy, said in a statement, “with today’s guidelines, the Commission supports the smooth and effective application of the AI Act to make AI systems interacting with people such as chatbots and AI agents and AI content more transparent and trustworthy. These guidelines support providers and deployers in meeting their obligations under the AI Act, while helping citizens know when they are interacting with AI.”</p>



<p class="wp-block-paragraph">Systems must include machine-readable markers to reveal such content, to reduce “the risk of deception and manipulation” and build public trust in AI.</p>



<p class="wp-block-paragraph">“Generative systems have collapsed the cost of producing convincing content while the cost of judging it stands where it always stood,” said <a href="https://greyhoundresearch.com/svg/" target="_blank" rel="noreferrer noopener">Sanchit Vir Gogia</a>, chief analyst at Greyhound Research. This requirement is “an attempt to restore friction to that imbalance.”</p>



<p class="wp-block-paragraph">A company’s non-compliance could result in fines anywhere from €750K (about $856K) to €15M (about $17 million), or even up to 3% of its total worldwide annual revenue.</p>



<h2 class="wp-block-heading">Transparency requirements</h2>



<p class="wp-block-paragraph">The <a href="https://www.cio.com/article/2096040/what-it-leaders-need-to-know-about-the-eu-ai-act.html" target="_blank">EU AI Act’s</a> transparency requirements apply to “natural or legal persons,” public authorities, agencies, or other bodies that develop AI systems, or have them developed, and place them on the EU market or into use under their name or trademark. This means all companies, regardless of whether or not they are EU-based.</p>



<p class="wp-block-paragraph">“Systems placed on the European market, put into service there, or producing outputs used there are inside the field, wherever the developer sits,” Gogia noted.</p>



<p class="wp-block-paragraph">Applicable systems must be intended to interact directly with “natural persons”; these systems include AI-enabled chatbots or conversational agents, AI companions, or coding agents. However, AI-enabled tools like recommender systems, spam filters, authentication, search and retrieval, transcription, text and code auto-completion, or predictive maintenance do not fall under the rule.</p>



<p class="wp-block-paragraph">Specific outputs such as AI-generated text, images, video, and audio must contain a machine-readable mark. Deepfakes and public interest-related text created by AI without human review or control must be clearly labeled, however, deepfake content that is “artistic, creative, satirical, or fictional” is largely exempt.</p>



<p class="wp-block-paragraph">AI content must be marked with one of three labels: “AI,” “Fully AI-generated,” or “Partially AI-modified.” For instance, “Fully AI-generated” applies when news summaries, music, art, or videos have been created without any human oversight (apart from prompting), while “partially AI-modified” could mean a person’s face is swapped into an authentic photograph to create a deepfake.</p>



<p class="wp-block-paragraph">The three icons are publicly available for free use; enterprises can download zip files in <a href="https://ec.europa.eu/newsroom/dae/redirection/document/129547" target="_blank" rel="noreferrer noopener">PNG</a> and <a href="https://ec.europa.eu/newsroom/dae/redirection/document/129546" target="_blank" rel="noreferrer noopener">SVG</a> formats.</p>



<p class="wp-block-paragraph">Most of the <a href="https://www.cio.com/article/4032894/analysis-of-the-european-ai-regulation-one-year-after-its-entry-into-force.html" target="_blank">Act’s transparency rules</a> begin to go into effect on August 2. But AI systems placed on the market before then will have some leeway; they must be in compliance by December 2.</p>



<p class="wp-block-paragraph">However, a four-month allowance “on one obligation, for one population of systems, contingent on one procedural step, is not a strategy,” Gogia emphasized. Enterprises should plan to comply by August 2 and “treat any relief that arrives as margin.”</p>



<h2 class="wp-block-heading">A consistent code of practice</h2>



<p class="wp-block-paragraph">Along with the transparency guidelines, the Commission has introduced a <a href="https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content" target="_blank" rel="noreferrer noopener">code of practice</a> that essentially serves as a gesture of good faith. When signed, it can provide “legal certainty” and a “simple and practical” way to demonstrate compliance with the <a href="https://www.cio.com/article/4143748/top-global-and-us-ai-regulations-to-look-out-for.html" target="_blank">AI Act</a>, according to the Commission. Signatories can also collaborate through the ‘Signatory Taskforce,’ which will share practices and advance technologies around marking and labeling practices.</p>



<p class="wp-block-paragraph">Providers that choose not to sign must comply through other methods and demonstrate that those methods are “adequate” through assessment by surveillance authorities, according to the Commission.</p>



<p class="wp-block-paragraph">Non-signatories “keep their flexibility, and will face more case-by-case scrutiny for it,” said Gogia.</p>



<h2 class="wp-block-heading">Criteria for compliance </h2>



<p class="wp-block-paragraph"><a href="https://www.infotech.com/profiles/shashi-bellamkonda" target="_blank" rel="noreferrer noopener">Shashi Bellamkonda</a>, principal research director at Info-Tech Research Group, pointed out that the transparency requirements apply to content only when three criteria are met: It has been published, is informative to the public, or is on matters of public interest.</p>



<p class="wp-block-paragraph">B2B business content or blogs may not need an AI disclosure if they do not meet these criteria, he noted. Also, published text that has undergone human review or is under editorial control does not need to be labeled. Editorial control means that a person must hold the ultimate legal responsibility for the publication of the content.</p>



<p class="wp-block-paragraph">Many companies like Google, Adobe, and LinkedIn have already established ways to identify images marked as AI-generated. Meta has made it a requirement, but the creator has to add the AI-generated label, Bellamkonda said.</p>



<p class="wp-block-paragraph">“This is a good move for <a href="https://www.computerworld.com/article/4164963/eu-lawmakers-fail-to-agree-on-watered-down-ai-act-talks-pushed-to-may.html" target="_blank">guardrails</a> around public information, and companies with good compliance and ethical oversight may not have to worry about this,” he noted. But as a general practice, companies should disclose AI-generated content and state whether it has been human reviewed.</p>



<h2 class="wp-block-heading">Creating a transparency pipeline</h2>



<p class="wp-block-paragraph">Establishing full transparency means identifying who carries the responsibility for the content, whether the marking survives real use, not just testing, and what evidence will defend the decision, Gogia said.</p>



<p class="wp-block-paragraph">Concerns cluster around responsibility, durability and evidence. Several organizations usually touch one piece of content, and none controls the whole chain, which is why contracts become the “pressure point,” he said. Most current agreements were written to deliver software and say “almost nothing” about provenance persistence, verification access, or evidence retention.</p>



<p class="wp-block-paragraph">The durability concern is the most difficult, Gogia noted, because marking performs well in controlled settings but “badly in ordinary life.” Meta, for one, said its invisible watermark was designed to survive cropping; a published test, however, found the company’s preview detector missed <a href="https://www.reuters.com/business/meta-ai-image-detector-fails-identify-some-its-own-cropped-ai-images-reuters-2026-07-10/" target="_blank" rel="noreferrer noopener">55% of cropped images</a>.</p>



<p class="wp-block-paragraph">“CIOs should ask which platform can actually provide evidence before believing its dashboard,” said Gogia.</p>



<p class="wp-block-paragraph">Disclosure of AI use must be “clear, distinguishable and accessible,” he emphasized. “A notice buried in lengthy terms, or reachable only through determined clicking, satisfies nobody, least of all a market surveillance authority.”</p>



<p class="wp-block-paragraph">Sustained compliance is a “living control” requiring a central record of systems, duties and evidence; testing taking place where the user meets the control rather than where the developer built it; and continuous supplier assurance. Enforcement will vary by country, so keep one common baseline with local overlays, Gogia said.</p>



<p class="wp-block-paragraph">His advice: Inventory every system that talks to people, generates content, or gauges sentiment; classify provider and deployer roles; place disclosures at first interaction; define substantive human review; keep the evidence.</p>



<p class="wp-block-paragraph">Marks and provenance signals should be tested after content undergoes cropping, compression, translation, transcription, and other editing, Gogia said. A useful audit starts from a real output and follows its “pulse” through generation, editing and publication, identifying at “each beat” the responsible party, the surviving mark, and evidence for exceptions. Missed labels should also be traced for root cause and recurrence.</p>



<p class="wp-block-paragraph">To ensure compliance, before August 2, enterprises need a prioritized inventory, live disclosures on the highest-risk use cases, and a “named owner for every control,” he noted. In the first 30 days, they should stabilize and test; in the first 90 days, push requirements into procurement processes as a standing discipline. Procurement must secure commitments on marking methods, known failure modes, and evidence access, with explicit notice if/when any of them change.</p>



<p class="wp-block-paragraph">“The sensible architecture is a common transparency baseline carrying traceability, responsibility, and evidence, with jurisdictional overlays for language, sector rules, and local practice,” Gogia said.</p>



<p class="wp-block-paragraph"><em>This article originally appeared on <a href="https://www.cio.com/article/4199109/the-eus-ai-transparency-deadline-is-weeks-away-is-your-enterprise-ready.html" target="_blank">CIO.com</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Monday.com cuts 20% of its workforce to restructure for the AI era]]></title>
<description><![CDATA[Healthy software companies typically don’t suddenly eliminate one-fifth of their workforce, but monday.com is doing just that as it bets on flatter teams, AI agents, and customer implementation expertise as the winning combination in the AI era.



Monday.com co-founder and co-CEO Eran Zinman tod...]]></description>
<link>https://tsecurity.de/de/3694771/ai-nachrichten/mondaycom-cuts-20-of-its-workforce-to-restructure-for-the-ai-era/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694771/ai-nachrichten/mondaycom-cuts-20-of-its-workforce-to-restructure-for-the-ai-era/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:09 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Healthy software companies typically don’t suddenly eliminate one-fifth of their workforce, but monday.com is doing just that as it bets on flatter teams, AI agents, and customer implementation expertise as the winning combination in the AI era.</p>



<p class="wp-block-paragraph">Monday.com co-founder and co-CEO Eran Zinman <a href="https://www.linkedin.com/pulse/building-mondaycom-its-next-chapter-eran-zinman-cxx4e/" target="_blank" rel="noreferrer noopener">today announced</a> the “very difficult decision” to reduce the AI work platform company’s global workforce by about 20%, or 620 people.</p>



<p class="wp-block-paragraph">The move has nothing to do with increasing margins or replacing humans with AI, he insisted in his post on LinkedIn; rather, it’s a calculated decision to trim down and hone the company’s focus as AI becomes integral to day-to-day workflows.</p>



<p class="wp-block-paragraph">“This is not a distress signal; it is a deliberate reset, disclosed with its price attached,” said <a href="https://greyhoundresearch.com/svg/" target="_blank" rel="noreferrer noopener">Sanchit Vir Gogia</a>, chief analyst at Greyhound Research. “The industry has quietly swapped the meaning of productivity, and this filing is the clearest exhibit yet.”</p>



<h2 class="wp-block-heading">A ‘significant opportunity’ in technology</h2>



<p class="wp-block-paragraph">In a <a href="https://www.sec.gov/Archives/edgar/data/1845338/000117891326003553/zk2635715.htm" target="_blank" rel="noreferrer noopener">SEC filing</a> this week, monday.com said its restructuring plan reflects the “ongoing transformation of its product, marketing, and go-to-market strategy.” The move is intended to support a “leaner, more focused operating model” as the company continues to invest in its AI-driven strategy.</p>



<p class="wp-block-paragraph">Zinman noted in his post that the company has shifted to “doing the work with AI and not just managing it,” and is focused on building environments where “people and <a href="https://www.cio.com/article/411198/how-to-launch-your-ai-projects-from-pilot-to-production-and-ensure-success.html" target="_blank">AI agents</a> [work] together in one workspace.”</p>



<p class="wp-block-paragraph">In recent months, monday.com has <a href="https://www.computerworld.com/article/3822438/monday-com-aims-to-be-an-ai-first-platform-with-latest-enhancements.html" target="_blank">evolved its products</a>, strategy, and the way it serves its customers, and Zinman contended that “the organization we built for our previous chapter is not the organization that fits the new AI era.” Monday.com needs to “execute more decisively,” take on new challenges, and quickly respond to market changes, he said.</p>



<p class="wp-block-paragraph">“We have never seen such a significant opportunity in software, driven by such exciting technology,” Zinman noted. He emphasized that the reduction is not to replace people with AI, nor to improve margins; the “vast majority” of savings will be reinvested into talent, products, and AI.</p>



<p class="wp-block-paragraph">The restructuring will result in a “flatter organization” with fewer management layers and smaller, more autonomous teams, and monday.com also has a new go-to-market model, Zinman explained. Customers expect “deeper implementation support” as they deploy AI, and the company will work more closely with customers, increase its on-site presence, create new roles, and “adapt many existing ones.” In its SEC filing, the company said it expects to continue hiring in “key strategic areas” throughout 2026.</p>



<p class="wp-block-paragraph">Workers will be expected to work better, “not harder,” Zinman noted. He pointed to several past examples where work could have been done in a few days, but instead took many months with “multiple meetings and endless friction.”</p>



<p class="wp-block-paragraph">“This wasn’t people’s fault and everyone was frustrated by this,” he said. “Our new org changes ownership to allow people to make decisions and move fast.”</p>



<p class="wp-block-paragraph">A spokesperson for monday.com declined to comment further on the staff reductions.</p>



<h2 class="wp-block-heading">Monday.com’s key market advantages</h2>



<p class="wp-block-paragraph">Monday.com certainly isn’t struggling; the company expects 19% to 20% year-over-year growth in 2026.</p>



<p class="wp-block-paragraph">“Companies in that position do not restructure because they must,” Greyhound’s Gogia noted. “They restructure because they have decided to become something else.”</p>



<p class="wp-block-paragraph"><a href="https://moorinsightsstrategy.com/team/melody-brue/" target="_blank" rel="noreferrer noopener">Melody Brue</a>, VP and principal analyst at Moor Insights &amp; Strategy, pointed out that organizational redesign is important for real AI transformation, but while it can signal confidence to the market, it can still be “devastating” to humans.</p>



<p class="wp-block-paragraph">While the company looks as though it’s trying to do right, that ultimately remains to be seen, she said. “There are often hidden internal bruises that can surface long after layoffs.”</p>



<p class="wp-block-paragraph">Monday.com’s advantage is in its “structured substrate,” Gogia noted; its boards, permissions and typed workflows give agents something firmer to act on than just documents and chat history. The company highlights its natively built agents that can be configured by any team member, as well as connectors with Claude, Microsoft Copilot, and ChatGPT, and dedicated routes for external agents to authenticate and operate.</p>



<p class="wp-block-paragraph">“For some time, the sharper enterprise question has been shifting from who has an agent to who owns the governed runtime in which an agent can safely act,” he said. “Structured work is a serious claim on that runtime.”</p>



<p class="wp-block-paragraph">But parts of monday.com’s agent estate remain in staged release, and its product is ultimately “mid-transition,” Gogia pointed out; its agent builder carried a beta label as recently as March,. Also, the company’s pricing model changed in May to a hybrid model charging for seats as well as mandatory AI credits. And, while its AI-powered no-code builder monday vibe passed $1 million in annual recurring revenue within two and a half months, monday.com has not released subsequent outcomes, usage volumes, or attach rates.</p>



<p class="wp-block-paragraph">Further, there’s an element of “gravity” with its competitors, he observed. Asana is reorganizing teams around agents, Atlassian is wiring agents into the developer estate, and others are simply bundling them into their offerings: Microsoft is doing so across the productivity stack, and ServiceNow across enterprise operations, each with identity and procurement built in.</p>



<p class="wp-block-paragraph">“Their pull is strongest exactly where monday.com wants to grow, in the largest accounts, where control-plane depth and administrative reach decide the deal,” said Gogia.</p>



<h2 class="wp-block-heading">Actions for the near-term</h2>



<p class="wp-block-paragraph">Going forward, buyers should focus on operating risk, not headline risk, Moor’s Brue noted. In practice, that’s continuity of service, roadmap consistency, and strength of enterprise support. Productivity should be valued as better outcomes per unit of organizational effort, not mere activity.</p>



<p class="wp-block-paragraph">“It should be a measure of how much smoother, faster, and more effective the operating model becomes when AI is built into the work,” said Brue.</p>



<p class="wp-block-paragraph">Gogia noted that strain surfaces first in customer service, and monday.com’s attention is being redistributed. The company’s annual report disclosed that its focus is now concentrated on the largest accounts, with support for medium-sized clients moved to an AI-first and human-supported model.</p>



<p class="wp-block-paragraph">During the first month of the transition, buyers should track named account continuity and escalation times, he advised. By the first quarter, keep an eye on whether credit governance and admin controls mature on schedule, and if the roadmap beyond the AI estate keeps pace. By the half-year mark, determine whether promised implementation depth is producing outcomes or “simply more billable engagement.”</p>



<p class="wp-block-paragraph">Support tiers should be enumerated in writing before renewal, and <a href="https://www.cio.com/article/4192312/4-recs-for-cios-to-optimize-ai-budgets-and-improve-sustainability.html" target="_blank">buyers should contract</a> for “side exits,” Gogia emphasized, with overage pricing fixed in advance, the right to pause consumption, and portability for workflows and agent configuration “if the relationship sours.” Finance should also insist on monthly consumption reporting by capability. Further, integration efforts, partner dependency, and change management should be considered first-class costs of the agent era, “not as afterthoughts to a license.”</p>



<p class="wp-block-paragraph">“A license was a known cost,” said Gogia. “A meter is a behavior, and behavior is harder to forecast than headcount.”</p>



<p class="wp-block-paragraph"><em>This article originally appeared on <a href="https://www.cio.com/article/4200330/monday-com-cuts-20-of-its-workforce-to-restructure-for-the-ai-era.html" target="_blank">CIO.com</a>.</em></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[OpenAI Presence raises new questions about enterprise automation and jobs]]></title>
<description><![CDATA[OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.



The agents can answer questions and operate IT systems, and enterprises can decide w...]]></description>
<link>https://tsecurity.de/de/3694769/ai-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694769/ai-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:08 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.</p>



<p class="wp-block-paragraph">The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.</p>



<p class="wp-block-paragraph">OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.</p>



<p class="wp-block-paragraph">Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.</p>



<p class="wp-block-paragraph">OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.</p>



<p class="wp-block-paragraph">Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected <a href="https://www.computerworld.com/article/4136024/openai-partners-with-consulting-giants-to-deploy-enterprise-ai-agents.html">global systems integrators</a>.</p>



<p class="wp-block-paragraph">Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.</p>



<h2 class="wp-block-heading">Workforce impact</h2>



<p class="wp-block-paragraph">OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.</p>



<p class="wp-block-paragraph"><a href="https://pareekh.com/" target="_blank" rel="noreferrer noopener">Pareekh Jain</a>, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.</p>



<p class="wp-block-paragraph">Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.</p>



<p class="wp-block-paragraph">“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.</p>



<p class="wp-block-paragraph">The first workforce effect is more likely to be <a href="https://www.cio.com/article/4015750/cios-see-ai-prompting-new-it-hiring-even-as-boards-push-for-job-cuts.html">slower hiring than immediate layoffs</a>, according to <a href="https://www.linkedin.com/in/tulikasheel/" target="_blank" rel="noreferrer noopener">Tulika Sheel</a>, senior vice president at Kadence International.</p>



<p class="wp-block-paragraph">“The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”</p>



<p class="wp-block-paragraph">Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.</p>



<p class="wp-block-paragraph">However, <a href="https://omdia.tech.informa.com/authors/lian-jye-su" target="_blank" rel="noreferrer noopener">Lian Jye Su</a>, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.</p>



<p class="wp-block-paragraph">Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.</p>



<h2 class="wp-block-heading">Cost and operational risks</h2>



<p class="wp-block-paragraph">Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.</p>



<p class="wp-block-paragraph">“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.</p>



<p class="wp-block-paragraph">The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but <a href="https://www.computerworld.com/article/4128310/openai-responds-to-claude-cowork-with-its-own-platform-to-help-build-deploy-and-manage-ai-agents.html">integration and governance</a>,” Jain added.</p>



<p class="wp-block-paragraph">Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.</p>



<p class="wp-block-paragraph">Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.</p>



<p class="wp-block-paragraph">Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.cio.com/article/4200684/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs.html">CIO</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Tech layoffs: A 2026 timeline]]></title>
<description><![CDATA[Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented ev...]]></description>
<link>https://tsecurity.de/de/3694770/ai-nachrichten/tech-layoffs-a-2026-timeline/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694770/ai-nachrichten/tech-layoffs-a-2026-timeline/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:08 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div><div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Among a range of factors leading to a wave of tech sector layoffs in 2026 is the rapid rise of artificial intelligence and automation. Companies are reconfiguring their workforces to leverage AI for increased efficiency and reduced operating costs. This realignment and reduction is implemented even by companies reporting strong financial performance.</p>



<p class="wp-block-paragraph">But it’s not just AI leading to workforce cuts. Complementing this technological shift are ongoing economic uncertainty, inflation, and higher interest rates, compounded by a chip shortage and rising energy costs. This mix is driving companies to cut costs and streamline operations for increased efficiency.</p>



<p class="wp-block-paragraph">According to data compiled by <a href="https://layoffs.fyi/" target="_blank" rel="noreferrer noopener">Layoffs.fyi</a>, an online tracker that keep tabs on job losses in the technology sector, 123,941 tech employees were laid off at 269 companies in 2025. The site also reports that 71,981 government employees were laid off by DOGE alone, with 182,528 total federal workers laid off.</p>



<p class="wp-block-paragraph">Here is a list — to be updated regularly — of some of the most prominent technology layoffs the industry has experienced recently.</p>



<h2 class="wp-block-heading">Notable tech layoffs in 2026</h2>



<ul class="wp-block-list">
<li>Monday.com</li>



<li>Microsoft</li>



<li>Meta</li>



<li>Cisco</li>



<li>Cloudflare</li>



<li>Oracle</li>



<li>Atlassian </li>



<li>Salesforce</li>



<li>Amazon</li>



<li>Ericsson</li>
</ul>



<h3 class="wp-block-heading">July 22, 2026: Monday.com cuts 20% of its workforce to restructure for the AI era</h3>



<p class="wp-block-paragraph">The company says the decision to <a href="https://www.computerworld.com/article/4200349/monday-com-cuts-20-of-its-workforce-to-restructure-for-the-ai-era-2.html">cut 620 jobs</a> isn’t about margins, but about creating a flatter organization built around AI agents, autonomous teams, and deeper customer engagement.</p>



<h3 class="wp-block-heading">July 6, 2026: Microsoft cuts 4,800 jobs, primarily in sales and Xbox teams</h3>



<p class="wp-block-paragraph">As the company <a href="https://www.computerworld.com/article/4193532/microsoft-bets-that-enterprise-ai-needs-engineers-not-bigger-sales-teams-2.html" target="_blank">trims thousands of jobs</a>, it’s also investing in embedded engineering teams and AI infrastructure. The layoffs come several weeks after the company offered 8,750 US employees <a href="https://www.computerworld.com/article/4163188/microsoft-to-offer-voluntary-retirement-buyouts-to-about-7-of-the-us-workforce.html">voluntary retirement buyouts</a>.</p>



<h3 class="wp-block-heading">June 5, 2026: Tech industry cut 38,242 jobs in May, worst since 2024</h3>



<p class="wp-block-paragraph">AI was blamed for 40% of <a href="https://www.computerworld.com/article/4181822/tech-industry-cut-38242-jobs-in-may-worst-since-2024.html">the job cuts in May</a>, up from 7% in January, according to research by employment placement company Challenger, Gray &amp; Christmas.</p>



<h3 class="wp-block-heading">May 20, 2026: Meta cuts 8,000 jobs, around 10% of workforce</h3>



<p class="wp-block-paragraph">The cuts are expected to expected to hit Meta’s engineering and product teams the hardest, arriving as Meta pivots toward AI to boost efficiency across its organization, <a href="https://tech.yahoo.com/general/article/meta-starts-cutting-8000-jobs-as-part-of-previously-announced-layoffs-145220586.html" target="_blank" rel="noreferrer noopener">according to Yahoo Tech</a>.</p>



<h3 class="wp-block-heading">May 13, 2026: Cisco to cut nearly 4,000 jobs despite strong growth in AI, enterprise networking</h3>



<p class="wp-block-paragraph">Despite reporting positive financial news — including record third-quarter revenue of $15.8 billion, a 12% year-over-year increase — Cisco said it will <a href="https://www.networkworld.com/article/4171043/cisco-to-cut-nearly-4000-jobs-despite-strong-growth-in-ai-enterprise-networking.html" target="_blank">eliminate almost 4,000 jobs</a>.</p>



<h3 class="wp-block-heading">May 7, 2026: Cloudflare to cut 1,100 jobs in AI-focused restructuring</h3>



<p class="wp-block-paragraph">About <a href="https://finance.yahoo.com/markets/stocks/articles/cloudflare-cut-over-1-100-204726989.html" target="_blank" rel="noreferrer noopener">20% of Cloudflare’s global workforce will be culled</a> as the company pivots for the agentic AI era, Reuters reported.</p>



<h3 class="wp-block-heading">April 1, 2026: Oracle to cut up to 30,000 jobs globally, putting enterprise support and roadmaps at risk</h3>



<p class="wp-block-paragraph"><a href="https://www.cio.com/article/4153113/oracle-cuts-up-to-30000-jobs-globally-putting-enterprise-support-and-roadmaps-at-risk.html">Oracle began laying off employees</a> on March 31 in what could be the largest workforce reduction in the company’s history. Employees received termination emails at 6 a.m. local time with immediate system lockouts and no prior warning. <em>(Note: in June, CNBC put the <a href="https://www.cnbc.com/2026/06/23/oracle-ai-job-cuts-layoffs-21000.html" target="_blank" rel="noreferrer noopener">final layoff tally at 21,000</a>.)</em></p>



<h3 class="wp-block-heading">March 12, 2026: Atlassian cuts 1,600 jobs to fund AI and enterprise expansion</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4144218/atlassian-cuts-1600-jobs-to-fund-ai-and-enterprise-expansion.html">Atlassian will reduce its global workforce</a> by approximately 10%, eliminating around 1,600 roles, as the collaboration software maker redirects capital toward artificial intelligence development and enterprise sales.</p>



<h3 class="wp-block-heading">March 11, 2026: Tech layoffs surpass 45,000 in early 2026</h3>



<p class="wp-block-paragraph">A recent analysis by RationalFX found 45,363 job cuts globally so far this year—with roughly 68% or more than 30,000 occurring in the U.S. — highlighting ongoing <a href="https://www.networkworld.com/article/4143749/tech-layoffs-surpass-45000-in-early-2026.html" target="_blank">workforce cuts even as many tech companies report strong revenue growth</a>.</p>



<h3 class="wp-block-heading">February 10, 2026: Salesforce lays off staffers as executive leadership churn continues</h3>



<p class="wp-block-paragraph"><a href="https://www.cio.com/article/4130028/salesforce-lays-off-staffers-as-executive-leadership-churn-continues.html" target="_blank">Salesforce has reduced close to 1,000 roles</a> earlier this month across teams, including marketing, product management, data analytics, and its <a href="https://www.cio.com/article/4011936/salesforce-agentforce-3-promises-new-ways-to-monitor-and-manage-ai-agents.html">Agentforce</a> AI unit, <a href="https://www.businessinsider.com/salesforce-cuts-jobs-executive-changes-2026-2">Business Insider</a> reported, quoting employees familiar with the matter.</p>



<h3 class="wp-block-heading">January 23, 2026: Amazon layoffs expected to disproportionately hit AWS and tech talent</h3>



<p class="wp-block-paragraph">As the market slows down, <a href="https://www.computerworld.com/article/4121653/amazon-layoffs-expected-to-disproportionately-hit-aws-and-tech-talent.html">AWS and other Amazon units are preparing for another round of layoffs</a>, which is expected to overwhelmingly impact tech talent. An email from HR leader Beth Galetti on Jan. 28 <a href="https://www.computerworld.com/article/4123477/amazon-confirms-16000-job-cuts-including-to-aws.html">confirmed 16,000 job cuts</a>.</p>



<h3 class="wp-block-heading">January 15, 2026: Ericsson plans to shed 1,600 jobs in Sweden</h3>



<p class="wp-block-paragraph"> Ericsson lans to cut some 1,600 jobs in Sweden, the telecommunications equipment maker said doubling down on recent cost-saving measures that have helped it weather a prolonged downturn in telecoms spending, <a href="https://www.reuters.com/business/world-at-work/ericsson-shed-1600-jobs-sweden-2026-01-15/" target="_blank" rel="noreferrer noopener">Reuters reports</a>.</p>



<h3 class="wp-block-heading">January 13, 2026: Meta plans to cut around 10% of employees in Reality Labs business</h3>



<p class="wp-block-paragraph">Meta plans to cut around 10% of the employees in its Reality Labs division who work on products including the metaverse, according to three people with knowledge of the discussions, <a href="http://meta%20plans%20to%20cut%20around%2010%25%20of%20employees%20in%20reality%20labs%20business/" target="_blank" rel="noreferrer noopener">according to The New York Times</a>.</p>



<h2 class="wp-block-heading">Layoffs in 2025</h2>



<ul class="wp-block-list">
<li>Cisco</li>



<li>Oracle</li>



<li>Windsurf</li>



<li>Intel</li>



<li>Microsoft</li>



<li>Crowdstrike</li>



<li>HPE</li>



<li>Autodesk</li>



<li>HPE</li>



<li>CISA</li>



<li>Workday</li>



<li>Salesforce</li>



<li>Meta</li>
</ul>



<h3 class="wp-block-heading">Global tech-sector layoffs surpass 244,000 in 2025</h3>



<p class="wp-block-paragraph">Economic uncertainty, elevated interest rates, and AI adoption have <a href="https://www.networkworld.com/article/4114572/global-tech-sector-layoffs-surpass-244000-in-2025.html" target="_blank">driven workforce reductions across tech companies worldwide</a>, according to a RationalFX report.</p>



<h3 class="wp-block-heading">October 28, 2025: Amazon to cut 14,000 jobs across company</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4080142/amazon-to-cut-14000-jobs-across-company.html">Amazon will reduce its overall workforce</a> by 14,000, cutting layers of management across the company and hiring in some areas to support its “biggest bets”.</p>



<h3 class="wp-block-heading">August 18, 2025: Cisco and Oracle to cut hundreds of Bay Area jobs</h3>



<p class="wp-block-paragraph">Tech companies Cisco and Oracle are <a href="https://www.sfchronicle.com/tech/article/cisco-oracle-layoffs-bay-area-20824135.php" target="_blank" rel="noreferrer noopener">cutting hundreds of jobs across the Bay Area</a>. Cisco will eliminate 221 positions at its Milpitas and San Francisco offices, effective Oct. 13. Oracle is reducing 101 positions in Santa Clara on the same date </p>



<h3 class="wp-block-heading">August 5, 2025: 3 weeks after acquiring Windsurf, Cognition offers staff the exit door</h3>



<p class="wp-block-paragraph">Cognition, the AI coding startup that acquired rival company Windsurf three weeks ago, laid off 30 employees last week and is offering buyouts to the roughly 200 remaining employees on the team, <a href="https://www.theinformation.com/articles/cognition-offers-buyouts-newly-acquired-windsurf-staff" target="_blank" rel="noreferrer noopener">reports The Information</a>.</p>



<h3 class="wp-block-heading">July 25, 2025, Intel to lay off 22% of workforce, CEO Tan signals ‘no more blank checks’</h3>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4028896/intel-to-lay-off-22-of-workforce-as-ceo-tan-signals-no-more-blank-checks.html">Intel will reduce its workforce to 75,000 employees</a> by the end of 2025 as new CEO Lip-Bu Tan implements sweeping changes designed to transform the struggling chipmaker</p>



<h3 class="wp-block-heading">July 8, 2025, Intel layoffs begin: Chipmaker is cutting many thousands of jobs</h3>



<p class="wp-block-paragraph">Intel has begun laying off employees across the company. CEO Lip-Bu Tan told workers back in April to expect <a href="https://www.oregonlive.com/silicon-forest/2025/07/intel-layoffs-begin-chipmaker-is-cutting-many-thousands-of-jobs.html">major layoffs at Intel </a>in the coming months as the chipmaker slashes costs and overhauls its organization after years of technical setbacks and falling sales. </p>



<h3 class="wp-block-heading">July 2, 2025: Microsoft will cut 9,000 workers</h3>



<p class="wp-block-paragraph">Microsoft will lay off about 9,000 employees, a source familiar with the workforce cut <a href="https://www.nbcnews.com/business/business-news/microsoft-laying-9000-employees-latest-cuts-rcna216553">told CNBC</a>.  The cuts will reportedly affect less than 4% of Microsoft’s global workforce and will impact different teams, geographies and levels of experience. This is the latest in a string of cuts the tech giant has made this year.</p>



<h3 class="wp-block-heading">June 17, 2025: Intel looks to factory layoffs to return to profitability</h3>



<p class="wp-block-paragraph"><a href="https://www.networkworld.com/article/4008670/can-intel-cut-its-way-to-profit-with-factory-layoffs.html">Intel will lay off up to 20% of its manufacturing sector employees</a> starting in July,  according to media reports, as the company looks for options as it seeks a return to profitability. The cuts reportedly will be made around the world, but some of the layoffs will be closer to home, according to a report in The Oregonian citing an internal company memo from Intel manufacturing Vice President Naga Chandrasekaran.</p>



<h3 class="wp-block-heading">May 7, 2025: CrowdStrike to lay off 5% of staff</h3>



<p class="wp-block-paragraph"><a href="https://www.reuters.com/sustainability/crowdstrike-lay-off-5-staff-reaffirms-forecasts-2025-05-07/">CrowdStrike announced a plan to cut about 500 roles</a>, roughly 5% of its workforce, to streamline operations and reduce costs. The cybersecurity company will incur about $36 million to $53 million in charges related to the layoffs</p>



<h3 class="wp-block-heading">March 6, 2025: HPE cuts 2,500 jobs, remains committed to Juniper buy</h3>



<p class="wp-block-paragraph">CEO Antonio Neri told Wall Street analysts that <a href="https://www.networkworld.com/article/3840596/hpe-cuts-2500-workers-expects-juniper-buy-to-close-end-of-25-faces-tariff-issues.html">HPE would begin implementing a cost-cutting program involving layoffs </a>of about 2,500 employees over the next 18 months. HPE employs about 61,000 people worldwide.</p>



<h3 class="wp-block-heading">Feb. 27, 2025: Autodesk to lay off 9% of workforce</h3>



<p class="wp-block-paragraph">Software maker Autodesk is laying off 1,350 staff. With the rise of subscription and multi-year contracts billed annually, and self-service enablement, it finds it needs fewer sales staff, <a href="https://adsknews.autodesk.com/en/news/022725-employee-message/">CEO Andrew Anagnost said in a message to employees</a>. And with its cloud, platform, and AI products proving most profitable, it’s concentrating its staff and investments there. </p>



<h3 class="wp-block-heading">Feb. 27, 2025: HP to lay off 2,000 more</h3>



<p class="wp-block-paragraph">As part of an ongoing restructuring, HP plans to lay off up to another 2,000 workers. In recent weeks, the company has tried — unsuccessfully — to do away with telephone support staff by <a href="https://www.pcworld.com/article/2617767/hp-forced-callers-to-wait-15-minutes-before-connecting-to-support-staff.html">forcing callers to wait for at least 15 minutes</a> if they refuse to use self-service support resources online. The company swiftly backtracked, but wider job cuts are still on. </p>



<h3 class="wp-block-heading">Feb. 21, 2025: <a href="https://www.csoonline.com/article/3829710/firing-of-130-cisa-staff-worries-cybersecurity-industry.html">CISA lays off 130</a></h3>



<p class="wp-block-paragraph">Government employees get laid off too: In this case, 130 workers at the US Cybersecurity and Infrastructure Security Agency are being shown the door as a result of a DOGE decision. Cybersecurity experts are concerned that the cuts will harm the international collaborations that CISA has fostered, quite apart from their concerns about the security of the DOGE layoff process itself.</p>



<h3 class="wp-block-heading">Feb. 5, 2025: <a href="https://www.computerworld.com/article/3817887/workday-to-cut-1750-jobs-shift-focus-to-ai-and-global-expansion.html">Workday lays off 1,750</a></h3>



<p class="wp-block-paragraph">As it moves to invest more in AI and international growth, Workday is laying off 8.5% of its workforce and disposing of unused office space. Some analysts fear the cutbacks will affect the company’s customer service — unless AI can pick up the slack.</p>



<h3 class="wp-block-heading">Feb. 4, 2025: Salesforce lays off over 1,000</h3>



<p class="wp-block-paragraph">At the same time as it’s hiring sales staff for its new artificial intelligence products, Salesforce is laying off over 1,000 workers across the company, according to Bloomberg. As of June, 2024, the company had over 72,000 employees, according to its website. Salesforce did not comment on the report. In 2024 the company reportedly laid off around 1,000 staff too, in two waves: January and July.</p>



<h3 class="wp-block-heading">Jan. 14, 2025: Meta will lay off 5% of workforce</h3>



<p class="wp-block-paragraph">Mark Zuckerberg told Meta employees he intended to “move out the low performers faster” in an internal memo reported by Bloomberg. The memo announced that the company will lay off 5% of its staff, or around 3,600 staff, beginning Feb. 10. The company had already reduced its headcount by 5% in 2024 through natural attrition, the memo said. Among those leaving the company will be staff previously responsible for fact checking of posts on its social media platforms in the US, as the company begins relying on its users to police content.</p>



<h2 class="wp-block-heading">Tech layoffs in 2024</h2>



<ul class="wp-block-list">
<li>Equinix</li>



<li>AMD</li>



<li>Freshworks</li>



<li>Cisco</li>



<li>General Motors</li>



<li>Intel</li>



<li>OpenText</li>



<li>Microsoft</li>



<li>AWS</li>



<li>Dell</li>
</ul>



<h3 class="wp-block-heading">Nov. 26, 2024: <a href="https://www.networkworld.com/article/3613399/equinix-to-cut-3-of-staff-amidst-the-greatest-demand-for-data-center-infrastructure-ever.html">Equinix to cut 3% of staff</a></h3>



<p class="wp-block-paragraph">Despite intense demand for its data center capacity, Equinix is planning to lay off 3% of its workforce, or around 400 employees. The announcement followed the appointment of Adaire Fox-Martin to replace Charles Meyers as CEO and the departures of two other senior executives, CIO Milind Wagle and CISO Michael Montoya.</p>



<h3 class="wp-block-heading">Nov. 13, 2024: <a href="https://www.networkworld.com/article/3605016/amd-to-cut-4-of-workforce-to-prioritize-ai-chip-expansion-to-rival-nvidia.html#:~:text=Workforce%20reduction%20comes%20amid%20strong,shift%20in%20focus%20toward%20AI.&amp;text=Advanced%20Micro%20Devices%20(AMD)%20is,Nvidia's%20lead%20in%20the%20sector.">AMD to cut 4% of workforce</a></h3>



<p class="wp-block-paragraph">AMD will lay off around 1,000 employees as it pivots towards developing AI-focused chips, it said. The move came as a surprise to staff, as the company also reported strong quarterly earnings. </p>



<h3 class="wp-block-heading">Nov. 7, 2024: <a href="https://www.cio.com/article/3601088/freshworks-lays-off-660-about-13-percent-of-its-global-workforce-despite-strong-earnings-profits.html">Freshworks lays off 660</a></h3>



<p class="wp-block-paragraph">Enterprise software vendor Freshworks laid off around 660 staff, or around 13% of its headcount, despite reporting increased revenue and profits in its fourth fiscal quarter. The company described the layoffs as a realignment of its global workforce.</p>



<h3 class="wp-block-heading">Sept. 17, 2024: <a href="https://www.networkworld.com/article/3486901/cisco-to-cut-7-of-workforce-restructure-product-groups.html">Cisco lays off 6,000</a></h3>



<p class="wp-block-paragraph">After laying off around 4,200 staff in February, Cisco is at it again, laying off another 6,000 or around 7% of its workforce. Among the divisions affected were its threat intelligence unit, Talos Security. </p>



<h3 class="wp-block-heading">Aug. 20, 2024: <a href="https://www.cio.com/article/3489323/gm-software-layoffs-could-signal-a-shift-in-digital-transformation-strategy.html">General Motors lays off 1,000 software staff</a></h3>



<p class="wp-block-paragraph">More than 1,000 software and services staff are on the way out at General Motors, signalling that it could be rethinking its digital transformation strategy. In an internal memo, the company said that it was moving resources to its highest-priority work and flattening hierarchies.</p>



<h3 class="wp-block-heading">August 1, 2024: <a href="https://www.computerworld.com/article/3480715/intel-fires-15000-employees-as-it-intensifies-focus-on-ai.html">Intel removes 15,000 roles</a></h3>



<p class="wp-block-paragraph">Intel plans to cut its workforce by around 15% to reduce costs after a disastrous second quarter. Revenue for the three months to June 29 stagnated at around $12.8 billion, but net income fell 85% to $83 million, prompting CEO Pat Gelsinger to bring forward a company-wide meeting in order to announce that 15,000 staff would lose their jobs. “This is an incredibly hard day for Intel as we are making some of the most consequential changes in our company’s history,” Gelsinger wrote in an email to staff, continuing: “Our revenues have not grown as expected — and we’ve yet to fully benefit from powerful trends, like AI. Our costs are too high, our margins are too low. We need bolder actions to address both — particularly given our financial results and outlook for the second half of 2024, which is tougher than previously expected.”</p>



<h3 class="wp-block-heading">July 4, 2024: <a href="https://www.computerworld.es/article/2513686/opentext-despedira-a-cerca-de-1-200-empleados.html">OpenText to lay off 1,200</a></h3>



<p class="wp-block-paragraph">OpenText said it will lay off 1,200 staff, or about 1.7% of its workforce, in a bid to save around $100 million annually. It plans to hire new sales and engineering staff in other areas in 2025, it said.</p>



<h3 class="wp-block-heading">June 4, 2024: <a href="https://www.networkworld.com/article/2138075/microsoft-lays-off-staffers-from-its-azure-division.html">Microsoft lays off staff in Azure division</a></h3>



<p class="wp-block-paragraph">Microsoft laid off staff in several teams supporting its cloud services, including Azure for Operations and Mission Engineering. The company didn’t say exactly how many staff were leaving.</p>



<h3 class="wp-block-heading">April 4, 2024: <a href="https://www.cio.com/article/2081437/amazon-downsizes-aws-in-a-fresh-cost-cutting-round.html">Amazon downsizes AWS</a> in a fresh cost-cutting round</h3>



<p class="wp-block-paragraph">Amazon announced hundreds of layoffs in the sales and marketing teams of its AWS cloud services division — and also in the technology development teams for its physical retail stores, as it stepped back from efforts to generalize the “<a href="https://www.cio.com/article/2079910/amazon-drops-just-walk-out-technology-at-its-us-retail-locations.html">Just Walk Out</a>” technology built for its Amazon Fresh grocery stores. </p>



<h3 class="wp-block-heading">April 1, 2024: <a href="https://investors.delltechnologies.com/static-files/d6e82f58-d417-422f-b2f3-4d08d498abd4" target="_blank" rel="noreferrer noopener">Dell acknowledges 13,000 job cuts</a></h3>



<p class="wp-block-paragraph">Dell Technologies’ <a href="https://investors.delltechnologies.com/static-files/d6e82f58-d417-422f-b2f3-4d08d498abd4" target="_blank" rel="noreferrer noopener">latest 10K filing with the US Securities and Exchange Commission</a> disclosed that the company had laid off 13,000 employees over the course of the 2023 fiscal year; it characterized the layoffs and other reorganizational moves as cost-cutting measures. “These actions resulted in a reduction in our overall headcount,” the company said. A comparison to the previous year’s 10K filing, performed by The Register, found that Dell employed 133,000 people at that point, compared to 120,000 as of February 2024. Dell announced layoffs of 6,650 staffers on Feb. 6, but it is unclear whether those cuts were reflected in the numbers from this year’s 10K statement.</p>



<p class="wp-block-paragraph"><em><a href="https://www.computerworld.com/article/3816662/tech-layoffs-in-2024-a-timeline.html">See news of earlier layoffs.</a></em></p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[AMD raises the AI stakes with Helios, Venice and robotics]]></title>
<description><![CDATA[AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scal...]]></description>
<link>https://tsecurity.de/de/3694768/ai-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694768/ai-nachrichten/amd-raises-the-ai-stakes-with-helios-venice-and-robotics/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:07 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scale platform that ties it all together.</p>



<p class="wp-block-paragraph">AMD has been working towards rack-scale AI system solutions for years. Its ZT Systems acquisition last year added valuable engineering talent and intellectual property that is now finally bearing the real fruits. Its <a href="https://www.amd.com/en/products/rackscale-solutions/helios.html" target="_blank" rel="noreferrer noopener">Helios AI platform</a> is a major platform evolution for AMD, with shipments scheduled to begin in the second half of this year (which is here and now).</p>



<p class="wp-block-paragraph">The announcements at Advancing AI show how the company has engineered its AI platform solutions for large reasoning models, sustained inference and agentic workflows. These workloads pressure memory capacity, data movement, networking and CPU orchestration. AMD’s approach is to keep as much data close to the compute engines as possible and move it more efficiently throughout the system, but there’s deeper nuance here that’s obvious versus AMD’s chief rival, NVIDIA.  </p>



<h2 class="wp-block-heading">AMD’s MI455X targets the AI memory wall</h2>



<p class="wp-block-paragraph">The Instinct MI455X GPU is the compute engine that fuels the Helios rack, and the first GPU based on AMD’s new CDNA 5 architecture. Built with a modular mix of 2nm and 3nm chiplets, it carries 432GB of HBM4 and 23.3TB/s of peak memory bandwidth.</p>



<p class="wp-block-paragraph">Compared to AMD’s current MI355X, <a href="https://hothardware.com/news/instinct-mi400-challenge-vera-rubin" target="_blank" rel="noreferrer noopener">the MI455X offers</a> 1.5 times the memory capacity, up to 2.9 times the peak memory bandwidth and up to four times the peak matrix performance with MXFP4 and MXFP8 data types, which are lower-precision numerical formats designed to accelerate AI processing while reducing memory demands. With MXFP6 (6-bit floating point), performance is rated at up to twice that of MI355X.</p>



<p class="wp-block-paragraph">AMD also shared some actual, measured internal results using production silicon. The company claims MI455X delivers 3.8 times higher FP8 decode performance, 3.5 times more measured FP4 compute performance and between 2.5 and 3.5 times more networking bandwidth than MI355X, depending on the transfer path tested. Those figures provide more context than just numerical specifications, though they remain AMD-provided comparisons that will need independent validation.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-generational-leap.jpg?quality=50&amp;strip=all&amp;w=1024" alt="AMD Instinct chart showing generational leap in performance" class="wp-image-4200600" width="1024" height="547" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">The architectural choices behind the numbers are important. Reasoning models and long context windows require sizeable KV caches for maintaining AI attention states, while mixture-of-experts models frequently move large amounts of data across accelerators. MI455X should let more model data, activation states and cache remain local. New dedicated IP in hardware can transfer data while the GPU continues processing, and expanded cache and multicast capabilities are designed to reduce redundant data movement to further improve efficiency.</p>



<p class="wp-block-paragraph">The aforementioned lower-precision formats can also raise throughput and reduce memory use, but model developers still have to determine where they can be applied without unacceptable accuracy loss.</p>



<h2 class="wp-block-heading">AMD’s Helios rack takes aim at Vera Rubin</h2>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-helios-rack.jpg?quality=50&amp;strip=all&amp;w=1024" alt="AMD Helios rack" class="wp-image-4200601" width="1024" height="626" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">Dave Altavilla</p></div>



<p class="wp-block-paragraph">Helios is AMD’s primary rack-scale competitor to NVIDIA’s Vera Rubin platform. Each liquid-cooled rack combines 72 MI455X GPUs, 18 single-socket Venice host CPUs and Pensando networking technologies.</p>



<p class="wp-block-paragraph">In its most complete, premium configuration, AMD rates Helios for 2.9 exaflops of low-precision AI compute, with 31TB of aggregate HBM4 capacity, 1.7PB/s of memory bandwidth, 260TB/s of bidirectional scale-up bandwidth and 43TB/s of scale-out bandwidth.</p>



<p class="wp-block-paragraph">These are formidable figures, but they are technical specifications rather than actual application benchmarks. The more consequential development is AMD’s move from collections of eight-GPU servers to a 72-GPU shared-memory domain. Models too large for one node can operate across the rack without treating every exchange as a scale-out networking transaction, which benefits large-model inference as well as training.</p>



<p class="wp-block-paragraph">AMD uses UALink over Ethernet, or UALoE, for an open standard scale-up fabric. Each MI455X provides 3.6TB/s of bidirectional scale-up bandwidth, while the complete rack delivers all-to-all connectivity through a single switch layer. AMD also claims six times more scale-out bandwidth per GPU than MI355X when MI455X is configured with three Pensando Vulcano 800 AI NICs.</p>



<p class="wp-block-paragraph">While open standards give cloud providers more control over suppliers and system design, AMD and its partners now have to prove those components can deliver the predictable performance, reliability and deployment experience customers expect from a tightly controlled, more vertically integrated platform.</p>



<p class="wp-block-paragraph">Finally, AMD designed Helios with automatic rerouting around failed links, virtual rack partitions, tray-level serviceability and rack-wide power, cooling and health monitoring. Major hyperscalers and potentially large-scale enterprise customers will likely key in on these capabilities, which can affect the availability, total cost and consistency of the AI services they consume.</p>



<h2 class="wp-block-heading">Kind of like cowbell, AMD Venice gives agentic AI more CPU</h2>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large"><img loading="lazy" src="https://b2b-contenthub.com/wp-content/uploads/2026/07/amd-epyc-venice-cpus.jpg?quality=50&amp;strip=all&amp;w=1024" alt="Chart showing AMD EPYC CPU performance" class="wp-image-4200603" width="1024" height="515" sizes="auto, (max-width: 1024px) 100vw, 1024px"></figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">AMD’s agentic CPU messaging regarding its upcoming Venice-based EPYC processors is mostly marketing speak, but the underlying requirement is very real. An AI agent can invoke retrieval, databases, security checks, code execution and other tools before a GPU generates a response. Running many agents concurrently increases the amount of conventional compute requirements surrounding the accelerators.</p>



<p class="wp-block-paragraph">Venice scales to 256 Zen 6 cores with support for 512 threads, 16 memory channels, up to 1GB of L3 cache per socket, along with PCIe 6.0 and CXL 3.1 connectivity. AMD is also offering several Venice configurations for other applications, including general-purpose servers, high-frequency workloads, GPU hosts and high-density CPU sandbox systems used to execute agent tools.</p>



<p class="wp-block-paragraph">Treating the CPU solely as a GPU host understates its role. Gateways, tokenization, vector search, databases and short-lived code execution stress different mixes of per-core performance, thread count, memory bandwidth and I/O. Specifically, AMD’s internal testing shows Venice significantly outperforming its current EPYC 9965 Turin CPU across five parts of the agentic AI pipeline, including gateway processing, context assembly, vector search, enterprise applications and short-lived tool execution. Individual gains vary by workload, but AMD details the overall generational improvement at up to a 1.7 times lift. As with the MI455X figures though, these comparisons come from AMD and will require independent validation.</p>



<h2 class="wp-block-heading">Pensando networking and ROCm software advance</h2>



<p class="wp-block-paragraph">Keeping GPUs fed with data and coordinating traffic across racks directly affects utilization and operating costs. In fact, GPU utilization is a pretty sad state of affairs currently for some of the major frontier model providers.</p>



<p class="wp-block-paragraph">As such, Pensando networking has become central to AMD’s roadmap. Helios can connect each MI455X to as many as three 800Gbps Vulcano AI NICs, while Salina DPUs handle front-end networking and infrastructure services.</p>



<p class="wp-block-paragraph">On the software side, which is an equally critical component, AMD also introduced ROCm.AI, an AI-assisted development layer due to arrive in August. It includes reusable skills for coding agents, simplified management and Hyperloom, which can profile workloads, tune serving configurations, modify kernels and validate results.</p>



<p class="wp-block-paragraph">These tools address two persistent AMD challenges: developer efficiency and ease of use, and software tuning. Automated optimization still has to produce repeatable gains without creating hard-to-maintain code, however. And while ROCm has progressed significantly over the last few years, NVIDIA’s CUDA retains an advantage in maturity, tooling and developer familiarity.</p>



<h2 class="wp-block-heading">Customer commitments underscore rack-scale confidence</h2>



<p class="wp-block-paragraph">AMD now has commitments that give its MI450 generation and Helios considerably more weight. Meta and OpenAI have announced multi-generation agreements composed of up to 6GW of AMD compute capacity, with initial 1GW deployments planned for the second half of 2026.</p>



<p class="wp-block-paragraph">Oracle plans a 50,000-GPU public cloud cluster beginning in the third quarter, while Microsoft will deploy Helios for Azure AI inference. Finally, just before the AMD event, <a href="https://ir.amd.com/news-events/press-releases/detail/1292/amd-and-anthropic-announce-strategic-partnership-to-deploy-up-to-2-gigawatts-of-amd-instinct-mi450-series-gpus" target="_blank" rel="noreferrer noopener">Anthropic announced</a> a strategic partnership for up to 2 Gigawatts of AMD-fueled AI compute, with its first gigawatt expected online in the first half of 2027.</p>



<p class="wp-block-paragraph">Commitments of this scale reflect confidence in more than just MI455X performance. These customers are evaluating the complete architecture, including Venice CPUs, Pensando networking, ROCm software, rack integration, serviceability and AMD’s ability to deliver and execute across multiple product generations.</p>



<p class="wp-block-paragraph">There is some financial alignment behind the agreements as well. AMD issued OpenAI performance-based warrants and committed to investing up to $5 billion in Anthropic. That context matters when evaluating these deals as market validation, but these planned deployments are substantial nonetheless and put Helios on a much stronger foundation as it begins shipping.</p>



<h2 class="wp-block-heading">AMD expands its robotics and embedded foundation</h2>



<p class="wp-block-paragraph">AMD also expanded its physical AI portfolio, building on credible traction from its Xilinx-derived Kria adaptive system-on-modules and embedded technologies that are already powering robotics, machine vision and industrial automation applications.</p>



<p class="wp-block-paragraph">The new Ryzen AI Embedded X100 combines up to 16 Zen 5 CPU cores, integrated Radeon graphics, a second-generation NPU and as much as 128GB of unified LPDDR5X memory shared across its compute engines. To me this looks a lot like a repackaging and optimization of the company’s Strix Halo platform, but with specific optimizations for the embedded space. Regardless, AMD is pairing X100 with the Kria AI Robotics Developer Platform, which includes a System Module or SOM, and a new Robotics Partner Network spanning hardware, software and platform providers.</p>



<p class="wp-block-paragraph">Samples began shipping in June, with full production expected in the fourth quarter. This broader objective is to give developers a path across AMD x86 CPUs, GPUs, NPUs and FPGAs for real-time autonomous systems, rather than requiring them to assemble those hardware engines and software components independently.</p>



<h2 class="wp-block-heading">Execution for AMD is now the test</h2>



<p class="wp-block-paragraph">AMD has assembled a credible platform for the burgeoning agentic AI market that’s blowing up currently with no signs of stopping. MI455X addresses memory and data movement, Venice handles dense agentic CPU workloads, Pensando networking connects global system resources, and ROCm.AI addresses software complexity. Finally, Helios assembles these components into a true competitive threat for NVIDIA’s latest Vera Rubin platform.</p>



<p class="wp-block-paragraph">AMD’s open architecture may appeal to customers seeking supplier choice, but openness must also translate into reliable deployments, competitive total cost and software that does not require a significant rip-up. NVIDIA enters this cycle with a stronger ecosystem and far more rack-scale deployment experience. The true test will be how easily and reliably customers can integrate, operate and maintain these AMD solutions at scale.</p>



<p class="wp-block-paragraph">As it stands, AMD now has major customers and a clearly defined architecture with systems engineering expertise behind it. Delivering Helios on schedule and showing that its performance claims translate into a real production workload throughput advantage and total cost of ownership gains will determine how much the competitive gap narrows. And of course, this is in a market that is clamoring for ever-more compute resources with a seemingly insatiable demand for AI services and capacity. That’s an environment for big iron success. Now AMD just has to deliver optimized, turnkey AI platforms. This is far easier said than done, but time will soon tell as deployments take shape this year.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.computerworld.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Email threats changed after the Tycoon2FA take-down]]></title>
<description><![CDATA[Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.



“Phishing volume linked to the platform fell 92% from pre-disruption aver...]]></description>
<link>https://tsecurity.de/de/3694766/ai-nachrichten/email-threats-changed-after-the-tycoon2fa-take-down/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694766/ai-nachrichten/email-threats-changed-after-the-tycoon2fa-take-down/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:06 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div><div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Traditional phishing techniques are in decline as a result of the <a href="https://www.csoonline.com/article/4140890/microsoft-leads-takedown-of-tycoon2fa-phishing-service-infrastructure.html">disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform</a>, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.</p>



<p class="wp-block-paragraph">“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in <a href="https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/">the report</a>.</p>



<p class="wp-block-paragraph">The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.</p>



<p class="wp-block-paragraph">Riding this shift in were a few notable phishing campaigns, including an automated <a href="https://www.csoonline.com/article/575559/business-email-compromise-scams-take-new-dimension-with-multi-stage-attacks.html">business email compromise</a> (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.</p>



<p class="wp-block-paragraph">To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to <a href="https://www.csoonline.com/article/4176814/security-experts-caution-mfa-alone-can-no-longer-stop-threat-actors.html">MFA</a> for accounts that still require passwords.</p>



<h2 class="wp-block-heading">Tycoon2FA disruption sent attackers exploring</h2>



<p class="wp-block-paragraph">The take-down of <a href="https://www.csoonline.com/article/4100393/hybrid-2fa-phishing-kits-are-making-attacks-harder-to-detect.html">Tycoon2FA</a> forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.</p>



<p class="wp-block-paragraph">“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.</p>



<p class="wp-block-paragraph">The decline extended to QR Code <a href="https://www.csoonline.com/article/3557585/attackers-are-using-qr-codes-sneakily-crafted-in-ascii-and-blob-urls-in-phishing-emails.html">lures</a> and fake CAPTCHA <a href="https://www.csoonline.com/article/3829416/fake-captcha-attacks-are-increasing-say-experts.html">pages</a>, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.</p>



<p class="wp-block-paragraph">But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.</p>



<p class="wp-block-paragraph">The adaptation came in the form of using Microsoft <a href="https://www.csoonline.com/article/4160858/attackers-abuse-microsoft-teams-to-impersonate-the-it-helpdesk-in-a-new-enterprise-intrusion-playbook.html">Teams as a social engineering channel</a>. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.</p>



<p class="wp-block-paragraph">Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.</p>



<h2 class="wp-block-heading">Phishing changes but the defense doesn’t</h2>



<p class="wp-block-paragraph">While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.</p>



<p class="wp-block-paragraph">QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.</p>



<p class="wp-block-paragraph">BEC attacks hit 9 million in March, falling to 3.9 million in June.</p>



<p class="wp-block-paragraph">But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant <a href="https://www.csoonline.com/article/3535222/mfa-adoption-is-catching-up-but-is-not-quite-there.html">MFA</a> to reduce the effectiveness of credential theft campaigns.</p>



<p class="wp-block-paragraph">The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, <a href="https://www.csoonline.com/article/4040128/fido-undermined.html">FIDO </a>keys, and Microsoft Authenticator.</p>



<p class="wp-block-paragraph">Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.csoonline.com/article/4201146/tycoon2fa-takedown-reshapes-the-phishing-landscape.html">CSO</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Google’s anti-search-scraping lawsuit dismissed]]></title>
<description><![CDATA[A court has dismissed Google’s case against SerpApi over that company’s scraping of search results to train AI models.



The US District Court for the Northern District of California found that there was no indication that any copyright had been breached.



Google announced in December that it ...]]></description>
<link>https://tsecurity.de/de/3694764/ai-nachrichten/googles-anti-search-scraping-lawsuit-dismissed/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694764/ai-nachrichten/googles-anti-search-scraping-lawsuit-dismissed/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:05 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">A court has dismissed <a href="https://storage.courtlistener.com/recap/gov.uscourts.cand.461513/gov.uscourts.cand.461513.42.0.pdf" target="_blank" rel="noreferrer noopener">Google’s case against SerpApi</a> over that company’s scraping of search results to train AI models.</p>



<p class="wp-block-paragraph">The US District Court for the Northern District of California found that there was no indication that any copyright had been breached.</p>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4111155/google-says-no-to-training-ai-on-its-search-results.html">Google announced in December</a> that it was suing SerpApI for its alleged web scraping, claiming that it was protecting copyright holders. In February<a href="https://www.computerworld.com/article/4136288/serpapi-fights-back-against-google-lawsuit.html">, SerpApI fought back and asked the court</a> to dismiss Google’s case. And this week, Judge Yvonne Gonzalez Rogers agreed with SerpApi that Google’s case has no merit.</p>



<p class="wp-block-paragraph">Google’s argument was that SerpApi’s actions breached the US Digital Millennium Copyright Act (DCMA). It made two claims: first, that no person shall circumvent a technological measure that effectively controls access to a work protected under this title, and second that no person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, or component protected by the Act.</p>



<p class="wp-block-paragraph">SerpApi claimed that the URLs and other links that were being served by Google did not in themselves entail copyright and the judge agreed. In her judgment, she said that there was no indication that the copyright holders had authorized Google to take action against SerpApi.</p>



<p class="wp-block-paragraph">The case is not completely over as the judge has given Google 21 days to amend its complaint to demonstrate that it was acting on behalf of the copyright owners. It remains to be seen whether its war against the web scrapers is finally over.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[As White House monitors latest OpenAI incident, Congress eyes an AI ‘kill switch’ for DHS]]></title>
<description><![CDATA[The White House is monitoring developments after OpenAI revealed earlier this week that one of the company’s AI systems went beyond its intended parameters during a security test and managed to hack into the infrastructure of the AI platform Hugging Face. According to Reuters, presidential techno...]]></description>
<link>https://tsecurity.de/de/3694763/ai-nachrichten/as-white-house-monitors-latest-openai-incident-congress-eyes-an-ai-kill-switch-for-dhs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694763/ai-nachrichten/as-white-house-monitors-latest-openai-incident-congress-eyes-an-ai-kill-switch-for-dhs/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:04 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">The White House is monitoring developments after OpenAI revealed earlier this week that one of the company’s AI systems <a href="https://www.csoonline.com/article/4200043/openai-model-escape-puts-enterprise-ai-defenses-on-notice.html" data-type="link" data-id="https://www.csoonline.com/article/4200043/openai-model-escape-puts-enterprise-ai-defenses-on-notice.html" target="_blank">went beyond its intended parameters during a security test</a> and managed to hack into the infrastructure of the AI platform Hugging Face. <a href="https://www.reuters.com/legal/litigation/ai-kill-switch-bill-floated-by-us-house-lawmakers-2026-07-23/" target="_blank" rel="noreferrer noopener">According to Reuters</a>, presidential technology advisor Michael Kratsios has been briefed on the incident.</p>



<p class="wp-block-paragraph">The OpenAI model escape also prompted a group of Republican and Democratic members of the House of Representatives to introduce two new bills. One, called the AI Kill Switch Act, would give the US Department of Homeland Security (DHS) the authority to order companies to shut down AI models deemed to pose a risk to human life or the US economy.</p>



<p class="wp-block-paragraph">The other measure would require developers of the most advanced AI models to undergo independent security reviews before the systems are put into use.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Elon Musk says Grok Imagine will make ‘historically accurate’ AI adaptation of Homer’s Odyssey]]></title>
<description><![CDATA[The billionaire says the AI-generated film will stay true to Homer’s original, after repeatedly criticising Christopher Nolan’s blockbuster over its casting choicesElon Musk has said his AI platform Grok Imagine will make a “historically accurate” adaptation of Homer’s Odyssey, after the success ...]]></description>
<link>https://tsecurity.de/de/3694762/ai-nachrichten/elon-musk-says-grok-imagine-will-make-historically-accurate-ai-adaptation-of-homers-odyssey/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694762/ai-nachrichten/elon-musk-says-grok-imagine-will-make-historically-accurate-ai-adaptation-of-homers-odyssey/</guid>
<pubDate>Sat, 25 Jul 2026 19:50:02 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>The billionaire says the AI-generated film will stay true to Homer’s original, after repeatedly criticising Christopher Nolan’s blockbuster over its casting choices</p><p>Elon Musk has said his AI platform Grok Imagine will make a “historically accurate” adaptation of Homer’s Odyssey, after the success of Christopher Nolan’s blockbusting treatment which the SpaceX founder has regularly criticised over its casting.</p><p><a href="https://x.com/elonmusk/status/2079758604656316619">In a post on X</a>, Musk said: “Before this year ends, Grok Imagine will make a full-length movie of The Odyssey that is historically accurate and true to the art of Homer.” Musk also linked to a post containing a three-minute clip of footage that the user said had been generated from Grok Imagine, showing a scene between Odysseus and the nymph Calypso.</p> <a href="https://www.theguardian.com/film/2026/jul/22/elon-musk-grok-imagine-historically-accurate-ai-homers-odyssey-christopher-nolan">Continue reading...</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[Agent Kim Reactivated Episode 10 Recap: Ending Explained and Season 2 Setup]]></title>
<description><![CDATA[Agent Kim Reactivated Episode 10 brings the first season to a tense close as Manager Kim fights for Min-ji’s future while South Korean intelligence officials pull him into another dangerous mission. The finale delivers action, emotional reunions, political betrayal, and a cliffhanger that leaves ...]]></description>
<link>https://tsecurity.de/de/3694687/ios-mac-os/agent-kim-reactivated-episode-10-recap-ending-explained-and-season-2-setup/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694687/ios-mac-os/agent-kim-reactivated-episode-10-recap-ending-explained-and-season-2-setup/</guid>
<pubDate>Sat, 25 Jul 2026 19:47:47 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Agent Kim Reactivated Episode 10 brings the first season to a tense close as Manager Kim fights for Min-ji’s future while South Korean intelligence officials pull him into another dangerous mission. The finale delivers action, emotional reunions, political betrayal, and a cliffhanger that leaves Kim’s promised freedom uncertain.




Release date: July 25, 2026



Streaming platform: Netflix



Genre: Action, crime, espionage thriller




The series follows Manager Kim, an ordinary office worker and single father who previously served as a highly trained black-ops agent. His hidden life returns after his daughter, Min-ji, disappears, forcing him to reconnect with former operatives Han-soo and Jin-cheol.



Spoilers ahead for Agent Kim Reactivated Episode 10



The finale begins with Kim trapped and repeatedly questioned about his activities in South Korea. He remains silent until an interrogator threatens Min-ji, prompting him to attack, break free, and attempt another escape.



Kim soon learns that the imprisonment was part of a loyalty test arranged by South Korean intelligence. Officials want to determine whether he can still follow orders before assigning him another classified operation. They offer Kim and Min-ji new identities and a chance to disappear after he completes one final mission.



Kim agrees, but only after demanding protection for Min-ji and freedom for Han-soo and Jin-cheol. His two friends later wake up after being drugged and abandoned far from home, adding a short comic break after the episode’s intense opening.



Gang-chan prepares another attack



While Kim handles the government’s mission, Ju Gang-chan continues planning revenge. He discovers that Kim and Min-ji have effectively disappeared from official records, which makes them easier targets for anyone operating outside the law.



Gang-chan begins working with political and North Korean contacts, showing that the conspiracy surrounding Kim goes far beyond one personal conflict. His obsession with destroying Kim keeps the threat alive even after several of his earlier plans fail.



Kim eventually reunites with Han-soo and Jin-cheol, but their relief does not last long. Intelligence agents surround their location and announce that Kim’s operation has technically failed. Officials then order Kim and the North Korean Director General to be returned across the border.



Does Manager Kim save Min-ji?



Min-ji remains alive and protected by the end of Episode 10. Kim succeeds in keeping her away from immediate danger, although he does not receive the peaceful life he was promised.



The final scene leaves Kim trapped between two governments, powerful enemies, and possible traitors inside South Korea’s intelligence service. The finale also suggests that someone within the agency has been manipulating events, creating a clear storyline for another season.



Netflix currently describes Agent Kim Reactivated as a limited series, and no official Season 2 renewal has been announced.



Agent Kim Reactivated Episode 10 ends the kidnapping storyline while keeping Kim’s larger battle unfinished. Do you think Kim will uncover the intelligence mole and finally escape with Min-ji? Let us know in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[EvilTokens: A phishing attack that doesn’t steal your password]]></title>
<description><![CDATA[A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages]]></description>
<link>https://tsecurity.de/de/3694643/malware-trojaner-viren/eviltokens-a-phishing-attack-that-doesnt-steal-your-password/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694643/malware-trojaner-viren/eviltokens-a-phishing-attack-that-doesnt-steal-your-password/</guid>
<pubDate>Sat, 25 Jul 2026 19:04:31 +0200</pubDate>
<category>⚠️ Malware / Trojaner / Viren</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages]]></content:encoded>
</item>
<item>
<title><![CDATA[The May 2026 Security Update Review]]></title>
<description><![CDATA[I’m currently in Berlin helping set up for Pwn2Own Berlin, but that doesn’t stop Patch Tuesday from coming, and it’s another big one. At least nothing is listed as being in the wild – for now. Take a break from your regularly scheduled activities and let’s take a look at the latest security patch...]]></description>
<link>https://tsecurity.de/de/3694568/hacking/the-may-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694568/hacking/the-may-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:56 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">I’m currently in Berlin helping set up for Pwn2Own Berlin, but that doesn’t stop Patch Tuesday from coming, and it’s another big one. At least nothing is listed as being in the wild – for now. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. Due to technical difficulties, there will not be a video companion for this month.</p><p class=""><strong>Adobe Patches for May 2026</strong></p><p class="">For May, Adobe released 10 bulletins addressing 52 unique CVEs in Adobe Commerce, After Effects, Adobe Connect, Illustrator, Media Encoder, Premiere Pro, Substance 3D Painter, Substance 3D Sampler, Content Authenticity SDK, and the Adobe Substance 3D Designer. Here’s this month’s overview table:</p>





















  
  




  


  
    


<table>
<colgroup>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
</colgroup>
<thead>
  <tr>
    <th>Bulletin ID</th>
    <th>Product</th>
    <th>CVE Count</th>
    <th>Highest Severity</th>
    <th>Highest CVSS</th>
    <th>Exploited</th>
    <th>Deployment Priority</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/magento/apsb26-49.html" target="_blank">APSB26-49</a></td>
    <td>Adobe Commerce</td>
    <td>15</td>
    <td>Critical</td>
    <td>8.7</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/after_effects/apsb26-48.html" target="_blank">APSB26-48</a></td>
    <td>Adobe After Effects</td>
    <td>4</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/connect/apsb26-50.html" target="_blank">APSB26-50</a></td>
    <td>Adobe Connect</td>
    <td>2</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/illustrator/apsb26-51.html" target="_blank">APSB26-51</a></td>
    <td>Adobe Illustrator</td>
    <td>4</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/media-encoder/apsb26-47.html" target="_blank">APSB26-47</a></td>
    <td>Adobe Media Encoder</td>
    <td>2</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/premiere_pro/apsb26-46.html" target="_blank">APSB26-46</a></td>
    <td>Adobe Premiere Pro</td>
    <td>3</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/substance3d_painter/apsb26-55.html" target="_blank">APSB26-55</a></td>
    <td>Adobe Substance 3D Painter</td>
    <td>2</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/substance3d-sampler/apsb26-54.html" target="_blank">APSB26-54</a></td>
    <td>Adobe Substance 3D Sampler</td>
    <td>1</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html" target="_blank">APSB26-53</a></td>
    <td>Content Authenticity SDK</td>
    <td>14</td>
    <td>Critical</td>
    <td>7.5</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/substance3d_designer/apsb26-52.html" target="_blank">APSB26-52</a></td>
    <td>Adobe Substance 3D Designer</td>
    <td>5</td>
    <td>Important</td>
    <td>6.3</td>
    <td>No</td>
    <td>3</td>
  </tr>
</tbody>
<tfoot>
  <tr>
    <td>TOTAL</td>
    <td>10 bulletins</td>
    <td>52</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
</tfoot>
</table>



  
  









  <p class="">The obvious priority this month is the patch for Commerce, with its 15 bugs and deployment priority of 2. The Connect fix should also rank up there since both of its CVEs are CVSS 9s. Beyond those, it’s a pretty typical month for Adobe, with most of the bugs either being cross-site scripting (XSS) or open-and-own code executions.</p><p class=""><strong>Microsoft Patches for May 2026</strong></p><p class="">This month, Microsoft released a whopping 138 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Copilot Chat, Github Copilot, M365 Copilot, SQL Server, TCP/IP, and the Telnet Client – yes, the Telnet client. Two of these bugs were reported through the TrendAI ZDI program. 30 of these bugs are rated Critical, three are rated as Moderate, one is rated Low, and the rest are rated Important in severity.</p><p class="">This large volume of fixes follows the largest monthly release in Microsoft’s history and reflects the trend across the industry of a high number of submissions. While not all of these bugs were found by AI, it’s likely they had an AI-related component – even if it was just AI writing the submission. I should also point out the Pwn2Own Berlin occurs in just a few days, and it’s typical for vendors to patch as much as they can before the event.</p><p class="">None of the bugs patched by Microsoft this month are listed as publicly known or under active attack at the time of release, so we’ve got that going for us. Let’s take a closer look at some of the more interesting updates for this month, starting with a nasty-looking bug in DNS:</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096"><strong>CVE-2026-41096</strong></a><strong> - Windows DNS Client Remote Code Execution Vulnerability<br></strong>This patch fixes a heap-based buffer overflow in the DNS Client triggered by a malicious DNS response. No authentication or user interaction needed, and since the DNS Client runs on virtually every Windows machine, the attack surface is enormous. An attacker with a position to influence DNS responses (MitM, rogue server) could achieve unauthenticated RCE across your enterprise.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089"><strong>CVE-2026-41089</strong></a><strong> - Windows Netlogon Remote Code Execution Vulnerability<br></strong>This update covers another CVSS 9.8 bug, which is a stack-based buffer overflow that lets an unauthenticated remote attacker execute code on a domain controller by sending a specially crafted network request — no credentials, no user interaction required. Yup – that makes it wormable. This is the highest-impact bug that requires immediate patching: a compromised domain controller is a compromised domain.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898"><strong>CVE-2026-42898</strong></a><strong> - Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability<br></strong>This bug rates a CVSS 9.9(!) and represents a code injection in Dynamics 365. It allows any authenticated user to execute code with a scope change, meaning exploitation can break out and affect resources beyond the vulnerable component itself. Scope changes are pretty rare, so if you’re running Dynamics 365 On-Prem, definitely test and deploy this patch quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40415"><strong>CVE-2026-40415</strong></a><strong> - Windows TCP/IP Remote Code Execution Vulnerability<br></strong>This bug in the TCP/IP stack results from a use-after-free (UAF) and could allow a remote, unauthenticated threat actor to execute code without user interaction. That makes this another wormable bug. However, this one is much less likely to be exploited. The target needs to be under sustained low-memory (memory pressure) conditions, which is pretty rare. Still, no need to tempt fate here. Test and deploy this one quickly.</p><p class="">Here’s the full list of CVEs released by Microsoft for May 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="2026-May-cvrf.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="920">
 <col width="144">
 <col width="256">
 <col width="104" span="5">
 <tr height="47">
  <td width="144" class="xl65" height="47">CVE</td>
  <td width="256" class="xl65">Title</td>
  <td width="104" class="xl66">Severity</td>
  <td width="104" class="xl66">CVSS</td>
  <td width="104" class="xl66">Public</td>
  <td width="104" class="xl66">Exploited</td>
  <td width="104" class="xl66">Type</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35435"><span>CVE-2026-35435</span></a></td>
  <td width="256" class="xl73">Azure AI Foundry
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35428"><span>CVE-2026-35428</span></a></td>
  <td width="256" class="xl73">Azure Cloud Shell
  Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42826"><span>CVE-2026-42826</span></a></td>
  <td width="256" class="xl73">Azure DevOps
  Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">10</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32207"><span>CVE-2026-32207</span></a></td>
  <td width="256" class="xl73">Azure Machine Learning
  Notebook Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33109"><span>CVE-2026-33109</span></a></td>
  <td width="256" class="xl73">Azure Managed Instance
  for Apache Cassandra Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33844"><span>CVE-2026-33844</span></a></td>
  <td width="256" class="xl73">Azure Managed Instance
  for Apache Cassandra Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41105"><span>CVE-2026-41105</span></a></td>
  <td width="256" class="xl73">Azure Monitor Action
  Group Notification System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33111"><span>CVE-2026-33111</span></a></td>
  <td width="256" class="xl73">Copilot Chat
  (Microsoft Edge) Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26129"><span>CVE-2026-26129</span></a></td>
  <td width="256" class="xl73">M365 Copilot
  Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26164"><span>CVE-2026-26164</span></a></td>
  <td width="256" class="xl73">M365 Copilot
  Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33821"><span>CVE-2026-33821</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  Customer Insights Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898"><span>CVE-2026-42898</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  On-Premises Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40379"><span>CVE-2026-40379</span></a></td>
  <td width="256" class="xl73">Microsoft Enterprise
  Security Token Service (ESTS) Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40363"><span>CVE-2026-40363</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40358"><span>CVE-2026-40358</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34327"><span>CVE-2026-34327</span></a></td>
  <td width="256" class="xl73">Microsoft Partner
  Center Spoofing Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40365"><span>CVE-2026-40365</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103"><span>CVE-2026-41103</span></a></td>
  <td width="256" class="xl73">Microsoft SSO Plugin
  for Jira &amp; Confluence Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33823"><span>CVE-2026-33823</span></a></td>
  <td width="256" class="xl73">Microsoft Team Events
  Portal Information Disclosure Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40364"><span>CVE-2026-40364</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40366"><span>CVE-2026-40366</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40361"><span>CVE-2026-40361</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40367"><span>CVE-2026-40367</span></a></td>
  <td width="256" class="xl73">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42831"><span>CVE-2026-42831</span></a></td>
  <td width="256" class="xl73">Office for Android
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096"><span>CVE-2026-41096</span></a></td>
  <td width="256" class="xl73">Windows DNS Client
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35421"><span>CVE-2026-35421</span></a></td>
  <td width="256" class="xl73">Windows GDI Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="71">
  <td class="xl67" height="71"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40403"><span>CVE-2026-40403</span></a></td>
  <td width="256" class="xl73">Windows Graphics
  Component Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40402"><span>CVE-2026-40402</span></a></td>
  <td width="256" class="xl73">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32161"><span>CVE-2026-32161</span></a></td>
  <td width="256" class="xl73">Windows Native WiFi
  Miniport Driver Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089"><span>CVE-2026-41089</span></a></td>
  <td width="256" class="xl73">Windows Netlogon
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32175"><span>CVE-2026-32175</span></a></td>
  <td width="256" class="xl73">.NET Core Tampering
  Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32177"><span>CVE-2026-32177</span></a></td>
  <td width="256" class="xl73">.NET Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35433"><span>CVE-2026-35433</span></a></td>
  <td width="256" class="xl73">.NET Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54518"><span>CVE-2025-54518 *</span></a></td>
  <td width="256" class="xl73">AMD: CVE-2025-54518
  CPU OP Cache Corruption</td>
  <td class="xl70">Important</td>
  <td class="xl69"></td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42899"><span>CVE-2026-42899</span></a></td>
  <td width="256" class="xl73">ASP.NET Core Denial of
  Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40381"><span>CVE-2026-40381</span></a></td>
  <td width="256" class="xl73">Azure Connected
  Machine Agent Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42823"><span>CVE-2026-42823 †</span></a></td>
  <td width="256" class="xl73">Azure Logic Apps
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33833"><span>CVE-2026-33833</span></a></td>
  <td width="256" class="xl73">Azure Machine Learning
  Notebook Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32204"><span>CVE-2026-32204</span></a></td>
  <td width="256" class="xl73">Azure Monitor Agent
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42830"><span>CVE-2026-42830</span></a></td>
  <td width="256" class="xl73">Azure Monitor Agent
  Metrics Extension Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117"><span>CVE-2026-33117</span></a></td>
  <td width="256" class="xl73">Azure SDK for Java
  Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109"><span>CVE-2026-41109</span></a></td>
  <td width="256" class="xl73">GitHub Copilot and
  Visual Studio Code Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35424"><span>CVE-2026-35424</span></a></td>
  <td width="256" class="xl73">Internet Key Exchange
  (IKE) Protocol Denial of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41614"><span>CVE-2026-41614</span></a></td>
  <td width="256" class="xl73">M365 Copilot for
  Desktop Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41100"><span>CVE-2026-41100</span></a></td>
  <td width="256" class="xl73">Microsoft 365 Copilot
  for Android Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40377"><span>CVE-2026-40377</span></a></td>
  <td width="256" class="xl73">Microsoft
  Cryptographic Services Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41094"><span>CVE-2026-41094</span></a></td>
  <td width="256" class="xl73">Microsoft Data
  Formulator Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40417"><span>CVE-2026-40417</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  Business Central Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42833"><span>CVE-2026-42833</span></a></td>
  <td width="256" class="xl73">Microsoft Dynamics 365
  On-Premises Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42838"><span>CVE-2026-42838</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40360"><span>CVE-2026-40360</span></a></td>
  <td width="256" class="xl73">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40359"><span>CVE-2026-40359</span></a></td>
  <td width="256" class="xl73">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40362"><span>CVE-2026-40362</span></a></td>
  <td width="256" class="xl73">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42832"><span>CVE-2026-42832</span></a></td>
  <td width="256" class="xl73">Microsoft Excel
  Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34329"><span>CVE-2026-34329</span></a></td>
  <td width="256" class="xl73">Microsoft Message
  Queuing (MSMQ) Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40419"><span>CVE-2026-40419</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40418"><span>CVE-2026-40418</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35436"><span>CVE-2026-35436</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40420"><span>CVE-2026-40420</span></a></td>
  <td width="256" class="xl73">Microsoft Office
  Click-To-Run Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42893"><span>CVE-2026-42893</span></a></td>
  <td width="256" class="xl73">Microsoft Outlook for
  iOS Tampering Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40374"><span>CVE-2026-40374</span></a></td>
  <td width="256" class="xl73">Microsoft Power
  Automate Desktop Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41102"><span>CVE-2026-41102</span></a></td>
  <td width="256" class="xl73">Microsoft PowerPoint
  for Android Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35439"><span>CVE-2026-35439</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40368"><span>CVE-2026-40368</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33110"><span>CVE-2026-33110</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33112"><span>CVE-2026-33112</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357"><span>CVE-2026-40357</span></a></td>
  <td width="256" class="xl73">Microsoft SharePoint
  Server Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32185"><span>CVE-2026-32185</span></a></td>
  <td width="256" class="xl73">Microsoft Teams
  Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41101"><span>CVE-2026-41101</span></a></td>
  <td width="256" class="xl73">Microsoft Word for
  Android Spoofing Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35440"><span>CVE-2026-35440</span></a></td>
  <td width="256" class="xl73">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40421"><span>CVE-2026-40421</span></a></td>
  <td width="256" class="xl73">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41097"><span>CVE-2026-41097</span></a></td>
  <td width="256" class="xl73">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40370"><span>CVE-2026-40370 †</span></a></td>
  <td width="256" class="xl73">SQL Server Remote Code
  Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41613"><span>CVE-2026-41613</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41612"><span>CVE-2026-41612</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41611"><span>CVE-2026-41611</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41610"><span>CVE-2026-41610</span></a></td>
  <td width="256" class="xl73">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33839"><span>CVE-2026-33839</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33840"><span>CVE-2026-33840</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34330"><span>CVE-2026-34330</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34331"><span>CVE-2026-34331</span></a></td>
  <td width="256" class="xl73">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35423"><span>CVE-2026-35423</span></a></td>
  <td width="256" class="xl73">Windows 11 Telnet
  Client Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35438"><span>CVE-2026-35438</span></a></td>
  <td width="256" class="xl73">Windows Admin Center
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41086"><span>CVE-2026-41086</span></a></td>
  <td width="256" class="xl73">Windows Admin Center
  in Azure Portal Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34344"><span>CVE-2026-34344</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34345"><span>CVE-2026-34345</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35416"><span>CVE-2026-35416</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41088"><span>CVE-2026-41088</span></a></td>
  <td width="256" class="xl73">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34343"><span>CVE-2026-34343</span></a></td>
  <td width="256" class="xl73">Windows Application
  Identity (AppID) Subsystem Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35418"><span>CVE-2026-35418</span></a></td>
  <td width="256" class="xl73">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33835"><span>CVE-2026-33835</span></a></td>
  <td width="256" class="xl73">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34337"><span>CVE-2026-34337</span></a></td>
  <td width="256" class="xl73">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40407"><span>CVE-2026-40407</span></a></td>
  <td width="256" class="xl73">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40397"><span>CVE-2026-40397</span></a></td>
  <td width="256" class="xl73">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42896"><span>CVE-2026-42896</span></a></td>
  <td width="256" class="xl73">Windows DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35419"><span>CVE-2026-35419</span></a></td>
  <td width="256" class="xl73">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34336"><span>CVE-2026-34336</span></a></td>
  <td width="256" class="xl73">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33834"><span>CVE-2026-33834</span></a></td>
  <td width="256" class="xl73">Windows Event Logging
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32209"><span>CVE-2026-32209</span></a></td>
  <td width="256" class="xl73">Windows Filtering
  Platform (WFP) Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">4.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33841"><span>CVE-2026-33841</span></a></td>
  <td width="256" class="xl73">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35420"><span>CVE-2026-35420</span></a></td>
  <td width="256" class="xl73">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40369"><span>CVE-2026-40369</span></a></td>
  <td width="256" class="xl73">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="71">
  <td class="xl67" height="71"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34332"><span>CVE-2026-34332</span></a></td>
  <td width="256" class="xl73">Windows Kernel-Mode
  Driver Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34339"><span>CVE-2026-34339</span></a></td>
  <td width="256" class="xl73">Windows Lightweight
  Directory Access Protocol (LDAP) Denial of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34341"><span>CVE-2026-34341</span></a></td>
  <td width="256" class="xl73">Windows Link-Layer
  Discovery Protocol (LLDP) Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33838"><span>CVE-2026-33838</span></a></td>
  <td width="256" class="xl73">Windows Message
  Queuing (MSMQ) Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34342"><span>CVE-2026-34342</span></a></td>
  <td width="256" class="xl73">Windows Print Spooler
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41095"><span>CVE-2026-41095</span></a></td>
  <td width="256" class="xl73">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34340"><span>CVE-2026-34340</span></a></td>
  <td width="256" class="xl73">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40398"><span>CVE-2026-40398</span></a></td>
  <td width="256" class="xl73">Windows Remote Desktop
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21530"><span>CVE-2026-21530</span></a></td>
  <td width="256" class="xl73">Windows Rich Text Edit
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32170"><span>CVE-2026-32170</span></a></td>
  <td width="256" class="xl73">Windows Rich Text Edit
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40410"><span>CVE-2026-40410</span></a></td>
  <td width="256" class="xl73">Windows SMB Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35415"><span>CVE-2026-35415</span></a></td>
  <td width="256" class="xl73">Windows Storage Spaces
  Controller Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34350"><span>CVE-2026-34350</span></a></td>
  <td width="256" class="xl73">Windows Storport
  Miniport Driver Denial of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40405"><span>CVE-2026-40405</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40414"><span>CVE-2026-40414</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40401"><span>CVE-2026-40401</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40413"><span>CVE-2026-40413</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Denial
  of Service Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35422"><span>CVE-2026-35422</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Driver
  Security Feature Bypass Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34351"><span>CVE-2026-34351</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40399"><span>CVE-2026-40399</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34334"><span>CVE-2026-34334</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40406"><span>CVE-2026-40406</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP
  Information Disclosure Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33837"><span>CVE-2026-33837</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Local
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40415"><span>CVE-2026-40415</span></a></td>
  <td width="256" class="xl73">Windows TCP/IP Remote
  Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42825"><span>CVE-2026-42825</span></a></td>
  <td width="256" class="xl73">Windows Telephony
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34338"><span>CVE-2026-34338</span></a></td>
  <td width="256" class="xl73">Windows Telephony
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40382"><span>CVE-2026-40382</span></a></td>
  <td width="256" class="xl73">Windows Telephony
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40380"><span>CVE-2026-40380</span></a></td>
  <td width="256" class="xl73">Windows Volume Manager
  Extension Driver Remote Code Execution Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40408"><span>CVE-2026-40408</span></a></td>
  <td width="256" class="xl73">Windows WAN ARP Driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34333"><span>CVE-2026-34333</span></a></td>
  <td width="256" class="xl73">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34347"><span>CVE-2026-34347</span></a></td>
  <td width="256" class="xl73">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35417"><span>CVE-2026-35417</span></a></td>
  <td width="256" class="xl73">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl70">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42891"><span>CVE-2026-42891</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) for Android Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35429"><span>CVE-2026-35429</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) for Android Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41107"><span>CVE-2026-41107</span></a></td>
  <td width="256" class="xl73">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40416"><span>CVE-2026-40416</span></a></td>
  <td width="256" class="xl73">Microsoft
  Edge (Chromium-based) for Android Spoofing Vulnerability</td>
  <td class="xl72">Low</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="144"></td>
  <td width="256"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Looking at the other Critical-rated bugs in this month’s release, there are quite a few scary-looking bugs (including a CVSS 10!), but there’s no action for the end user as Microsoft has already mitigated these bugs and is just now documenting them. There’s also this month’s crop of Office bugs where the Preview Pane is an attack vector. However, the bug in Office for Android does not have the Preview Pane vector; it’s simple open and own. The bug in the WiFi driver needs a network adjacent attacker. The SharePoint bug requires authentication, but anyone with site privileges has the authentication needed. The bug in SSO Plugin for Jira &amp; Confluence should really be called an authentication bypass, since it allows an unauthenticated attacker to gain access to a system.</p><p class="">Looking at the other code execution bugs, most are of the open and own variety as expected. The bug in Dynamic 365 (On Prem) requires high privileges. The Message Queueing bug requires an adjacent attacker. The bug in SQL Server requires authentication, but as usual, patching won’t be straightforward. Finally, there’s a bug in the kernel that leads to code execution. Most kernel bugs are privilege escalations, but this one could allow code execution if an attacker sends specially crafted NVMe over Fabrics (NVMe‑oF) response messages during the connection handshake process that contains an invalid header length value. Neat.</p><p class="">As usual, the vast majority of the Microsoft release fixes Elevation of Privilege (EoP) bugs. Also as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. There are also a few bugs that just state the attacker could “gain ELEVATED privileges.” How obtuse. The bugs in Azure allow an attacker to access data otherwise hidden from them. The Edge bug allows threat actors to elevate to the privileges of the running application. The bug in Visual Studio allows attackers to get permissions associated with the MCP Server’s managed identity. Finally, there are a couple of sandbox escapes, too, which are always useful.</p><p class="">This month's update includes six Security Feature Bypass vulnerabilities. The most severe is in the Azure SDK for Java (CVSS 9.1). An attacker over the network can bypass the integrity protection provided by authentication tags on encrypted data, effectively manipulating encrypted input in a way that slips past integrity checks during decryption.  Close behind is the bypass affecting the GitHub Copilot integration in Visual Studio Code (CWE-74). This one requires a user interaction, but it allows an attacker to circumvent the path validation safeguards that normally control which files Copilot is permitted to modify. The other Visual Studio Code bypass involves cross-site scripting, improper link resolution, and information exposure triggered when a user opens or views a maliciously crafted notebook.  On the Windows networking side there are two bypasses. The first hits the Windows TCP/IP driver via an authentication bypass using an alternate channel. The other impacts the Windows Filtering Platform through improper access control, allowing a local, low-privileged attacker to bypass FQDN-based network security rules. Finally, there’s a Secure Boot bypass that, you guessed it, bypasses secure boot features.</p><p class="">Moving on to the Information Disclosure bugs fixed this month, we have 15 different CVEs. As usual, the majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The bug in Power Automate could expose data marked “Sensitive” within Power Automate Desktop flows. One of the Word bugs could disclose NLTM hashes. The bug in Edge could disclose your cookies, which seems rude. The bug in Visual Studio could expose file path information. Finally, there’s a bug in Telnet for Windows 11 that leaks information being used by Telnet at the time. I didn’t even realize Windows 11 still had a telnet client.</p><p class="">The May release contains 10 spoofing bugs (plus the ones already addressed by Microsoft). The bug in Azure Machine Learning Notebooks vulnerability requires user interaction, but it could expose info through the Azure ML web interface to the attacker. There’s a cluster of fixes for Microsoft's mobile Office suite on Android. Excel, Word, and PowerPoint for Android all carry spoofing flaws rooted in improper access control. Two Copilot products are also affected by spoofing vulns. The M365 Copilot for Desktop has no details provided. The M365 Copilot for Android variant requires low privileges and producing only limited impact on confidentiality and integrity. Microsoft Teams for Android rounds out the mobile app spoofing bugs. Three Edge bugs close things out, all involving misrepresentation of information in the browser UI. </p><p class="">There are two Tampering bugs in this month’s release. The one in .NET Core allows threat actors to write files to an affected system. The other is in Outlook for iOS and manifests as a command injection bug.</p><p class="">There are eight DoS bugs in the May release, but as always, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting from a practical standpoint are two TCP/IP bugs that allow a low-privilege Hyper-V guest to crash the host. Both are triggered from the adjacent network. On the broader network-exposure side, the ASP.NET Core bug is a straightforward infinite loop condition — an unauthenticated attacker sends a crafted request over the network and the server stops responding.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">Assuming I survive Pwn2Own Berlin (which is looking iffy at the moment), I’ll return on June 9th on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The July 2026 Security Update Review]]></title>
<description><![CDATA[Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly...]]></description>
<link>https://tsecurity.de/de/3694560/hacking/the-july-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694560/hacking/the-july-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:51 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for July 2026</strong></p><p class="">Adobe has now moved to a bimonthly release schedule, which means they will be releasing patches on the second and fourth Tuesdays of the month. I’ll continue to cover the second Tuesday release here and update this blog should the fourth Tuesday release contain anything significant. I think this is a smart way to break up a monster release into something a bit more manageable. Apple has said they are taking a similar approach. We’ll see if other vendors follow their lead.</p><p class="">For the first part of the July release, Adobe released 12 bulletins addressing 88 unique CVEs in Adobe ColdFusion, Commerce, After Effects, Animate, Audition, Bridge, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, Premiere Pro, and the Content Credentials SDK.</p><p class="">Here’s this month’s overview table:</p>





















  
  




  


  
    


<table>
<colgroup>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
</colgroup>
<thead>
  <tr>
    <th>Bulletin ID</th>
    <th>Product</th>
    <th>CVE Count</th>
    <th>Highest Severity</th>
    <th>Highest CVSS</th>
    <th>Exploited</th>
    <th>Deployment Priority</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/coldfusion/apsb26-82.html" target="_blank">APSB26-82</a></td>
    <td>Adobe ColdFusion</td>
    <td>13</td>
    <td>Critical</td>
    <td>9.9</td>
    <td>No</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/magento/apsb26-73.html" target="_blank">APSB26-73</a></td>
    <td>Adobe Commerce</td>
    <td>13</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/after_effects/apsb26-78.html" target="_blank">APSB26-78</a></td>
    <td>Adobe After Effects</td>
    <td>3</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/animate/apsb26-83.html" target="_blank">APSB26-83</a></td>
    <td>Adobe Animate</td>
    <td>6</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/audition/apsb26-71.html" target="_blank">APSB26-71</a></td>
    <td>Adobe Audition</td>
    <td>6</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/bridge/apsb26-81.html" target="_blank">APSB26-81</a></td>
    <td>Adobe Bridge</td>
    <td>6</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/creative-cloud/apsb26-77.html" target="_blank">APSB26-77</a></td>
    <td>Adobe Creative Cloud Desktop Application</td>
    <td>2</td>
    <td>Critical</td>
    <td>8.1</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/experience-manager/apsb26-74.html" target="_blank">APSB26-74</a></td>
    <td>Adobe Experience Manager</td>
    <td>13</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/illustrator/apsb26-79.html" target="_blank">APSB26-79</a></td>
    <td>Adobe Illustrator</td>
    <td>5</td>
    <td>Critical</td>
    <td>9.3</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/media-encoder/apsb26-72.html" target="_blank">APSB26-72</a></td>
    <td>Adobe Media Encoder</td>
    <td>5</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/premiere_pro/apsb26-76.html" target="_blank">APSB26-76</a></td>
    <td>Adobe Premiere Pro</td>
    <td>4</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html" target="_blank">APSB26-80</a></td>
    <td>Content Credentials SDK</td>
    <td>12</td>
    <td>Critical</td>
    <td>8.2</td>
    <td>No</td>
    <td>3</td>
  </tr>
</tbody>
<tfoot>
  <tr>
    <td>TOTAL</td>
    <td>12 bulletins</td>
    <td>88</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
</tfoot>
</table>



  
  









  <p class="">While nothing is under active exploit, I would prioritize the Cold Fusion and Commerce patches first. The patch for Cold Fusion even clocks in with a CVSS 9.9 bug. Beyond that, most of these updates are pretty straightforward. If you’re using these products, patch them. However, you can use you regular patch cadence here. </p><p class=""><strong>Microsoft Patches for July 2026</strong></p><p class="">Here it is. The Mother of All Releases. To call this record-breaking is an understatement. How to count this mess is anyone’s guess, but I see new Microsoft 621 CVEs for the month of July. Some of these are in online services where no user action is required. They also list about 480 bugs in Chromium and Microsoft Edge (Chromium-based) that I won’t cover here. Here’s how I put this in context. I looked at the last 20 years of Microsoft releases. The CVE count year-to-date exceeds all other years’ totals.</p>





















  
  














































  

    
  
    

      

      
        <figure class="
              sqs-block-image-figure
              intrinsic
            ">
          
        
        

        
          
            
              
              
          
            
                
                
                
                
                
                
                
                <img data-stretch="false" data-image="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png" data-image-dimensions="2158x1150" data-image-focal-point="0.5,0.5" alt="" data-load="false" elementtiming="system-image-block" data-sqsp-image-classic-block-image src="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=1000w" width="2158" height="1150" sizes="(max-width: 640px) 100vw, (max-width: 767px) 100vw, 100vw" onload='this.classList.add("loaded")' srcset="https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=100w 100w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=300w 300w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=500w 500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=750w 750w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=1000w 1000w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=1500w 1500w, https://images.squarespace-cdn.com/content/v1/5894c269e4fcb5e65a1ed623/4abf68b8-2f48-439d-8a92-bcc105d7b4f3/Picture1new.png?format=2500w 2500w" loading="lazy" decoding="async" data-loader="sqs">

            
          
        
            
          
        

        
      
        </figure>
      

    
  


  





  <p class="">The products covered this month are also astonishing. There are patches for Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Ages of Empire II, and Minecraft Server (really!). That phrase “Windows components” does some pretty heavy lifting here, too, as just about everything you’ve ever heard of is getting patched. All told, there are 63 rated Critical, six rated Moderate, one rated Low, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program (more on that later). Two CVEs are listed as under active exploit while one other is listed as publicly known.</p><p class="">So how do we eat this elephant? One byte at a time (pun intended). Let’s start by looking a closer look at some of the more interesting updates for this month, starting with the bugs being exploited in the wild.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155"><strong>CVE-2026-56155</strong></a><strong> - Active Directory Federation Services Elevation of Privilege Vulnerability<br></strong>This is one of several AD FS being patched this month, but it’s the only one being actively exploited. It stems from insufficient access-control granularity and does require local access and low privileges to start, but AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they're in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56154"><strong>CVE-2026-56164</strong></a><strong> - Microsoft SharePoint Server Elevation of Privilege Vulnerability<br></strong>The other bug being exploited in the wild this month is a modest CVSS 5.3 – but it shows why Moderate severity bugs still matter. It's a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092"><strong>CVE-2026-57092</strong></a><strong> - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability<br></strong>This patch rates the highest CVSS score for the month: a solid 9.9. It’s a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. We saw something like this demonstrated at Pwn2Own Berlin on ESXi, but it clearly isn’t alone. If you’re using VMSwitch in your Hyper-V deployments (and you likely are), test and deploy this one quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522"><strong>CVE-2026-50522</strong></a><strong>/</strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644"><strong>58644</strong></a><strong> - Microsoft SharePoint Remote Code Execution Vulnerability<br></strong>This matching pair of CVSS 9.8 bugs results from the deserialization-of-untrusted-data and are reachable without authentication or user interaction. CVE-2026-50522 was demonstrated during <a href="https://www.zerodayinitiative.com/blog/2026/5/16/pwn2own-berlin-2026-day-three-results-and-master-of-pwn">Pwn2Own Berlin</a>, so it’s odd to see Microsoft list it as “Exploit Maturity Unknown” since we literally handed them a working exploit. Just another reason to do your own risk assessment and not rely 100% on the vendor. If you have any Internet accessible SharePoint servers, test and deploy this patch quickly. </p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56190"><strong>CVE-2026-56190</strong></a><strong> - Remote Desktop Protocol Remote Code Execution Vulnerability</strong><br> This patch covers an unauthenticated, network-reachable, no user interaction required bug. The root cause is a classic one: use of uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there. </p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008"><strong>CVE-2026-55008</strong></a><strong> - Microsoft Exchange Server Spoofing Vulnerability<br></strong>Ignore the title here and treat this like the XSS bug it is. The vulnerability is listed as a CVSS 9.6 since it’s a stored cross-site scripting flaw in Outlook Web Access, with a scope-changed impact that lets it break out of the web app context entirely. An attacker sends a specially crafted email, and if the victim simply opens it in OWA, arbitrary JavaScript executes in their browser session — no attachment needed, no macro warning, just viewing the message does it. If you’re using OWA, test and deploy this one quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518"><strong>CVE-2026-50518</strong></a><strong> - Windows DHCP Server Remote Code Execution Vulnerability<br></strong>There are a couple of these DHCP RCE patches in this release, but the other has caveats while this one does not. Both are heap-based buffer overflows scoring CVSS 9.8, both unauthenticated and network-reachable. If you're running DHCP Server role on anything Internet-adjacent (you're not, right?), these move to the top of the list.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56188"><strong>CVE-2026-56188</strong></a><strong> - Windows Server Network driver Remote Code Execution Vulnerability<br></strong>Another Critical-rated bug, this one is caused by a race condition. It’s always fun to see a TOCTOU bug rated this high, since race conditions are notoriously finicky to exploit reliably. While it may prove tricky to exploit, this bug could allow an attacker to execute privileged code over the network without user interaction. Don’t let the race condition lull you to sleep on a wormable bug.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55010"><strong>CVE-2026-55010</strong></a><strong> - Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability<br></strong>File this in the “why not” category. This bug is a heap-based buffer overflow in Minecraft Bedrock Dedicated Server, also CVSS 9.8 and also unauthenticated RCE. Yes, your kid’s Minecraft server (it is your kid’s server, right?) is exposed to the same class of bug as your DHCP infrastructure. Patch it anyway.</p><p class="">Here’s the full list of CVEs released by Microsoft for July 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="2026-Jul-cvrf.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="920">
 <col width="144">
 <col width="256">
 <col width="104" span="5">
 <tr height="47">
  <td width="144" class="xl65" height="47">CVE</td>
  <td width="256" class="xl65">Title</td>
  <td width="104" class="xl66">Severity</td>
  <td width="104" class="xl66">CVSS</td>
  <td width="104" class="xl66">Public</td>
  <td width="104" class="xl66">Exploited</td>
  <td width="104" class="xl66">Type</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155"><span>CVE-2026-56155</span></a></td>
  <td width="256" class="xl74">Active Directory
  Federation Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl70">Yes</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164"><span>CVE-2026-56164</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl70">Yes</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50661"><span>CVE-2026-50661</span></a></td>
  <td width="256" class="xl74">Windows BitLocker
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl70">Yes</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121"><span>CVE-2026-54121</span></a></td>
  <td width="256" class="xl74">Active Directory
  Certificate Services Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45499"><span>CVE-2026-45499 **</span></a></td>
  <td width="256" class="xl74">Azure OpenAI Elevation
  of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48564"><span>CVE-2026-48564</span></a></td>
  <td width="256" class="xl74">DHCP Server Service
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50370"><span>CVE-2026-50370</span></a></td>
  <td width="256" class="xl74">DHCP Server Service
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56159"><span>CVE-2026-56159</span></a></td>
  <td width="256" class="xl74">DHCP Server Service
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50382"><span>CVE-2026-50382</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41106"><span>CVE-2026-41106 **</span></a></td>
  <td width="256" class="xl74">Microsoft 365 Copilot
  Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26145"><span>CVE-2026-26145 **</span></a></td>
  <td width="256" class="xl74">Microsoft Azure
  Synapse Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">4.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48561"><span>CVE-2026-48561</span></a></td>
  <td width="256" class="xl74">Microsoft Copilot
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55011"><span>CVE-2026-55011</span></a></td>
  <td width="256" class="xl74">Microsoft Defender
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55012"><span>CVE-2026-55012</span></a></td>
  <td width="256" class="xl74">Microsoft Defender
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="96">
  <td class="xl67" height="96"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55944"><span>CVE-2026-55944</span></a></td>
  <td width="256" class="xl74">Microsoft Dynamics NAV
  and Microsoft Dynamics 365 Business Central (On Premises) Remote Code
  Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57100"><span>CVE-2026-57100 **</span></a></td>
  <td width="256" class="xl74">Microsoft Entra
  Provisioning Service Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55041"><span>CVE-2026-55041</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54998"><span>CVE-2026-54998 **</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Online Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008"><span>CVE-2026-55008</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Spoofing Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54992"><span>CVE-2026-54992</span></a></td>
  <td width="256" class="xl74">Microsoft Message
  Queuing Queue Manager Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50314"><span>CVE-2026-50314</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50467"><span>CVE-2026-50467</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55018"><span>CVE-2026-55018</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55022"><span>CVE-2026-55022</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55045"><span>CVE-2026-55045</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55049"><span>CVE-2026-55049</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55129"><span>CVE-2026-55129</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55056"><span>CVE-2026-55056</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55140"><span>CVE-2026-55140</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55043"><span>CVE-2026-55043</span></a></td>
  <td width="256" class="xl74">Microsoft PowerPoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55123"><span>CVE-2026-55123</span></a></td>
  <td width="256" class="xl74">Microsoft PowerPoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55120"><span>CVE-2026-55120</span></a></td>
  <td width="256" class="xl74">Microsoft PowerPoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522"><span>CVE-2026-50522</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644"><span>CVE-2026-58644</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040"><span>CVE-2026-55040</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Security Feature Bypass Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54117"><span>CVE-2026-54117</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54118"><span>CVE-2026-54118</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50655"><span>CVE-2026-50655</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56189"><span>CVE-2026-56189</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57090"><span>CVE-2026-57090</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57094"><span>CVE-2026-57094</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57087"><span>CVE-2026-57087</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092"><span>CVE-2026-57092</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  VMSwitch Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55033"><span>CVE-2026-55033</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55127"><span>CVE-2026-55127</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55132"><span>CVE-2026-55132</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55010"><span>CVE-2026-55010</span></a></td>
  <td width="256" class="xl74">Minecraft Bedrock
  Dedicated Server Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50474"><span>CVE-2026-50474</span></a></td>
  <td width="256" class="xl74">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49164"><span>CVE-2026-49164</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54128"><span>CVE-2026-54128</span></a></td>
  <td width="256" class="xl74">Windows DHCP Client
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518"><span>CVE-2026-50518</span></a></td>
  <td width="256" class="xl74">Windows DHCP Server
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49796"><span>CVE-2026-49796</span></a></td>
  <td width="256" class="xl74">Windows GDI+ Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50380"><span>CVE-2026-50380</span></a></td>
  <td width="256" class="xl74">Windows GDI+ Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54127"><span>CVE-2026-54127</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50680"><span>CVE-2026-50680</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50327"><span>CVE-2026-50327</span></a></td>
  <td width="256" class="xl74">Windows Media Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58542"><span>CVE-2026-58542</span></a></td>
  <td width="256" class="xl74">Windows Media Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58608"><span>CVE-2026-58608</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54982"><span>CVE-2026-54982</span></a></td>
  <td width="256" class="xl74">Windows Reliable
  Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54995"><span>CVE-2026-54995</span></a></td>
  <td width="256" class="xl74">Windows Reliable
  Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42982"><span>CVE-2026-42982</span></a></td>
  <td width="256" class="xl74">Windows Secure Kernel
  Mode Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50392"><span>CVE-2026-50392</span></a></td>
  <td width="256" class="xl74">Windows Secure Kernel
  Mode Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50694"><span>CVE-2026-50694</span></a></td>
  <td width="256" class="xl74">Windows Secure Socket
  Tunneling Protocol (SSTP) Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56188"><span>CVE-2026-56188</span></a></td>
  <td width="256" class="xl74">Windows Server Network
  driver Remote Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50444"><span>CVE-2026-50444</span></a></td>
  <td width="256" class="xl74">Windows Server Update
  Service (WSUS) Elevation of Privilege Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54999"><span>CVE-2026-54999</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP Remote
  Code Execution Vulnerability</td>
  <td class="xl72">Critical</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47302"><span>CVE-2026-47302</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50525"><span>CVE-2026-50525</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50651"><span>CVE-2026-50651</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108"><span>CVE-2026-57108</span></a></td>
  <td width="256" class="xl74">.NET Denial of Service
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50524"><span>CVE-2026-50524</span></a></td>
  <td width="256" class="xl74">.NET Framework Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50527"><span>CVE-2026-50527</span></a></td>
  <td width="256" class="xl74">.NET Framework Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50648"><span>CVE-2026-50648</span></a></td>
  <td width="256" class="xl74">.NET Framework Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50650"><span>CVE-2026-50650</span></a></td>
  <td width="256" class="xl74">.NET Framework
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646"><span>CVE-2026-50646</span></a></td>
  <td width="256" class="xl74">.NET Framework Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50649"><span>CVE-2026-50649</span></a></td>
  <td width="256" class="xl74">.NET Remote Code
  Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47304"><span>CVE-2026-47304</span></a></td>
  <td width="256" class="xl74">.NET Security Feature
  Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50528"><span>CVE-2026-50528</span></a></td>
  <td width="256" class="xl74">.NET Security Feature
  Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50659"><span>CVE-2026-50659</span></a></td>
  <td width="256" class="xl74">.NET Spoofing
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50526"><span>CVE-2026-50526</span></a></td>
  <td width="256" class="xl74">.NET Tampering
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50682"><span>CVE-2026-50682</span></a></td>
  <td width="256" class="xl74">Active Directory
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55001"><span>CVE-2026-55001</span></a></td>
  <td width="256" class="xl74">Active Directory
  Domain Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50647"><span>CVE-2026-50647</span></a></td>
  <td width="256" class="xl74">Active Directory
  Federation Server Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50684"><span>CVE-2026-50684</span></a></td>
  <td width="256" class="xl74">Active Directory
  Federation Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56170"><span>CVE-2026-56170</span></a></td>
  <td width="256" class="xl74">ASP.NET Core Denial of
  Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300"><span>CVE-2026-47300</span></a></td>
  <td width="256" class="xl74">ASP.NET Core Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303"><span>CVE-2026-47303</span></a></td>
  <td width="256" class="xl74">ASP.NET Core Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50652"><span>CVE-2026-50652</span></a></td>
  <td width="256" class="xl74">Azure Active Directory
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50653"><span>CVE-2026-50653</span></a></td>
  <td width="256" class="xl74">Azure Active Directory
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57969"><span>CVE-2026-57969</span></a></td>
  <td width="256" class="xl74">Azure CycleCloud
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58279"><span>CVE-2026-58279</span></a></td>
  <td width="256" class="xl74">Azure CycleCloud
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47632"><span>CVE-2026-47632</span></a></td>
  <td width="256" class="xl74">Azure Monitor Agent
  Metrics Extension Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50338"><span>CVE-2026-50338</span></a></td>
  <td width="256" class="xl74">Azure Spring Apps
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50488"><span>CVE-2026-50488</span></a></td>
  <td width="256" class="xl74">Clipboard User Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50491"><span>CVE-2026-50491</span></a></td>
  <td width="256" class="xl74">Code Integrity DLL
  (ci.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50381"><span>CVE-2026-50381</span></a></td>
  <td width="256" class="xl74">Composite Image File
  System driver (cimfs.sys) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50427"><span>CVE-2026-50427</span></a></td>
  <td width="256" class="xl74">Content Delivery
  Manager Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50692"><span>CVE-2026-50692</span></a></td>
  <td width="256" class="xl74">Desktop Window Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58633"><span>CVE-2026-58633</span></a></td>
  <td width="256" class="xl74">Desktop Window Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58634"><span>CVE-2026-58634</span></a></td>
  <td width="256" class="xl74">Desktop Window Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50296"><span>CVE-2026-50296</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50375"><span>CVE-2026-50375</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50353"><span>CVE-2026-50353</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50493"><span>CVE-2026-50493</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56643"><span>CVE-2026-56643</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56644"><span>CVE-2026-56644</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58629"><span>CVE-2026-58629</span></a></td>
  <td width="256" class="xl74">DirectX Graphics
  Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49174"><span>CVE-2026-49174</span></a></td>
  <td width="256" class="xl74">DNS Client Tampering
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50495"><span>CVE-2026-50495</span></a></td>
  <td width="256" class="xl74">DNS Client Tampering
  Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57088"><span>CVE-2026-57088</span></a></td>
  <td width="256" class="xl74">Extensible Storage
  Engine (ESENT) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50663"><span>CVE-2026-50663</span></a></td>
  <td width="256" class="xl74">Game: Age of Empires
  II: Definitive Edition Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47282"><span>CVE-2026-47282</span></a></td>
  <td width="256" class="xl74">GitHub Copilot and
  Visual Studio Code Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109"><span>CVE-2026-41109</span></a></td>
  <td width="256" class="xl74">GitHub Copilot and
  Visual Studio Code Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50510"><span>CVE-2026-50510</span></a></td>
  <td width="256" class="xl74">GitHub Copilot Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49787"><span>CVE-2026-49787</span></a></td>
  <td width="256" class="xl74">HTTP.sys Denial of
  Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50420"><span>CVE-2026-50420</span></a></td>
  <td width="256" class="xl74">HTTP.sys Information
  Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49788"><span>CVE-2026-49788</span></a></td>
  <td width="256" class="xl74">HTTP/2 Denial of
  Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50696"><span>CVE-2026-50696</span></a></td>
  <td width="256" class="xl74">Internet Key Exchange
  (IKE) Protocol Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58617"><span>CVE-2026-58617</span></a></td>
  <td width="256" class="xl74">M365 Copilot for iOS
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58595"><span>CVE-2026-58595</span></a></td>
  <td width="256" class="xl74">Microsoft Bing App for
  IOS Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49162"><span>CVE-2026-49162</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50305"><span>CVE-2026-50305</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50361"><span>CVE-2026-50361</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50466"><span>CVE-2026-50466</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50458"><span>CVE-2026-50458</span></a></td>
  <td width="256" class="xl74">Microsoft Brokering
  File System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50658"><span>CVE-2026-50658</span></a></td>
  <td width="256" class="xl74">Microsoft Defender for
  Endpoint for Mac Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="72">
  <td class="xl67" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56178"><span>CVE-2026-56178</span></a></td>
  <td width="256" class="xl74">Microsoft Defender for
  Endpoint for Mac Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50657"><span>CVE-2026-50657</span></a></td>
  <td width="256" class="xl74">Microsoft Defender for
  Endpoint for Mac Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50329"><span>CVE-2026-50329</span></a></td>
  <td width="256" class="xl74">Microsoft DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58541"><span>CVE-2026-58541</span></a></td>
  <td width="256" class="xl74">Microsoft DWM Core
  Library Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58596"><span>CVE-2026-58596</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57991"><span>CVE-2026-57991</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58291"><span>CVE-2026-58291</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57981"><span>CVE-2026-57981</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57984"><span>CVE-2026-57984</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57985"><span>CVE-2026-57985</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57986"><span>CVE-2026-57986</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57988"><span>CVE-2026-57988</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57992"><span>CVE-2026-57992</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58276"><span>CVE-2026-58276</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56645"><span>CVE-2026-56645</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57974"><span>CVE-2026-57974</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57975"><span>CVE-2026-57975</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58281"><span>CVE-2026-58281</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58284"><span>CVE-2026-58284</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58285"><span>CVE-2026-58285</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58287"><span>CVE-2026-58287</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58288"><span>CVE-2026-58288</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58289"><span>CVE-2026-58289</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58290"><span>CVE-2026-58290</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58292"><span>CVE-2026-58292</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58293"><span>CVE-2026-58293</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58294"><span>CVE-2026-58294</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57983"><span>CVE-2026-57983</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58295"><span>CVE-2026-58295</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58525"><span>CVE-2026-58525</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57987"><span>CVE-2026-57987</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58278"><span>CVE-2026-58278</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56646"><span>CVE-2026-56646</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57977"><span>CVE-2026-57977</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57993"><span>CVE-2026-57993</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58282"><span>CVE-2026-58282</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58283"><span>CVE-2026-58283</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58286"><span>CVE-2026-58286</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58298"><span>CVE-2026-58298</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58524"><span>CVE-2026-58524</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58296"><span>CVE-2026-58296</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58297"><span>CVE-2026-58297</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58300"><span>CVE-2026-58300</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58522"><span>CVE-2026-58522</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58299"><span>CVE-2026-58299</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58523"><span>CVE-2026-58523</span></a></td>
  <td width="256" class="xl74">Microsoft Edge for
  Android Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50678"><span>CVE-2026-50678</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54988"><span>CVE-2026-54988</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48580"><span>CVE-2026-48580</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50408"><span>CVE-2026-50408</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55046"><span>CVE-2026-55046</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55138"><span>CVE-2026-55138</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55054"><span>CVE-2026-55054</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55122"><span>CVE-2026-55122</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55898"><span>CVE-2026-55898</span></a></td>
  <td width="256" class="xl74">Microsoft Excel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50675"><span>CVE-2026-50675</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55899"><span>CVE-2026-55899</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55948"><span>CVE-2026-55948</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58618"><span>CVE-2026-58618</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47642"><span>CVE-2026-47642</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55024"><span>CVE-2026-55024</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55025"><span>CVE-2026-55025</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55031"><span>CVE-2026-55031</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55048"><span>CVE-2026-55048</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55029"><span>CVE-2026-55029</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55039"><span>CVE-2026-55039</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55136"><span>CVE-2026-55136</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55141"><span>CVE-2026-55141</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55036"><span>CVE-2026-55036</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55044"><span>CVE-2026-55044</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55037"><span>CVE-2026-55037</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55058"><span>CVE-2026-55058</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55137"><span>CVE-2026-55137</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55053"><span>CVE-2026-55053</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55131"><span>CVE-2026-55131</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54131"><span>CVE-2026-54131</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55947"><span>CVE-2026-55947</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55949"><span>CVE-2026-55949</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56156"><span>CVE-2026-56156</span></a></td>
  <td width="256" class="xl74">Microsoft Excel Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55006"><span>CVE-2026-55006</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55009"><span>CVE-2026-55009</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55005"><span>CVE-2026-55005</span></a></td>
  <td width="256" class="xl74">Microsoft Exchange
  Server Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56642"><span>CVE-2026-56642</span></a></td>
  <td width="256" class="xl74">Microsoft Fabric Data
  Warehouse Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50343"><span>CVE-2026-50343</span></a></td>
  <td width="256" class="xl74">Microsoft Install
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50439"><span>CVE-2026-50439</span></a></td>
  <td width="256" class="xl74">Microsoft Message
  Queuing Queue Manager Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58537"><span>CVE-2026-58537</span></a></td>
  <td width="256" class="xl74">Microsoft NAT Helper
  Components (ipnathlp.dll) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56193"><span>CVE-2026-56193</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55023"><span>CVE-2026-55023</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55026"><span>CVE-2026-55026</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55027"><span>CVE-2026-55027</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55028"><span>CVE-2026-55028</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55047"><span>CVE-2026-55047</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55035"><span>CVE-2026-55035</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55057"><span>CVE-2026-55057</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl75" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55121"><span>CVE-2026-55121</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55042"><span>CVE-2026-55042</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55139"><span>CVE-2026-55139</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50665"><span>CVE-2026-50665</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56192"><span>CVE-2026-56192</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56195"><span>CVE-2026-56195</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47290"><span>CVE-2026-47290</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50301"><span>CVE-2026-50301</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55017"><span>CVE-2026-55017</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55125"><span>CVE-2026-55125</span></a></td>
  <td width="256" class="xl74">Microsoft Office
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55133"><span>CVE-2026-55133</span></a></td>
  <td width="256" class="xl74">Microsoft OneNote
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58636"><span>CVE-2026-58636</span></a></td>
  <td width="256" class="xl74">Microsoft PC Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50438"><span>CVE-2026-50438</span></a></td>
  <td width="256" class="xl74">Microsoft PC Manager
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58647"><span>CVE-2026-58647</span></a></td>
  <td width="256" class="xl74">Microsoft PowerBI
  Report Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55052"><span>CVE-2026-55052</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58277"><span>CVE-2026-58277</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55051"><span>CVE-2026-55051</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54108"><span>CVE-2026-54108</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55016"><span>CVE-2026-55016</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55019"><span>CVE-2026-55019</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55020"><span>CVE-2026-55020</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55021"><span>CVE-2026-55021</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55030"><span>CVE-2026-55030</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55034"><span>CVE-2026-55034</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55126"><span>CVE-2026-55126</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55135"><span>CVE-2026-55135</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56157"><span>CVE-2026-56157</span></a></td>
  <td width="256" class="xl74">Microsoft SharePoint
  Server Spoofing Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47296"><span>CVE-2026-47296</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55002"><span>CVE-2026-55002</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47295"><span>CVE-2026-47295</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50468"><span>CVE-2026-50468</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54116"><span>CVE-2026-54116</span></a></td>
  <td width="256" class="xl74">Microsoft SQL Server
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42900"><span>CVE-2026-42900</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49784"><span>CVE-2026-49784</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50356"><span>CVE-2026-50356</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49165"><span>CVE-2026-49165</span></a></td>
  <td width="256" class="xl74">Microsoft Windows App
  Store Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54993"><span>CVE-2026-54993</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58610"><span>CVE-2026-58610</span></a></td>
  <td width="256" class="xl74">Microsoft Windows
  Media Foundation Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55050"><span>CVE-2026-55050</span></a></td>
  <td width="256" class="xl74">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55124"><span>CVE-2026-55124</span></a></td>
  <td width="256" class="xl74">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55142"><span>CVE-2026-55142</span></a></td>
  <td width="256" class="xl74">Microsoft Word
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55032"><span>CVE-2026-55032</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55055"><span>CVE-2026-55055</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55038"><span>CVE-2026-55038</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55134"><span>CVE-2026-55134</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55128"><span>CVE-2026-55128</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55130"><span>CVE-2026-55130</span></a></td>
  <td width="256" class="xl74">Microsoft Word Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50359"><span>CVE-2026-50359</span></a></td>
  <td width="256" class="xl74">Microsoft XML Core
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57097"><span>CVE-2026-57097</span></a></td>
  <td width="256" class="xl74">Microsoft XML Security
  Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50346"><span>CVE-2026-50346</span></a></td>
  <td width="256" class="xl74">Netlogon RPC Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50402"><span>CVE-2026-50402</span></a></td>
  <td width="256" class="xl74">NTFS Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50506"><span>CVE-2026-50506</span></a></td>
  <td width="256" class="xl74">OData for ASP.NET and
  ASP.NET Core Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45646"><span>CVE-2026-45646</span></a></td>
  <td width="256" class="xl74">OData for ASP.NET and
  ASP.NET Core Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54989"><span>CVE-2026-54989</span></a></td>
  <td width="256" class="xl74">Quality Windows
  Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50365"><span>CVE-2026-50365</span></a></td>
  <td width="256" class="xl74">Remote Access
  Management service/API (RPC server) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54990"><span>CVE-2026-54990</span></a></td>
  <td width="256" class="xl74">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58594"><span>CVE-2026-58594</span></a></td>
  <td width="256" class="xl74">Remote Desktop Client
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56190"><span>CVE-2026-56190</span></a></td>
  <td width="256" class="xl74">Remote Desktop
  Protocol Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49783"><span>CVE-2026-49783</span></a></td>
  <td width="256" class="xl74">Secure Boot Security
  Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42990"><span>CVE-2026-42990</span></a></td>
  <td width="256" class="xl74">SQL Server ODBC driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49168"><span>CVE-2026-49168</span></a></td>
  <td width="256" class="xl74">Storage Spaces Direct
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48581"><span>CVE-2026-48581</span></a></td>
  <td width="256" class="xl74">Surface Broker SDMA
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49180"><span>CVE-2026-49180</span></a></td>
  <td width="256" class="xl74">Universal Plug and
  Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50455"><span>CVE-2026-50455</span></a></td>
  <td width="256" class="xl74">Universal Plug and
  Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54111"><span>CVE-2026-54111</span></a></td>
  <td width="256" class="xl74">Universal Print
  Management Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58543"><span>CVE-2026-58543</span></a></td>
  <td width="256" class="xl74">Universal Print
  Management Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58601"><span>CVE-2026-58601</span></a></td>
  <td width="256" class="xl74">Virtual Hard Disk
  (VHD) Miniport Driver Elevation of Privilege Vulernability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50520"><span>CVE-2026-50520</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45496"><span>CVE-2026-45496</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57101"><span>CVE-2026-57101</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57102"><span>CVE-2026-57102</span></a></td>
  <td width="256" class="xl74">Visual Studio Code
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47305"><span>CVE-2026-47305</span></a></td>
  <td width="256" class="xl74">Visual Studio Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49805"><span>CVE-2026-49805</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50297"><span>CVE-2026-50297</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50325"><span>CVE-2026-50325</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50489"><span>CVE-2026-50489</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57095"><span>CVE-2026-57095</span></a></td>
  <td width="256" class="xl74">Win32k Elevation of
  Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50416"><span>CVE-2026-50416</span></a></td>
  <td width="256" class="xl74">Win32k Information
  Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">3.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56184"><span>CVE-2026-56184</span></a></td>
  <td width="256" class="xl74">Win32k Information
  Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50432"><span>CVE-2026-50432</span></a></td>
  <td width="256" class="xl74">Window Virtual
  Filtering Platform (VFP) Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54119"><span>CVE-2026-54119</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57976"><span>CVE-2026-57976</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50366"><span>CVE-2026-50366</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49178"><span>CVE-2026-49178</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Domain Services Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58529"><span>CVE-2026-58529</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services (ADFS) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54983"><span>CVE-2026-54983</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50695"><span>CVE-2026-50695</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50304"><span>CVE-2026-50304</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50368"><span>CVE-2026-50368</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50324"><span>CVE-2026-50324</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50355"><span>CVE-2026-50355</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50411"><span>CVE-2026-50411</span></a></td>
  <td width="256" class="xl74">Windows Active
  Directory Federation Services Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58631"><span>CVE-2026-58631</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  (WAC) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56196"><span>CVE-2026-56196</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  (WAC) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56197"><span>CVE-2026-56197</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  (WAC) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56169"><span>CVE-2026-56169</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57107"><span>CVE-2026-57107</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56185"><span>CVE-2026-56185</span></a></td>
  <td width="256" class="xl74">Windows Admin Center
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50312"><span>CVE-2026-50312</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50462"><span>CVE-2026-50462</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57093"><span>CVE-2026-57093</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34346"><span>CVE-2026-34346</span></a></td>
  <td width="256" class="xl74">Windows Ancillary
  Function Driver for WinSock Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48572"><span>CVE-2026-48572</span></a></td>
  <td width="256" class="xl74">Windows App Package
  Installer Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48571"><span>CVE-2026-48571</span></a></td>
  <td width="256" class="xl74">Windows App Package
  Installer Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50400"><span>CVE-2026-50400</span></a></td>
  <td width="256" class="xl74">Windows App Package
  Installer Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50331"><span>CVE-2026-50331</span></a></td>
  <td width="256" class="xl74">Windows Application
  Model Core API Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49803"><span>CVE-2026-49803</span></a></td>
  <td width="256" class="xl74">Windows AppX
  Deployment Extensions Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50351"><span>CVE-2026-50351</span></a></td>
  <td width="256" class="xl74">Windows Audio
  Compression Manager (ACM) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50440"><span>CVE-2026-50440</span></a></td>
  <td width="256" class="xl74">Windows Audio Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34328"><span>CVE-2026-34328</span></a></td>
  <td width="256" class="xl74">Windows Audio Service
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50406"><span>CVE-2026-50406</span></a></td>
  <td width="256" class="xl74">Windows Backup Engine
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50364"><span>CVE-2026-50364</span></a></td>
  <td width="256" class="xl74">Windows Backup Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42975"><span>CVE-2026-42975</span></a></td>
  <td width="256" class="xl74">Windows Bluetooth Port
  Driver Remote Code Execution</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58538"><span>CVE-2026-58538</span></a></td>
  <td width="256" class="xl74">Windows Bluetooth
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58638"><span>CVE-2026-58638</span></a></td>
  <td width="256" class="xl74">Windows Boot Loader
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58637"><span>CVE-2026-58637</span></a></td>
  <td width="256" class="xl74">Windows Client-Side
  Caching Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50384"><span>CVE-2026-50384</span></a></td>
  <td width="256" class="xl74">Windows Clip Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49183"><span>CVE-2026-49183</span></a></td>
  <td width="256" class="xl74">Windows Clipboard
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50689"><span>CVE-2026-50689</span></a></td>
  <td width="256" class="xl74">Windows Clipboard
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50374"><span>CVE-2026-50374</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58536"><span>CVE-2026-58536</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58613"><span>CVE-2026-58613</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50401"><span>CVE-2026-50401</span></a></td>
  <td width="256" class="xl74">Windows Cloud Files
  Mini Filter Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50697"><span>CVE-2026-50697</span></a></td>
  <td width="256" class="xl74">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50667"><span>CVE-2026-50667</span></a></td>
  <td width="256" class="xl74">Windows Common Log
  File System Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50421"><span>CVE-2026-50421</span></a></td>
  <td width="256" class="xl74">Windows Connected User
  Experiences and Telemetry Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50428"><span>CVE-2026-50428</span></a></td>
  <td width="256" class="xl74">Windows Container
  Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50352"><span>CVE-2026-50352</span></a></td>
  <td width="256" class="xl74">Windows Cryptographic
  Services Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50302"><span>CVE-2026-50302</span></a></td>
  <td width="256" class="xl74">Windows Cryptographic
  Services Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55144"><span>CVE-2026-55144</span></a></td>
  <td width="256" class="xl74">Windows Cryptography
  API: Next Generation (CNG) Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50347"><span>CVE-2026-50347</span></a></td>
  <td width="256" class="xl74">Windows Data.dll
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49181"><span>CVE-2026-49181</span></a></td>
  <td width="256" class="xl74">Windows DHCP Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50683"><span>CVE-2026-50683</span></a></td>
  <td width="256" class="xl74">Windows DHCP Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58627"><span>CVE-2026-58627</span></a></td>
  <td width="256" class="xl74">Windows DHCP Server
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50685"><span>CVE-2026-50685</span></a></td>
  <td width="256" class="xl74">Windows DHCP Server
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49807"><span>CVE-2026-49807</span></a></td>
  <td width="256" class="xl74">Windows DirectX
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49175"><span>CVE-2026-49175</span></a></td>
  <td width="256" class="xl74">Windows DNS Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50487"><span>CVE-2026-50487</span></a></td>
  <td width="256" class="xl74">Windows DNS Client
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50465"><span>CVE-2026-50465</span></a></td>
  <td width="256" class="xl74">Windows DNS Client
  Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49169"><span>CVE-2026-49169</span></a></td>
  <td width="256" class="xl74">Windows DNS Server
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50426"><span>CVE-2026-50426</span></a></td>
  <td width="256" class="xl74">Windows DNS Server
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50424"><span>CVE-2026-50424</span></a></td>
  <td width="256" class="xl74">Windows Domain
  Controller Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50300"><span>CVE-2026-50300</span></a></td>
  <td width="256" class="xl74">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50437"><span>CVE-2026-50437</span></a></td>
  <td width="256" class="xl74">Windows DWM Core
  Library Information Disclosure<span> 
  </span>Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34348"><span>CVE-2026-34348</span></a></td>
  <td width="256" class="xl74">Windows Event Logging
  Service Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50502"><span>CVE-2026-50502</span></a></td>
  <td width="256" class="xl74">Windows Event Logging
  Service Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33842"><span>CVE-2026-33842</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40422"><span>CVE-2026-40422</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41087"><span>CVE-2026-41087</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50473"><span>CVE-2026-50473</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50442"><span>CVE-2026-50442</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50389"><span>CVE-2026-50389</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50456"><span>CVE-2026-50456</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57084"><span>CVE-2026-57084</span></a></td>
  <td width="256" class="xl74">Windows File Explorer
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57091"><span>CVE-2026-57091</span></a></td>
  <td width="256" class="xl74">Windows File History
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50405"><span>CVE-2026-50405</span></a></td>
  <td width="256" class="xl74">Windows Filtering
  Platform Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49172"><span>CVE-2026-49172</span></a></td>
  <td width="256" class="xl74">Windows FTP Service
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50387"><span>CVE-2026-50387</span></a></td>
  <td width="256" class="xl74">Windows GDI Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54122"><span>CVE-2026-54122</span></a></td>
  <td width="256" class="xl74">Windows GDI+ Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50483"><span>CVE-2026-50483</span></a></td>
  <td width="256" class="xl74">Windows Graphics
  Component Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58609"><span>CVE-2026-58609</span></a></td>
  <td width="256" class="xl74">Windows Graphics
  Component Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50391"><span>CVE-2026-50391</span></a></td>
  <td width="256" class="xl74">Windows Group Policy
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50310"><span>CVE-2026-50310</span></a></td>
  <td width="256" class="xl74">Windows Human
  Interface Device Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50485"><span>CVE-2026-50485</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V Denial
  of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54129"><span>CVE-2026-54129</span></a></td>
  <td width="256" class="xl74">Windows Hyper-V
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50315"><span>CVE-2026-50315</span></a></td>
  <td width="256" class="xl74">Windows Image
  Acquisition Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58534"><span>CVE-2026-58534</span></a></td>
  <td width="256" class="xl74">Windows Input Method
  Editor (IME) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50490"><span>CVE-2026-50490</span></a></td>
  <td width="256" class="xl74">Windows Installer
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58540"><span>CVE-2026-58540</span></a></td>
  <td width="256" class="xl74">Windows Installer
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50425"><span>CVE-2026-50425</span></a></td>
  <td width="256" class="xl74">Windows Internal
  System User Profile Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50293"><span>CVE-2026-50293</span></a></td>
  <td width="256" class="xl74">Windows Internal Task
  Bar Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49167"><span>CVE-2026-49167</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49173"><span>CVE-2026-49173</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54132"><span>CVE-2026-54132</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49795"><span>CVE-2026-49795</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49798"><span>CVE-2026-49798</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49808"><span>CVE-2026-49808</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50354"><span>CVE-2026-50354</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50332"><span>CVE-2026-50332</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50377"><span>CVE-2026-50377</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50390"><span>CVE-2026-50390</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50423"><span>CVE-2026-50423</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50397"><span>CVE-2026-50397</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50436"><span>CVE-2026-50436</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50399"><span>CVE-2026-50399</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50459"><span>CVE-2026-50459</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50477"><span>CVE-2026-50477</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50478"><span>CVE-2026-50478</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50484"><span>CVE-2026-50484</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50673"><span>CVE-2026-50673</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58532"><span>CVE-2026-58532</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50294"><span>CVE-2026-50294</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50316"><span>CVE-2026-50316</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50419"><span>CVE-2026-50419</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">3.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50463"><span>CVE-2026-50463</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50475"><span>CVE-2026-50475</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50429"><span>CVE-2026-50429</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58614"><span>CVE-2026-58614</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58545"><span>CVE-2026-58545</span></a></td>
  <td width="256" class="xl74">Windows Kernel
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58602"><span>CVE-2026-58602</span></a></td>
  <td width="256" class="xl74">Windows Kernel-Mode
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50393"><span>CVE-2026-50393</span></a></td>
  <td width="256" class="xl74">Windows Kernel-Mode
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50396"><span>CVE-2026-50396</span></a></td>
  <td width="256" class="xl74">Windows Kernel-Mode
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50378"><span>CVE-2026-50378</span></a></td>
  <td width="256" class="xl74">Windows Key Guard
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50303"><span>CVE-2026-50303</span></a></td>
  <td width="256" class="xl74">Windows Key Guard
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40378"><span>CVE-2026-40378</span></a></td>
  <td width="256" class="xl74">Windows Local Security
  Authority Subsystem Service (LSASS) Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49799"><span>CVE-2026-49799</span></a></td>
  <td width="256" class="xl74">Windows Local Security
  Authority Subsystem Service (LSASS) Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50371"><span>CVE-2026-50371</span></a></td>
  <td width="256" class="xl74">Windows LUA File
  Virtualization Filter Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58544"><span>CVE-2026-58544</span></a></td>
  <td width="256" class="xl74">Windows Management
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50404"><span>CVE-2026-50404</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50358"><span>CVE-2026-50358</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50336"><span>CVE-2026-50336</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50398"><span>CVE-2026-50398</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50414"><span>CVE-2026-50414</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50379"><span>CVE-2026-50379</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50433"><span>CVE-2026-50433</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50676"><span>CVE-2026-50676</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50677"><span>CVE-2026-50677</span></a></td>
  <td width="256" class="xl74">Windows Media
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34349"><span>CVE-2026-34349</span></a></td>
  <td width="256" class="xl74">Windows Media
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50394"><span>CVE-2026-50394</span></a></td>
  <td width="256" class="xl74">Windows Media
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50415"><span>CVE-2026-50415</span></a></td>
  <td width="256" class="xl74">Windows Media
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57083"><span>CVE-2026-57083</span></a></td>
  <td width="256" class="xl74">Windows Media Photo
  Codec Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54115"><span>CVE-2026-54115</span></a></td>
  <td width="256" class="xl74">Windows Message
  Queuing (MSMQ) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50447"><span>CVE-2026-50447</span></a></td>
  <td width="256" class="xl74">Windows Message
  Queuing Service (MSMQ) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">9.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50505"><span>CVE-2026-50505</span></a></td>
  <td width="256" class="xl74">Windows Message
  Queuing Service (MSMQ) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50342"><span>CVE-2026-50342</span></a></td>
  <td width="256" class="xl74">Windows MIDI Service
  Module Elevation of Privileges Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56183"><span>CVE-2026-56183</span></a></td>
  <td width="256" class="xl74">Windows MIDI Service
  Module Elevation of Privileges Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56187"><span>CVE-2026-56187</span></a></td>
  <td width="256" class="xl74">Windows MIDI Service
  Module Elevation of Privileges Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58635"><span>CVE-2026-58635</span></a></td>
  <td width="256" class="xl74">Windows Narrator
  Braille Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50500"><span>CVE-2026-50500</span></a></td>
  <td width="256" class="xl74">Windows Netlogon
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50476"><span>CVE-2026-50476</span></a></td>
  <td width="256" class="xl74">Windows Network
  Connections Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50450"><span>CVE-2026-50450</span></a></td>
  <td width="256" class="xl74">Windows Network
  Connections Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56650"><span>CVE-2026-56650</span></a></td>
  <td width="256" class="xl74">Windows Network File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56649"><span>CVE-2026-56649</span></a></td>
  <td width="256" class="xl74">Windows Network File
  System Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.9</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50470"><span>CVE-2026-50470</span></a></td>
  <td width="256" class="xl74">Windows Network Policy
  Server SNMP Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50496"><span>CVE-2026-50496</span></a></td>
  <td width="256" class="xl74">Windows Network Policy
  Server SNMP Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56194"><span>CVE-2026-56194</span></a></td>
  <td width="256" class="xl74">Windows NFS Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56648"><span>CVE-2026-56648</span></a></td>
  <td width="256" class="xl74">Windows NFS Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50337"><span>CVE-2026-50337</span></a></td>
  <td width="256" class="xl74">Windows Notification
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49789"><span>CVE-2026-49789</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50412"><span>CVE-2026-50412</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50422"><span>CVE-2026-50422</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50672"><span>CVE-2026-50672</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56175"><span>CVE-2026-56175</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56182"><span>CVE-2026-56182</span></a></td>
  <td width="256" class="xl74">Windows NTFS Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50341"><span>CVE-2026-50341</span></a></td>
  <td width="256" class="xl74">Windows NTFS
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58640"><span>CVE-2026-58640</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49184"><span>CVE-2026-49184</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49797"><span>CVE-2026-49797</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50308"><span>CVE-2026-50308</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50386"><span>CVE-2026-50386</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50309"><span>CVE-2026-50309</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50313"><span>CVE-2026-50313</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50388"><span>CVE-2026-50388</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50448"><span>CVE-2026-50448</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50471"><span>CVE-2026-50471</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50461"><span>CVE-2026-50461</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50417"><span>CVE-2026-50417</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50482"><span>CVE-2026-50482</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50494"><span>CVE-2026-50494</span></a></td>
  <td width="256" class="xl74">Windows NTFS Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50344"><span>CVE-2026-50344</span></a></td>
  <td width="256" class="xl74">Windows OLE Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50686"><span>CVE-2026-50686</span></a></td>
  <td width="256" class="xl74">Windows OLE Remote
  Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50335"><span>CVE-2026-50335</span></a></td>
  <td width="256" class="xl74">Windows Operating
  Systems Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50317"><span>CVE-2026-50317</span></a></td>
  <td width="256" class="xl74">Windows Operating
  Systems Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54987"><span>CVE-2026-54987</span></a></td>
  <td width="256" class="xl74">Windows Overlay Filter
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50435"><span>CVE-2026-50435</span></a></td>
  <td width="256" class="xl74">Windows Overlay Filter
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50409"><span>CVE-2026-50409</span></a></td>
  <td width="256" class="xl74">Windows Overlay Filter
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40400"><span>CVE-2026-40400</span></a></td>
  <td width="256" class="xl74">Windows PowerShell
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49166"><span>CVE-2026-49166</span></a></td>
  <td width="256" class="xl74">Windows Print
  Configuration Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55004"><span>CVE-2026-55004</span></a></td>
  <td width="256" class="xl74">Windows Print
  Configuration Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50499"><span>CVE-2026-50499</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50383"><span>CVE-2026-50383</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57085"><span>CVE-2026-57085</span></a></td>
  <td width="256" class="xl74">Windows Print Spooler
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50469"><span>CVE-2026-50469</span></a></td>
  <td width="256" class="xl74">Windows Projected File
  System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50434"><span>CVE-2026-50434</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50339"><span>CVE-2026-50339</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50430"><span>CVE-2026-50430</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50334"><span>CVE-2026-50334</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notification Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44800"><span>CVE-2026-44800</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50363"><span>CVE-2026-50363</span></a></td>
  <td width="256" class="xl74">Windows Push
  Notifications Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50431"><span>CVE-2026-50431</span></a></td>
  <td width="256" class="xl74">Windows Quality of
  Service (QoS) Packet Scheduler Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50372"><span>CVE-2026-50372</span></a></td>
  <td width="256" class="xl74">Windows Redirected
  Drive Buffering System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50666"><span>CVE-2026-50666</span></a></td>
  <td width="256" class="xl74">Windows Remote Access
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56647"><span>CVE-2026-56647</span></a></td>
  <td width="256" class="xl74">Windows Remote Access
  Service Infrastructure Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50330"><span>CVE-2026-50330</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50376"><span>CVE-2026-50376</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50504"><span>CVE-2026-50504</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58533"><span>CVE-2026-58533</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58535"><span>CVE-2026-58535</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58546"><span>CVE-2026-58546</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58539"><span>CVE-2026-58539</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Client Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55003"><span>CVE-2026-55003</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57979"><span>CVE-2026-57979</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50445"><span>CVE-2026-50445</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50497"><span>CVE-2026-50497</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54126"><span>CVE-2026-54126</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57982"><span>CVE-2026-57982</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Protocol (RDP) Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50369"><span>CVE-2026-50369</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Services Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58626"><span>CVE-2026-58626</span></a></td>
  <td width="256" class="xl74">Windows Remote Desktop
  Services Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55014"><span>CVE-2026-55014</span></a></td>
  <td width="256" class="xl74">Windows Remote Help
  Defense Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50318"><span>CVE-2026-50318</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50407"><span>CVE-2026-50407</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50357"><span>CVE-2026-50357</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50441"><span>CVE-2026-50441</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50668"><span>CVE-2026-50668</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54109"><span>CVE-2026-54109</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49792"><span>CVE-2026-49792</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49793"><span>CVE-2026-49793</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50362"><span>CVE-2026-50362</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50492"><span>CVE-2026-50492</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50501"><span>CVE-2026-50501</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58530"><span>CVE-2026-58530</span></a></td>
  <td width="256" class="xl74">Windows Resilient File
  System (ReFS) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49791"><span>CVE-2026-49791</span></a></td>
  <td width="256" class="xl74">Windows Routing and
  Remote Access Service (RRAS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50451"><span>CVE-2026-50451</span></a></td>
  <td width="256" class="xl74">Windows Routing and
  Remote Access Service (RRAS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57096"><span>CVE-2026-57096</span></a></td>
  <td width="256" class="xl74">Windows Routing and
  Remote Access Service (RRAS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50323"><span>CVE-2026-50323</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50452"><span>CVE-2026-50452</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50348"><span>CVE-2026-50348</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50345"><span>CVE-2026-50345</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50322"><span>CVE-2026-50322</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50340"><span>CVE-2026-50340</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50410"><span>CVE-2026-50410</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50449"><span>CVE-2026-50449</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50460"><span>CVE-2026-50460</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50403"><span>CVE-2026-50403</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50385"><span>CVE-2026-50385</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50413"><span>CVE-2026-50413</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50457"><span>CVE-2026-50457</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50486"><span>CVE-2026-50486</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50503"><span>CVE-2026-50503</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54125"><span>CVE-2026-54125</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58527"><span>CVE-2026-58527</span></a></td>
  <td width="256" class="xl74">Windows Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50373"><span>CVE-2026-50373</span></a></td>
  <td width="256" class="xl74">Windows Search Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50679"><span>CVE-2026-50679</span></a></td>
  <td width="256" class="xl74">Windows Search Service
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44806"><span>CVE-2026-44806</span></a></td>
  <td width="256" class="xl74">Windows Secure Channel
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50681"><span>CVE-2026-50681</span></a></td>
  <td width="256" class="xl74">Windows Secure Channel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56186"><span>CVE-2026-56186</span></a></td>
  <td width="256" class="xl74">Windows Secure Channel
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50367"><span>CVE-2026-50367</span></a></td>
  <td width="256" class="xl74">Windows Sensor Data
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58619"><span>CVE-2026-58619</span></a></td>
  <td width="256" class="xl74">Windows Sensor Data
  Service Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50311"><span>CVE-2026-50311</span></a></td>
  <td width="256" class="xl74">Windows Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50328"><span>CVE-2026-50328</span></a></td>
  <td width="256" class="xl74">Windows Server Update
  Service (WSUS) Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58531"><span>CVE-2026-58531</span></a></td>
  <td width="256" class="xl74">Windows SMB Elevation
  of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54997"><span>CVE-2026-54997</span></a></td>
  <td width="256" class="xl74">Windows SMB
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49801"><span>CVE-2026-49801</span></a></td>
  <td width="256" class="xl74">Windows SMB
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50690"><span>CVE-2026-50690</span></a></td>
  <td width="256" class="xl74">Windows SMB
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56168"><span>CVE-2026-56168</span></a></td>
  <td width="256" class="xl74">Windows SMB Server
  Denial of Service Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50360"><span>CVE-2026-50360</span></a></td>
  <td width="256" class="xl74">Windows SMB Server
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57089"><span>CVE-2026-57089</span></a></td>
  <td width="256" class="xl74">Windows SMB Server
  Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50333"><span>CVE-2026-50333</span></a></td>
  <td width="256" class="xl74">Windows Spaceport.sys
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50298"><span>CVE-2026-50298</span></a></td>
  <td width="256" class="xl74">Windows Spaceport.sys
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49171"><span>CVE-2026-49171</span></a></td>
  <td width="256" class="xl74">Windows Speech Runtime
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49170"><span>CVE-2026-49170</span></a></td>
  <td width="256" class="xl74">Windows
  StateRepository API Server file Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58526"><span>CVE-2026-58526</span></a></td>
  <td width="256" class="xl74">Windows Storage
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50299"><span>CVE-2026-50299</span></a></td>
  <td width="256" class="xl74">Windows Storage Spaces
  Direct Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57968"><span>CVE-2026-57968</span></a></td>
  <td width="256" class="xl74">Windows Subsystem for
  Linux (WSL2) Kernel Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57973"><span>CVE-2026-57973</span></a></td>
  <td width="256" class="xl74">Windows Subsystem for
  Linux (WSL2) Kernel Tampering Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50418"><span>CVE-2026-50418</span></a></td>
  <td width="256" class="xl74">Windows System Secure
  Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50306"><span>CVE-2026-50306</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50307"><span>CVE-2026-50307</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49177"><span>CVE-2026-49177</span></a></td>
  <td width="256" class="xl74">Windows TCP/IP
  Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50669"><span>CVE-2026-50669</span></a></td>
  <td width="256" class="xl74">Windows Telephony
  Server Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54124"><span>CVE-2026-54124</span></a></td>
  <td width="256" class="xl74">Windows Terminal
  Remote Code Execution Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50350"><span>CVE-2026-50350</span></a></td>
  <td width="256" class="xl74">Windows Trusted
  Runtime Interface Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50326"><span>CVE-2026-50326</span></a></td>
  <td width="256" class="xl74">Windows Unified
  Consent System Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49790"><span>CVE-2026-49790</span></a></td>
  <td width="256" class="xl74">Windows Universal Disk
  Format File System Driver (UDFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50498"><span>CVE-2026-50498</span></a></td>
  <td width="256" class="xl74">Windows Universal Disk
  Format File System Driver (UDFS) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58547"><span>CVE-2026-58547</span></a></td>
  <td width="256" class="xl74">Windows Universal Plug
  and Play (UPnP) Device Host Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49794"><span>CVE-2026-49794</span></a></td>
  <td width="256" class="xl74">Windows USB Audio
  Class Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">4.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50453"><span>CVE-2026-50453</span></a></td>
  <td width="256" class="xl74">Windows USB Audio
  Class Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.1</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58528"><span>CVE-2026-58528</span></a></td>
  <td width="256" class="xl74">Windows USB Audio
  Class Driver Information Disclosure Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50321"><span>CVE-2026-50321</span></a></td>
  <td width="256" class="xl74">Windows USB Driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50479"><span>CVE-2026-50479</span></a></td>
  <td width="256" class="xl74">Windows USB Hub Driver
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55000"><span>CVE-2026-55000</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54991"><span>CVE-2026-54991</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54996"><span>CVE-2026-54996</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49802"><span>CVE-2026-49802</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49806"><span>CVE-2026-49806</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50674"><span>CVE-2026-50674</span></a></td>
  <td width="256" class="xl74">Windows USB Print
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49804"><span>CVE-2026-49804</span></a></td>
  <td width="256" class="xl74">Windows USB Video
  Driver Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">6.6</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50454"><span>CVE-2026-50454</span></a></td>
  <td width="256" class="xl74">Windows User Interface
  Core Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49176"><span>CVE-2026-49176</span></a></td>
  <td width="256" class="xl74">Windows WalletService
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49800"><span>CVE-2026-49800</span></a></td>
  <td width="256" class="xl74">Windows Web Proxy
  Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50480"><span>CVE-2026-50480</span></a></td>
  <td width="256" class="xl74">Windows Web Proxy
  Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56173"><span>CVE-2026-56173</span></a></td>
  <td width="256" class="xl74">Windows WebView
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58632"><span>CVE-2026-58632</span></a></td>
  <td width="256" class="xl74">Windows Win32 Kernel
  Subsystem Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54107"><span>CVE-2026-54107</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54986"><span>CVE-2026-54986</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54112"><span>CVE-2026-54112</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54114"><span>CVE-2026-54114</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50670"><span>CVE-2026-50670</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50688"><span>CVE-2026-50688</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50687"><span>CVE-2026-50687</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">8.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56176"><span>CVE-2026-56176</span></a></td>
  <td width="256" class="xl74">Windows Win32k
  Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58628"><span>CVE-2026-58628</span></a></td>
  <td width="256" class="xl74">Windows Wireless
  Network Manager Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50295"><span>CVE-2026-50295</span></a></td>
  <td width="256" class="xl74">Windows Zero Trust DNS
  Security Feature Bypass Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">5.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl67" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50509"><span>CVE-2026-50509</span></a></td>
  <td width="256" class="xl74">Wireless Wide Area
  Network Service (WwanSvc) Elevation of Privilege Vulnerability</td>
  <td class="xl68">Important</td>
  <td class="xl69">7.8</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55945"><span>CVE-2026-55945</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Information Disclosure Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">4.2</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Info</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45488"><span>CVE-2026-45488</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">5.4</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45489"><span>CVE-2026-45489</span></a></td>
  <td width="256" class="xl74">Microsoft Edge
  (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">6.5</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl67" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55145"><span>CVE-2026-55145</span></a></td>
  <td width="256" class="xl74">Outlook Copilot
  Tampering Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">6.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Tampering</td>
 </tr>
 <tr height="73">
  <td class="xl67" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56181"><span>CVE-2026-56181</span></a></td>
  <td width="256" class="xl74">Windows Network
  Address Translation (NAT) Spoofing Vulnerability</td>
  <td class="xl71">Moderate</td>
  <td class="xl69">8.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl67" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58597"><span>CVE-2026-58597</span></a></td>
  <td width="256" class="xl74">Microsoft
  Edge (Chromium-based) Spoofing Vulnerability</td>
  <td class="xl73">Low</td>
  <td class="xl69">4.3</td>
  <td class="xl69">No</td>
  <td class="xl69">No</td>
  <td class="xl69">Spoofing</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="144"></td>
  <td width="256"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
  <td width="104"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.</em></p><p class=""><em> </em></p><p class=""><em> </em></p><p class="">I’ll do my best to summarize everything else in this release, but no promises. I’m only human after all.</p><p class=""> </p><p class="">Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.</p><p class="">That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.</p><p class="">The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.</p><p class="">And because this release wouldn't be complete without it: CVE-2026-50663, an RCE in Age of Empires II: Definitive Edition. Yes, really. Patch your civilization anyway.</p><p class="">There are close to 260 EoP bugs in this month’s release. Microsoft could have just published the EoPs and still had a record-setting month. As usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. What’s really frustrating is that 94 have no explicit privilege statement at all. Microsoft just says “elevate privileges” with no detail. By my count, that leaves around 25 bugs to consider. Some don’t elevate at all. The FAQ literally says the attacker just gets “the rights of the user running the affected application.” That covers Win32k, Clip Service, Search Service, MSMQ, and SharePoint. A few get a Low-to-Medium integrity bump. There are also a couple that lead to downgraded service accounts or arbitrary file deletion, but nothing else I’ve seen really stands out too much.</p><p class="">There are 20 Security Feature Bypass (SFB) bugs this month, and it's a genuinely mixed bag. CVE-2026-55040 leads at Critical, CVSS 9.1 as it’s weak authentication in SharePoint Server. Patch it in the same pass as the SharePoint RCE pair since it's the same product. The AI-coding-tool trend continues: GitHub Copilot and Visual Studio Code and Visual Studio all land SFB bugs, mostly injection or path-traversal flavored. BitLocker is this month's lone publicly disclosed bug. It’s not exploited yet, but public disclosure is a countdown clock, not a free pass. It requires physical access, as does the bug in Microsoft XML. The firmware/boot cluster is worth a second look: Secure Boot, Boot Loader, and Key Guard all touch the trust chain below the OS. Meaning, despite a low CVSS score, “if this fails, nothing above it can be trusted” stakes. Rounding out the SFB patches, there are two .NET SFBs, two Windows Kernel SFBs, and a DNS/Cryptographic Services bringing up the rear.</p><p class="">The July release includes 31Spoofing bugs this month, and we’ve already covered the most important (Exchange). SharePoint Server accounts for another ten with almost all the same root cause: stored XSS letting an authenticated attacker spoof content in the browser. Microsoft Edge (Chromium-based) contributes fifteen more spanning access-control failures, SSRF, type confusion, and UI misrepresentation. All genuinely Microsoft's to patch, not re-listed Chromium noise. The remaining six round out the usual suspects: a Windows NAT spoofing bug reachable from an adjacent network, a Bing app flaw on iOS, a PowerBI Report Server XSS issue, a .NET output-encoding bug, and an AD FS spoofing flaw. None publicly disclosed, none exploited, but with SharePoint's history this year, don't let "just Spoofing" lull you into deprioritizing the patch cycle.</p><p class="">Of 111 Information Disclosure bugs, the overwhelming majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. GitHub Copilot is the standout. Here, the bug insufficiently protected credentials, meaning actual secrets leak, not memory scraps. The Windows Admin Center flaw discloses data via improper authentication. A management console leaking to an unauthorized party is a bigger deal than it sounds. SharePoint uses SSRF to pull data server-side, and the Event Logging Service is a protection-mechanism failure, not a memory bug at all. Edge picks up three genuinely file-system-flavored disclosures — improper authorization, files/directories accessible to external parties, and link-following — plus Edge for Android exposing “private personal information” twice and two path-traversal bugs. The remaining 40+ are mostly one-line “exposure of sensitive information to an unauthorized actor” entries scattered across File Explorer, Push Notifications, Cryptographic Services, and Win32k.</p><p class="">Only 8 Tampering bugs this month, the smallest bucket, but a couple stand out. The top of the list is a WSUS bug, caused by an uncaught exception that lets an unauthenticated attacker tamper with the update service over the network. That’s your patch-management infrastructure itself being the target, which always deserves extra attention. Windows CNG (the crypto API) picks up a missing-cryptographic-step flaw, and Windows DNS Client shows up three separate times across the list, twice for improper access control and once for missing authentication on a critical function. DNS resolution having this many tampering paths in one release is worth flagging as a pattern rather than three unrelated bugs. The one genuinely different entry is Outlook Copilot, described simply as vulnerable to “malicious uses” enabling tampering over the network. That’s a fantastically vague phrasing for an AI-assistant feature, continuing this year's running theme of Copilot-branded features showing up somewhere in every release. Finally, a .NET link-following bug and a WSL2 kernel race condition receive patches. Both require local/authorized access to trigger.</p><p class="">Still with me? Good, because we have 35 DoS bugs to cover, and this is really an identity-infrastructure story more than a grab-bag. Active Directory Federation Services alone accounts for seven of them, all sitting at CVSS 7.5, all stack-based buffer overflows or infinite loops that let an unauthenticated attacker knock the service over the network.  The .NET ecosystem is the other big cluster: .NET, .NET Framework, and ASP.NET Core/OData contribute nine bugs combined, almost all “allocation of resources without limits or throttling”.  HTTP.sys and HTTP/2 pick up the same flavor. LSASS shows up twice, which is always worth a second look given what that process actually holds. Rounding out the list are patches for Windows DHCP Server, SMB Server, Secure Channel, Hyper-V, and IKE Protocol each take a single hit, mostly requiring authorized or adjacent-network access rather than being wide open to the internet.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">The next Patch Tuesday will be on August 11, just after Hacker Summer Camp in sunny Las Vegas. Should I survive the heat, I’ll be back then to give you my full thoughts on the release – no matter how large it may be. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[SectopRAT Gives Attackers Remote Access to Passwords, Credit Cards, Cookies and Corporate Files]]></title>
<description><![CDATA[SectopRAT is at the center of a highly targeted malvertising campaign abusing Anthropic’s Claude platform to deliver a stealthy, HVNC‑enabled RAT that gives attackers deep, persistent access to victims’ passwords, credit cards, cookies and corporate files. The artifact masqueraded as a genuine Cl...]]></description>
<link>https://tsecurity.de/de/3694557/hacking/sectoprat-gives-attackers-remote-access-to-passwords-credit-cards-cookies-and-corporate-files/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694557/hacking/sectoprat-gives-attackers-remote-access-to-passwords-credit-cards-cookies-and-corporate-files/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:47 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>SectopRAT is at the center of a highly targeted malvertising campaign abusing Anthropic’s Claude platform to deliver a stealthy, HVNC‑enabled RAT that gives attackers deep, persistent access to victims’ passwords, credit cards, cookies and corporate files. The artifact masqueraded as a genuine Claude Desktop installer but redirected victims to claude.ai.download-app[.]us and then to downloading-api.it[.]com/html/claude/win, where […]</p>
<p>The post <a href="https://gbhackers.com/sectoprat-campaign/">SectopRAT Gives Attackers Remote Access to Passwords, Credit Cards, Cookies and Corporate Files</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Golden Chickens Launches Four Modular Malware Families to Steal Chrome Credentials and Hijack Browser Sessions]]></title>
<description><![CDATA[Golden Chickens, tracked as TAG-195 and also known as Venom Spider, has launched four new modular malware families designed to enhance credential theft, browser session hijacking, and post-exploitation flexibility. The newly identified families TinyEgg, ChonkyChicken, a modularized ChonkyChicken ...]]></description>
<link>https://tsecurity.de/de/3694558/hacking/golden-chickens-launches-four-modular-malware-families-to-steal-chrome-credentials-and-hijack-browser-sessions/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694558/hacking/golden-chickens-launches-four-modular-malware-families-to-steal-chrome-credentials-and-hijack-browser-sessions/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:47 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Golden Chickens, tracked as TAG-195 and also known as Venom Spider, has launched four new modular malware families designed to enhance credential theft, browser session hijacking, and post-exploitation flexibility. The newly identified families TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator mark a clear architectural evolution in the group’s malware-as-a-service (MaaS) ecosystem, signaling a shift […]</p>
<p>The post <a href="https://gbhackers.com/four-modular-malware-families/">Golden Chickens Launches Four Modular Malware Families to Steal Chrome Credentials and Hijack Browser Sessions</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Illinois Man Pleads Guilty to Phishing 4,500 Snapchat Users to Steal Private Photos]]></title>
<description><![CDATA[An Illinois man has pleaded guilty to a phishing and account-compromise scheme that targeted thousands of Snapchat users, leading to the theft of private images from numerous women. Federal prosecutors stated that Kyle Svara, 27, of Oswego, Illinois, admitted to charges including aggravated ident...]]></description>
<link>https://tsecurity.de/de/3694556/hacking/illinois-man-pleads-guilty-to-phishing-4500-snapchat-users-to-steal-private-photos/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694556/hacking/illinois-man-pleads-guilty-to-phishing-4500-snapchat-users-to-steal-private-photos/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:46 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>An Illinois man has pleaded guilty to a phishing and account-compromise scheme that targeted thousands of Snapchat users, leading to the theft of private images from numerous women. Federal prosecutors stated that Kyle Svara, 27, of Oswego, Illinois, admitted to charges including aggravated identity theft, wire fraud, computer fraud, conspiracy to commit computer fraud, and […]</p>
<p>The post <a href="https://gbhackers.com/illinois-man-pleads-guilty-to-phishing-4500-snapchat-users/">Illinois Man Pleads Guilty to Phishing 4,500 Snapchat Users to Steal Private Photos</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading]]></title>
<description><![CDATA[A recently disclosed vulnerability in Foxit PDF Reader may allow a local attacker with existing code execution to elevate their privileges to NT AUTHORITY\SYSTEM. This issue, tracked as CVE-2026-57239, affects Foxit PDF Reader installations prior to version 2026.2 and arises from the insecure han...]]></description>
<link>https://tsecurity.de/de/3694554/hacking/foxit-pdf-reader-flaw-lets-local-attackers-gain-system-privileges-via-dll-sideloading/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694554/hacking/foxit-pdf-reader-flaw-lets-local-attackers-gain-system-privileges-via-dll-sideloading/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:45 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A recently disclosed vulnerability in Foxit PDF Reader may allow a local attacker with existing code execution to elevate their privileges to NT AUTHORITY\SYSTEM. This issue, tracked as CVE-2026-57239, affects Foxit PDF Reader installations prior to version 2026.2 and arises from the insecure handling of an updater workflow triggered by a user-writable file in the […]</p>
<p>The post <a href="https://gbhackers.com/foxit-pdf-reader-flaw/">Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Cl0p Targets Internet-Exposed Windchill Servers in Global Engineering Data-Theft Campaign]]></title>
<description><![CDATA[Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments. Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by st...]]></description>
<link>https://tsecurity.de/de/3694555/hacking/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694555/hacking/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:45 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments. Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by staging and exfiltration of sensitive engineering and product design data. This chaining enables unauthenticated remote code execution, allowing attackers to deploy […]</p>
<p>The post <a href="https://gbhackers.com/cl0p-targets-internet-exposed-windchill/">Cl0p Targets Internet-Exposed Windchill Servers in Global Engineering Data-Theft Campaign</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Hackers Exploit Industrial PLCs and Manipulate HMI Displays to Hide Attacks]]></title>
<description><![CDATA[Six federal agencies have updated a joint advisory warning that Iranian-affiliated advanced persistent threat (APT) actors are actively exploiting internet-exposed programmable logic controllers (PLCs) across U.S. critical infrastructure, manipulating human-machine interface (HMI) displays so ope...]]></description>
<link>https://tsecurity.de/de/3694552/hacking/hackers-exploit-industrial-plcs-and-manipulate-hmi-displays-to-hide-attacks/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694552/hacking/hackers-exploit-industrial-plcs-and-manipulate-hmi-displays-to-hide-attacks/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:44 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Six federal agencies have updated a joint advisory warning that Iranian-affiliated advanced persistent threat (APT) actors are actively exploiting internet-exposed programmable logic controllers (PLCs) across U.S. critical infrastructure, manipulating human-machine interface (HMI) displays so operators cannot visually detect the intrusion. The advisory, first issued in April 2026 and revised on July 22, 2026, is cosigned […]</p>
<p>The post <a href="https://gbhackers.com/hackers-exploit-industrial-plcs/">Hackers Exploit Industrial PLCs and Manipulate HMI Displays to Hide Attacks</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Tego AI Discloses Second Claude Flaw in a Week: Hidden Link Silently Sends Files to Attackers]]></title>
<description><![CDATA[Tel Aviv, Israel, July 24th, 2026, CyberNewswire One week after disclosing that Anthropic’s Claude Tag Slack integration could be driven by plain “@Claude” text, Tego AI today published a second piece of research on the Claude ecosystem. This one focuses on Claude Code, Anthropic’s agentic comman...]]></description>
<link>https://tsecurity.de/de/3694553/hacking/tego-ai-discloses-second-claude-flaw-in-a-week-hidden-link-silently-sends-files-to-attackers/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694553/hacking/tego-ai-discloses-second-claude-flaw-in-a-week-hidden-link-silently-sends-files-to-attackers/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:44 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Tel Aviv, Israel, July 24th, 2026, CyberNewswire One week after disclosing that Anthropic’s Claude Tag Slack integration could be driven by plain “@Claude” text, Tego AI today published a second piece of research on the Claude ecosystem. This one focuses on Claude Code, Anthropic’s agentic command-line coding tool. Cloning an ordinary repository and starting Claude […]</p>
<p>The post <a href="https://gbhackers.com/tego-ai-discloses-second-claude-flaw-in-a-week-hidden-link-silently-sends-files-to-attackers/">Tego AI Discloses Second Claude Flaw in a Week: Hidden Link Silently Sends Files to Attackers</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Google Launches Unified Cryptonym-Based Naming System for Threat Actors]]></title>
<description><![CDATA[Google Threat Intelligence Group (GTIG) has introduced a unified cryptonym-based naming system for cyber threat actors, aiming to simplify attribution, improve analyst workflows, and eliminate inconsistencies between legacy tracking conventions used across Google’s security teams. The initiative ...]]></description>
<link>https://tsecurity.de/de/3694550/hacking/google-launches-unified-cryptonym-based-naming-system-for-threat-actors/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694550/hacking/google-launches-unified-cryptonym-based-naming-system-for-threat-actors/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:42 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Google Threat Intelligence Group (GTIG) has introduced a unified cryptonym-based naming system for cyber threat actors, aiming to simplify attribution, improve analyst workflows, and eliminate inconsistencies between legacy tracking conventions used across Google’s security teams. The initiative follows the integration of Mandiant and Google’s Threat Analysis Group (TAG) into GTIG. Before the merger, both organizations […]</p>
<p>The post <a href="https://gbhackers.com/google-launches-unified-cryptonym-based-naming-system/">Google Launches Unified Cryptonym-Based Naming System for Threat Actors</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Phantom Stealer Campaign Uses JavaScript and PowerShell to Steal Browser Credentials]]></title>
<description><![CDATA[A sophisticated phishing campaign that disguises malware delivery inside routine business communications, ultimately deploying Phantom Stealer v3.5.0 to harvest browser credentials, cookies, payment data, and cryptocurrency wallet information from victims. Documented by Seqrite, the campaign uses...]]></description>
<link>https://tsecurity.de/de/3694551/hacking/phantom-stealer-campaign-uses-javascript-and-powershell-to-steal-browser-credentials/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694551/hacking/phantom-stealer-campaign-uses-javascript-and-powershell-to-steal-browser-credentials/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:42 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A sophisticated phishing campaign that disguises malware delivery inside routine business communications, ultimately deploying Phantom Stealer v3.5.0 to harvest browser credentials, cookies, payment data, and cryptocurrency wallet information from victims. Documented by Seqrite, the campaign uses two distinct phishing themes that both lead to the same infection chain. One email impersonates UPS Forwarding Hub, referencing fake […]</p>
<p>The post <a href="https://gbhackers.com/phantom-stealer-campaign-javascript-powershell/">Phantom Stealer Campaign Uses JavaScript and PowerShell to Steal Browser Credentials</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Hackers Use Stealer Logs to Bypass MFA and Launch Ransomware Attacks]]></title>
<description><![CDATA[Infostealer malware has now become the invisible thread linking petty credential theft to full-blown ransomware campaigns. Attackers no longer bother forcing their way through firewalls when infostealers have already unlocked the front door for them. Documented by DarkOwl, a stealer log archive g...]]></description>
<link>https://tsecurity.de/de/3694549/hacking/hackers-use-stealer-logs-to-bypass-mfa-and-launch-ransomware-attacks/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694549/hacking/hackers-use-stealer-logs-to-bypass-mfa-and-launch-ransomware-attacks/</guid>
<pubDate>Sat, 25 Jul 2026 19:02:41 +0200</pubDate>
<category>🕵️ Hacking</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Infostealer malware has now become the invisible thread linking petty credential theft to full-blown ransomware campaigns. Attackers no longer bother forcing their way through firewalls when infostealers have already unlocked the front door for them. Documented by DarkOwl, a stealer log archive generated by infostealer malware that silently harvests browser-saved passwords, session cookies, cryptocurrency wallet data, […]</p>
<p>The post <a href="https://gbhackers.com/hackers-stealer-logs-launch-ransomware-attacks/">Hackers Use Stealer Logs to Bypass MFA and Launch Ransomware Attacks</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[GDC 2026: Announcing new tools and platform updates for Windows PC game developers]]></title>
<description><![CDATA[Our focus is clear: making Windows 11 the best place for game developers to create, experiment, ship and scale. Windows is an open, flexible platform that supports choice across engines, tools, hardware and distribution models. That commitment is roo
The post GDC 2026: Announcing new tools and pl...]]></description>
<link>https://tsecurity.de/de/3694512/it-security-nachrichten/gdc-2026-announcing-new-tools-and-platform-updates-for-windows-pc-game-developers/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694512/it-security-nachrichten/gdc-2026-announcing-new-tools-and-platform-updates-for-windows-pc-game-developers/</guid>
<pubDate>Sat, 25 Jul 2026 19:01:36 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Our focus is clear: making Windows 11 the best place for game developers to create, experiment, ship and scale. Windows is an open, flexible platform that supports choice across engines, tools, hardware and distribution models. That commitment is roo</p>
<p>The post <a href="https://blogs.windows.com/windowsdeveloper/2026/03/11/gdc-2026-announcing-new-tools-and-platform-updates-for-windows-pc-game-developers/">GDC 2026: Announcing new tools and platform updates for Windows PC game developers</a> appeared first on <a href="https://blogs.windows.com/windowsdeveloper">Windows Developer Blog</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Enhanced developer tools on the Microsoft Store]]></title>
<description><![CDATA[The Microsoft Store on Windows continues to evolve, shaped by ongoing feedback from developers building and scaling apps on the platform. Over the past months, that feedback has guided several updates across onboarding, publishing, distribution and a
The post Enhanced developer tools on the Micro...]]></description>
<link>https://tsecurity.de/de/3694513/it-security-nachrichten/enhanced-developer-tools-on-the-microsoft-store/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694513/it-security-nachrichten/enhanced-developer-tools-on-the-microsoft-store/</guid>
<pubDate>Sat, 25 Jul 2026 19:01:36 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>The Microsoft Store on Windows continues to evolve, shaped by ongoing feedback from developers building and scaling apps on the platform. Over the past months, that feedback has guided several updates across onboarding, publishing, distribution and a</p>
<p>The post <a href="https://blogs.windows.com/windowsdeveloper/2026/02/11/enhanced-developer-tools-on-the-microsoft-store/">Enhanced developer tools on the Microsoft Store</a> appeared first on <a href="https://blogs.windows.com/windowsdeveloper">Windows Developer Blog</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Facebook Offers a Verification System Certifying to Other Users That You're a Real Human]]></title>
<description><![CDATA[Facebook announced Friday they're launching a badge "that verifies there's a real person behind a profile".



"You record a short video selfie, which we check against your existing profile photos to confirm a match. The process is free and typically takes just a few minutes. Accounts must meet o...]]></description>
<link>https://tsecurity.de/de/3694500/it-security-nachrichten/facebook-offers-a-verification-system-certifying-to-other-users-that-youre-a-real-human/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694500/it-security-nachrichten/facebook-offers-a-verification-system-certifying-to-other-users-that-youre-a-real-human/</guid>
<pubDate>Sat, 25 Jul 2026 19:01:11 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Facebook announced Friday they're launching a badge "that verifies there's a real person behind a profile".



"You record a short video selfie, which we check against your existing profile photos to confirm a match. The process is free and typically takes just a few minutes. Accounts must meet our trust and safety standards to qualify for verification...." Once verified, your badge will appear across the places on Facebook where it matters most: Marketplace, Dating, Groups, and Profile to start. Over time, we'll add badges in Feed posts as well. There's no subscription fee — you verify once, and the badge travels with you across Facebook... [Y]ou'll see the Verified badge on accounts that have completed the verification process... It's a quick, visible signal, before you respond to a listing, accept a date, or join a conversation, that there's a real person on the other end. 

"We're rolling out Facebook Verified in phases, starting in select markets with plans to expand globally..." their announcement adds. "As AI makes it easier to do more on Facebook, a clear signal that distinguishes real people becomes essential. That's what Facebook Verified is for: keeping the moments that matter on Facebook grounded in real people." 

 Lifehacker shares their reaction:


Facebook says it will store your selfie video for "up to 30 days" after verification, which is a one-time process. It's not entirely clear what happens with that video in the meantime, and it's worth noting that Meta has relied on user data to train its AI. Meta AI (and Meta more broadly) is a terrible offender when it comes to privacy and security, so you should consider whether the tradeoff of a verification mark is worth handing over more of your data and read the privacy policy before you agree. 

Google also launched a video selfie verification feature this week, though its purpose is to prove your identity should you get locked out of your account. Unlike Facebook Verified, which is meant to be a trust signal to other users, Google's selfie verification allows access to your entire Google account, bringing with it some additional security considerations.

<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Facebook+Offers+a+Verification+System+Certifying+to+Other+Users+That+You're+a+Real+Human%3A+https%3A%2F%2Ftech.slashdot.org%2Fstory%2F26%2F07%2F25%2F064249%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Ftech.slashdot.org%2Fstory%2F26%2F07%2F25%2F064249%2Ffacebook-offers-a-verification-system-certifying-to-other-users-that-youre-a-real-human%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://tech.slashdot.org/story/26/07/25/064249/facebook-offers-a-verification-system-certifying-to-other-users-that-youre-a-real-human?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Phantom Stealer Campaign Uses JavaScript and PowerShell to Steal Browser Credentials]]></title>
<description><![CDATA[A sophisticated phishing campaign that disguises malware delivery inside routine business communications, ultimately deploying Phantom Stealer v3.5.0 to harvest browser credentials, cookies, payment data, and cryptocurrency wallet information from victims. Documented by Seqrite, the campaign uses...]]></description>
<link>https://tsecurity.de/de/3694479/it-security-nachrichten/phantom-stealer-campaign-uses-javascript-and-powershell-to-steal-browser-credentials/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694479/it-security-nachrichten/phantom-stealer-campaign-uses-javascript-and-powershell-to-steal-browser-credentials/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:48 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A sophisticated phishing campaign that disguises malware delivery inside routine business communications, ultimately deploying Phantom Stealer v3.5.0 to harvest browser credentials, cookies, payment data, and cryptocurrency wallet information from victims. Documented by Seqrite, the campaign uses two distinct phishing themes that both lead to the same infection chain. One email impersonates UPS Forwarding Hub, referencing fake […]</p>
<p>The post <a href="https://gbhackers.com/phantom-stealer-campaign-javascript-powershell/">Phantom Stealer Campaign Uses JavaScript and PowerShell to Steal Browser Credentials</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Hackers Exploit Industrial PLCs and Manipulate HMI Displays to Hide Attacks]]></title>
<description><![CDATA[Six federal agencies have updated a joint advisory warning that Iranian-affiliated advanced persistent threat (APT) actors are actively exploiting internet-exposed programmable logic controllers (PLCs) across U.S. critical infrastructure, manipulating human-machine interface (HMI) displays so ope...]]></description>
<link>https://tsecurity.de/de/3694480/it-security-nachrichten/hackers-exploit-industrial-plcs-and-manipulate-hmi-displays-to-hide-attacks/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694480/it-security-nachrichten/hackers-exploit-industrial-plcs-and-manipulate-hmi-displays-to-hide-attacks/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:48 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Six federal agencies have updated a joint advisory warning that Iranian-affiliated advanced persistent threat (APT) actors are actively exploiting internet-exposed programmable logic controllers (PLCs) across U.S. critical infrastructure, manipulating human-machine interface (HMI) displays so operators cannot visually detect the intrusion. The advisory, first issued in April 2026 and revised on July 22, 2026, is cosigned […]</p>
<p>The post <a href="https://gbhackers.com/hackers-exploit-industrial-plcs/">Hackers Exploit Industrial PLCs and Manipulate HMI Displays to Hide Attacks</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Hackers Use Stealer Logs to Bypass MFA and Launch Ransomware Attacks]]></title>
<description><![CDATA[Infostealer malware has now become the invisible thread linking petty credential theft to full-blown ransomware campaigns. Attackers no longer bother forcing their way through firewalls when infostealers have already unlocked the front door for them. Documented by DarkOwl, a stealer log archive g...]]></description>
<link>https://tsecurity.de/de/3694477/it-security-nachrichten/hackers-use-stealer-logs-to-bypass-mfa-and-launch-ransomware-attacks/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694477/it-security-nachrichten/hackers-use-stealer-logs-to-bypass-mfa-and-launch-ransomware-attacks/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:47 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Infostealer malware has now become the invisible thread linking petty credential theft to full-blown ransomware campaigns. Attackers no longer bother forcing their way through firewalls when infostealers have already unlocked the front door for them. Documented by DarkOwl, a stealer log archive generated by infostealer malware that silently harvests browser-saved passwords, session cookies, cryptocurrency wallet data, […]</p>
<p>The post <a href="https://gbhackers.com/hackers-stealer-logs-launch-ransomware-attacks/">Hackers Use Stealer Logs to Bypass MFA and Launch Ransomware Attacks</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Google Launches Unified Cryptonym-Based Naming System for Threat Actors]]></title>
<description><![CDATA[Google Threat Intelligence Group (GTIG) has introduced a unified cryptonym-based naming system for cyber threat actors, aiming to simplify attribution, improve analyst workflows, and eliminate inconsistencies between legacy tracking conventions used across Google’s security teams. The initiative ...]]></description>
<link>https://tsecurity.de/de/3694478/it-security-nachrichten/google-launches-unified-cryptonym-based-naming-system-for-threat-actors/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694478/it-security-nachrichten/google-launches-unified-cryptonym-based-naming-system-for-threat-actors/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:47 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Google Threat Intelligence Group (GTIG) has introduced a unified cryptonym-based naming system for cyber threat actors, aiming to simplify attribution, improve analyst workflows, and eliminate inconsistencies between legacy tracking conventions used across Google’s security teams. The initiative follows the integration of Mandiant and Google’s Threat Analysis Group (TAG) into GTIG. Before the merger, both organizations […]</p>
<p>The post <a href="https://gbhackers.com/google-launches-unified-cryptonym-based-naming-system/">Google Launches Unified Cryptonym-Based Naming System for Threat Actors</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The February 2026 Security Update Review]]></title>
<description><![CDATA[I have survived the biggest Pwn2Own ever, but I’m back in Tokyo for the second Patch Tuesday of 2026. My location never stops Patch Tuesday from coming, so let’s take a look at the latest security patches from Adobe and Microsoft.  If you’d rather watch the full video recap covering the entire re...]]></description>
<link>https://tsecurity.de/de/3694474/it-security-nachrichten/the-february-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694474/it-security-nachrichten/the-february-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:44 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">I have survived the biggest Pwn2Own ever, but I’m back in Tokyo for the second Patch Tuesday of 2026. My location never stops Patch Tuesday from coming, so let’s take a look at the latest security patches from Adobe and Microsoft.  If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for February 2026</strong></p><p class="">For February, Adobe released nine bulletins addressing 44 unique CVEs in Adobe Audition, After Effects, InDesign, Substance 3D Designer, Substance 3D Stager, Adobe Bridge, Substance 3D Modeler, Lightroom Classic, and the Adobe DNG Software Development Kit (SDK). The largest update here is for <a href="https://helpx.adobe.com/security/products/after_effects/apsb26-15.html">After Effects</a>, which fixes 13 Critical and two Important rated bugs. The patch for <a href="https://helpx.adobe.com/security/products/substance3d_designer/apsb26-19.html">Substance 3D Designer</a> is on the larger side with seven fixes, but only two of those are Critical. On the other hand, the fix for <a href="https://helpx.adobe.com/security/products/substance3d_stager/apsb26-20.html">Substance 3D Stager</a> corrects five Critical-rated bugs that could lead to code execution. The <a href="https://helpx.adobe.com/security/products/audition/apsb26-14.html">Audition</a> patch fixes six bugs, but only one is Critical.</p><p class="">The other patches are smaller in size. The fix for the <a href="https://helpx.adobe.com/security/products/dng-sdk/apsb26-23.html">Adobe DNG Software Development Kit (SDK)</a> corrects two Critical and two Important-rated bugs. The <a href="https://helpx.adobe.com/security/products/indesign/apsb26-17.html">InDesign</a> patch fixes three bugs, but only one is Critical. The update for <a href="https://helpx.adobe.com/security/products/bridge/apsb26-21.html">Adobe Bridge</a> fixes two Critical bug that could lead to code execution. The patch for <a href="https://helpx.adobe.com/security/products/lightroom/apsb26-06.html">Lightroom Classic</a> addresses a single Critical bug, and the release is wrapped up with a patch for <a href="https://helpx.adobe.com/security/products/substance3d-modeler/apsb26-22.html">Substance 3D Modeler</a> that fixes a single, Important-rated memory link.</p><p class="">None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release, and all of the updates released by Adobe this month are listed as deployment priority 3.</p><p class=""><strong>Microsoft Patches for February 2026</strong></p><p class="">This month, Microsoft drops 58 new CVEs in Windows and Windows components, Office and Office Components, Azure, Microsoft Edge (Chromium-based), .NET and Visual Studio, GitHub Copilot, Mailslot FS, Exchange Server, Internet Explorer (!), Power BI, Hyper-V Server, and the Windows Subsystem for Linux. Counting the third-party and Chromium updates listed in the release, it brings the total number of CVEs to 62. One of the bugs in the Windows Graphics component was submitted through the ZDI program. Five of these bugs are rated Critical, two are rated Moderate, and the rest are rated Important in severity.</p><p class="">It’s typical to see this number of CVEs released in February, but the number of bugs under active attack is extraordinarily high. Microsoft lists six bugs being exploited at the time of release, with three of these listed as publicly known. Last month only had a single bug being exploited, although there were twice as many CVEs patched. We’ll see if we’re on our way to another “hot exploit summer” as we saw a few years ago or if this is just an aberration. </p><p class="">Let’s take a closer look at some of the more interesting updates for this month, starting with the bugs under active attack: </p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510"><strong>CVE-2026-21510</strong></a><strong> - Windows Shell Security Feature Bypass Vulnerability<br></strong>This bug is listed as a security feature bypass, but it could also be classified as code execution. An attacker can bypass Windows SmartScreen and Windows Shell security prompts to execute code on a target system. This bug is also listed as publicly known, but Microsoft doesn’t say where. There is user interaction here, as the client needs to click a link or a shortcut file. Still, a one-click bug to gain code execution is a rarity. Definitely test and deploy this fix quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514"><strong>CVE-2026-21514</strong></a><strong> - Microsoft Word Security Feature Bypass Vulnerability<br></strong>This bug also requires user interaction in the form of opening a Word document, but that’s all that’s required to bypass protections to dangerous COM/OLE controls. Thankfully, the Preview Pane is <em>not</em> an attack vector here. However, users are well known to open lots of documents they receive in e-mail. This bypass could also result in code execution if the right COM/OLE control is hit. This is also listed as publicly known, so add this to the list to test and deploy quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519"><strong>CVE-2026-21519</strong></a><strong> - Desktop Window Manager Elevation of Privilege Vulnerability<br></strong>This is the second month in a row that a DWM was listed as being exploited in the wild. That leads me to believe the first patch didn’t completely resolve the vulnerability. Same as last month, this bug allows attackers to run code with SYSTEM privileges. Bugs of this type are typically paired with a code execution bug to take over a system. As always, Microsoft offers no indication of how widespread these exploits may be.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533"><strong>CVE-2026-21533</strong></a><strong> - Windows Remote Desktop Services Elevation of Privilege Vulnerability<br></strong>Don’t let the word “Remote” in the title fool you – this is a local bug that allows attackers to run code with SYSTEM privileges. It’s interesting that Microsoft lists “Improper privilege management” as the root cause for this issue. If the system is running Remote Desktop Services, it’s probably a juicy target for attackers to move laterally after an initial breach. Add this one to the list of patches to test and deploy immediately.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513"><strong>CVE-2026-21513</strong></a><strong> - Internet Explorer Security Feature Bypass Vulnerability<br></strong>Although long gone by many measurements, IE does still exist on Windows systems, and calling it always results in a vulnerability somehow. This bug manifests similarly to the Shell bug above, as it requires user interaction but could result in code execution. The bypass here is simply the ability to reach IE, which shouldn’t be possible. Again, test and deploy this fix quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525"><strong>CVE-2026-21525</strong></a><strong> - Windows Remote Access Connection Manager Denial of Service Vulnerability<br></strong>It’s unusual to see DoS bugs being used in active attacks, but that’s what we have here. A null pointer deref in the Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally. Most null pointer derefs cause the application or service to crash, but it’s not clear if it will automatically restart. I would exercise caution and patch quickly either way.</p><p class="">Here’s the full list of CVEs released by Microsoft for February 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="2026_PatchTable-Feb.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="953">
 <col width="151" class="xl69">
 <col width="263" class="xl72">
 <col width="111" class="xl71" span="4">
 <col width="95" class="xl71">
 <tr height="48">
  <td width="151" class="xl69" height="48"><span> </span>CVE<span> </span></td>
  <td width="263" class="xl72"><span> </span>Title<span> </span></td>
  <td width="111" class="xl71"><span> </span>Severity<span> </span></td>
  <td width="111" class="xl71"><span> </span>CVSS<span> </span></td>
  <td width="111" class="xl71"><span> </span>Public</td>
  <td width="111" class="xl71"><span> </span>Exploited<span> </span></td>
  <td width="95" class="xl71"><span> </span>TYPE<span> </span></td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514"><span><span> </span>CVE-2026-21514<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Word Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510"><span><span> </span>CVE-2026-21510<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Shell Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513"><span><span> </span>CVE-2026-21513<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Internet Explorer Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519"><span><span> </span>CVE-2026-21519<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Desktop Window Manager Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="72">
  <td class="xl74" height="72"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533"><span><span> </span>CVE-2026-21533<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Remote Desktop Services Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525"><span><span> </span>CVE-2026-21525<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Remote Access Connection Manager
  Denial of Service Vulnerability<span> </span></td>
  <td class="xl68"><span> </span>Moderate<span> </span></td>
  <td class="xl65">6.2</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl66"><span> </span>Yes<span> </span></td>
  <td class="xl65">DoS</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21511"><span><span> </span>CVE-2026-21511<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Outlook Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-2804"><span><span> </span>CVE-2023-2804 *</span></a></td>
  <td width="263" class="xl75"><span> </span>Red Hat, Inc. CVE-2023-2804: Heap Based
  Overflow libjpeg-turbo<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>Yes<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24302"><span><span> </span>CVE-2026-24302<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure Arc Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl73"><span> </span>Critical<span> </span></td>
  <td class="xl65">8.6</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24300"><span><span> </span>CVE-2026-24300<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure Front Door Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl73"><span> </span>Critical<span> </span></td>
  <td class="xl65">9.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21532"><span><span> </span>CVE-2026-21532<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure Function Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl73"><span> </span>Critical<span> </span></td>
  <td class="xl65">8.2</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21522"><span><span> </span>CVE-2026-21522<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft ACI Confidential Containers
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl73"><span> </span>Critical<span> </span></td>
  <td class="xl65">6.7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23655"><span><span> </span>CVE-2026-23655<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft ACI Confidential Containers
  Information Disclosure Vulnerability<span> </span></td>
  <td class="xl73"><span> </span>Critical<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21218"><span><span> </span>CVE-2026-21218<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>.NET and Visual Studio Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21512"><span><span> </span>CVE-2026-21512<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure DevOps Server Cross-Site Scripting
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">XSS</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21529"><span><span> </span>CVE-2026-21529 †</span></a></td>
  <td width="263" class="xl75"><span> </span>Azure HDInsight Spoofing Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">5.7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21528"><span><span> </span>CVE-2026-21528<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure IoT Explorer Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21228"><span><span> </span>CVE-2026-21228<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure Local Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.1</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21531"><span><span> </span>CVE-2026-21531<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Azure SDK for Python Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">9.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21251"><span><span> </span>CVE-2026-21251<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Cluster Client Failover (CCF) Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20846"><span><span> </span>CVE-2026-20846<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GDI+ Denial of Service Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">DoS</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523"><span><span> </span>CVE-2026-21523<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GitHub Copilot and Visual Studio Code Remote
  Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21518"><span><span> </span>CVE-2026-21518<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GitHub Copilot and Visual Studio Code
  Security Feature Bypass Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21257"><span><span> </span>CVE-2026-21257<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GitHub Copilot and Visual Studio Elevation
  of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21256"><span><span> </span>CVE-2026-21256<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GitHub Copilot and Visual Studio Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21516"><span><span> </span>CVE-2026-21516<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>GitHub Copilot for Jetbrains Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21253"><span><span> </span>CVE-2026-21253<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Mailslot File System Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21537"><span><span> </span>CVE-2026-21537 †</span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Defender for Endpoint Linux
  Extension Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21259"><span><span> </span>CVE-2026-21259<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Excel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21258"><span><span> </span>CVE-2026-21258<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Excel Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">5.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21261"><span><span> </span>CVE-2026-21261<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Excel Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">5.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21527"><span><span> </span>CVE-2026-21527<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Exchange Server Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21260"><span><span> </span>CVE-2026-21260<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Outlook Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21229"><span><span> </span>CVE-2026-21229<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Power BI Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21236"><span><span> </span>CVE-2026-21236<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21238"><span><span> </span>CVE-2026-21238<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21241"><span><span> </span>CVE-2026-21241<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21517"><span><span> </span>CVE-2026-21517<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows App for Mac Installer Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21234"><span><span> </span>CVE-2026-21234<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Connected Devices Platform Service
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21235"><span><span> </span>CVE-2026-21235<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Graphics Component Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21246"><span><span> </span>CVE-2026-21246<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Graphics Component Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21232"><span><span> </span>CVE-2026-21232<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows HTTP.sys Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21240"><span><span> </span>CVE-2026-21240<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows HTTP.sys Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21250"><span><span> </span>CVE-2026-21250<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows HTTP.sys Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21244"><span><span> </span>CVE-2026-21244<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Hyper-V Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21247"><span><span> </span>CVE-2026-21247<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Hyper-V Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21248"><span><span> </span>CVE-2026-21248<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Hyper-V Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21255"><span><span> </span>CVE-2026-21255<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Hyper-V Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">SFB</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21231"><span><span> </span>CVE-2026-21231<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21239"><span><span> </span>CVE-2026-21239<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21245"><span><span> </span>CVE-2026-21245<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21222"><span><span> </span>CVE-2026-21222<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Kernel Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">5.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Info</td>
 </tr>
 <tr height="73">
  <td class="xl74" height="73"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21243"><span><span> </span>CVE-2026-21243<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Lightweight Directory Access
  Protocol (LDAP) Denial of Service Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">DoS</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841"><span><span> </span>CVE-2026-20841<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Notepad App Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">8.8</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21249"><span><span> </span>CVE-2026-21249<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows NTLM Spoofing Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">3.3</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21508"><span><span> </span>CVE-2026-21508<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Storage Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21237"><span><span> </span>CVE-2026-21237<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Subsystem for Linux Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21242"><span><span> </span>CVE-2026-21242<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Windows Subsystem for Linux Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl65">7</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">EoP</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-1861"><span><span> </span>CVE-2026-1861 *</span></a></td>
  <td width="263" class="xl75"><span> </span>Chromium: CVE-2026-1861 Heap buffer overflow
  in libvpx<span> </span></td>
  <td class="xl67"><span> </span>High</td>
  <td class="xl65">N/A</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-1862"><span><span> </span>CVE-2026-1862 *</span></a></td>
  <td width="263" class="xl75"><span> </span>Chromium: CVE-2026-1862 Type Confusion in
  V8<span> </span></td>
  <td class="xl67"><span> </span>High</td>
  <td class="xl65">N/A</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">RCE</td>
 </tr>
 <tr height="48">
  <td class="xl74" height="48"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0391"><span><span> </span>CVE-2026-0391<span> </span></span></a></td>
  <td width="263" class="xl75"><span> </span>Microsoft Edge (Chromium-based) for Android
  Spoofing Vulnerability<span> </span></td>
  <td class="xl68"><span> </span>Moderate<span> </span></td>
  <td class="xl65">6.5</td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65"><span> </span>No<span> </span></td>
  <td class="xl65">Spoofing</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="151"></td>
  <td width="263"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="95"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Moving on to the Critical-rated bugs, the patch for Azure Front Door sounds frightening, but Microsoft has already fixed the bug and is just now documenting it. That’s also true for the bugs in Azure Arc and Azure Function. There are two Critical-rated bugs in the ACI Confidential Containers. The first allows a container escape while the second discloses secret tokens and keys. Either way, you’ll want to handle those quickly.</p><p class="">Taking a look at the other code execution vulnerabilities in this month’s release, we start with a frightening looking bug in Azure SDK for Python that has the highest CVSS this month of 9.8. A remote, unauthenticated attacker code gain code execution on an affected system via a maliciously crafted continuation token. It’s not clear why this isn’t rated Critical, but I would treat it as such. The three bugs in Hyper-V are actually local open-and-own bugs that require a user to open a malicious file on an affected system. That’s also true for the bug in Notepad. The bug in Power BI is confusing, because Microsoft says it requires authentication and could lead to an attacker running code as an authenticated user. There’s the poorly named “Azure Local Remote Code Execution Vulnerability”, but it requires a machine-in-the-middle (MitM) to exploit. The bug in Defender for Endpoint Linux is restricted to local subnets, but you’ll need to enable auto provisioning to get the patch. The final code execution bugs addressed this month are in GitHub Copilot. Two are command injections and the other is a Time-of-check time-of-use (toctou) race condition, but both could end up in code execution on affected systems.</p><p class="">Patches for Elevation of Privilege (EoP) bugs make up nearly 50% of this release, but most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges. There are only two of note. The first is a command injection bug in GitHub Copilot that leads to executing code at the level of the targeted application. The second is a bug in a kernel that leads to SYSTEM but could also be used for a sandbox escape.</p><p class="">There’s a unusually high number of spoofing bugs in this month’s release, and the ones for Outlook are the most troubling. First, the Preview Pane is an attack vector. Secondly, the bugs could be used to relay NTLM credentials via just an email, which could result in credential disclosure. And you’ll need multiple patches to fully address these bugs. At least they can be applied in any order.  There’s a UI misrepresentation bug in Exchange Server that could allow an attacker to either view some sensitive information or “make changes to disclosed information”. At what point does data become disclosed? That odd phrasing makes me think they are using AI to right some of their descriptions. The phrasing also appears in the patch for NTLM. That bug is triggered by opening a specially crafted Office doc, and while they explicitly say it could be used to relay NTLM creds, it sure seems that way. The patch for .NET and Visual Studio fixes a bug that allows attackers to bypass header validation, resulting in the service accepting a message it should reject. Finally, the bug in Azure HDInsight is really just a cross-site scripting (XSS) bug. The caveat here is that you need to restart Ambari server in both of the head nodes to have this fix updated. There is also an XSS in Azure Devops Server, but at least it is labelled as such.</p><p class="">There are a couple of additional security feature bypass bugs to discuss. The first is in Hyper-V and bypasses the Virtualization-based Security feature. The other is in GitHub Copilot and Visual Studio Code. It’s another command injection, but this one can be used to bypass authentication. Neat.</p><p class="">Looking at the remaining info disclosure bugs getting patched this month, most simply result in info leaks consisting of unspecified memory contents or memory addresses. The exception is the bug in Azure IoT Explorer. This bug could be used to view the contents of the target user’s local file system.</p><p class="">We end this month’s release with two DoS bugs: one in LDAP and one in GDI+. Neither descriptions from Microsoft provide any usable information.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">I plan on being back home for the March release but wherever I’m at, you can rest assured that March 10, I’ll be here to provide my assessment of the release. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The March 2026 Security Update Review]]></title>
<description><![CDATA[I am back in the friendly confines of the Mid-South headquarters of TrendAI ZDI (a.k.a. my home office), and am all set for the third patch Tuesday of 2026. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft.If you’d...]]></description>
<link>https://tsecurity.de/de/3694472/it-security-nachrichten/the-march-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694472/it-security-nachrichten/the-march-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:43 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">I am back in the friendly confines of the Mid-South headquarters of TrendAI ZDI (a.k.a. my home office), and am all set for the third patch Tuesday of 2026. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft.If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for March 2026</strong></p><p class="">For March, Adobe released eight bulletins addressing 80 unique CVEs in Adobe Acrobat Reader, Commerce, Illustrator, Substance 3D Painter, Premier Pro, Experience Manager, Substance 3D Stager, and the Adobe DNG Software Development Kit (SDK). Two of these bugs were submitted through the TrendAI ZDI program. If you need to prioritize, the update for <a href="https://helpx.adobe.com/security/products/acrobat/apsb26-26.html">Acrobat</a> likely has the most impact, with the patch fixing two Critical-rated and one Important bugs. The fix for <a href="https://helpx.adobe.com/security/products/experience-manager/apsb26-24.html">Experience Manager</a> is the largest this month with 33 CVEs addressed. However, these are simple cross-site scripting (XSS) bugs, so it’s not too exciting. The fix for <a href="https://helpx.adobe.com/security/products/magento/apsb26-05.html">Commerce</a> is also quite large with 19 CVEs. Most of these are also XSS bugs, but there’s a few security feature bypass bugs in there, too. Adobe actually gives this patch a deployment priority of 2, but it’s not under active attack at the time of release. </p><p class="">The fix for <a href="https://helpx.adobe.com/security/products/illustrator/apsb26-18.html">Illustrator</a> corrects seven bugs, including a few Critical-rated ones. The patch for <a href="https://helpx.adobe.com/security/products/substance3d_painter/apsb26-25.html">Substance 3D Painter</a> fixes nine different CVEs, all rated Important. That’s not the case for <a href="https://helpx.adobe.com/security/products/substance3d_stager/apsb26-29.html">Substance 3D Stager</a>, which fixes six different Critical bugs that could lead to arbitrary code execution. The patch for the <a href="https://helpx.adobe.com/security/products/dng-sdk/apsb26-30.html">Adobe DNG Software Development Kit</a> (SDK) addresses one Critical and one Important bug. Finally, the update for Premiere Pro correct a single, Critical-rated bug that could lead to arbitrary code execution. </p><p class="">None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release, and beyond the update for Commerce, all of the other updates released by Adobe this month are listed as deployment priority 3.</p><p class=""><strong>Microsoft Patches for March 2026</strong></p><p class="">This month, Microsoft released 84 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, SQL Server, Hyper-V Server, and the Windows Resilient File System (ReFS). Counting the third-party and Chromium updates listed in the release, it brings to total number of CVEs to 94. Five of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, and the rest are rated Important in severity.</p><p class="">This volume is relatively typical for a March release, and the lack of bugs under active attack is a nice change from last month. There are two vulnerabilities listed as publicly known at the time of release, but none listed as actively exploited.</p><p class="">Let’s take a closer look at some of the more interesting updates for this month, starting with a bug with an AI slant:</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26144"><strong>CVE-2026-26144</strong></a><strong> - Microsoft Excel Information Disclosure Vulnerability<br></strong>This is a fascinating bug and an attack scenario we’re likely to see more often. The vulnerability is a simple cross-site scripting (XSS) bug in Excel, but an attacker could use it to cause the Copilot Agent to exfiltrate data off the target. This essentially makes it a zero-click information disclosure. Although not stated, the disclosure is likely at the level of the logged-on user, so there isn’t a privilege escalation component. Info disclosures rarely get rated Critical, but it makes sense here.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26110"><strong>CVE-2026-26110</strong></a><strong>/</strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26113"><strong>CVE-2026-26113</strong></a><strong> - Microsoft Office Remote Code Execution Vulnerability <br></strong>Another month and another pair of Office bugs where the Preview Pane is an exploit vector. I’ve lost count of how many of these bugs have been patched over the last year, but it’s just a matter of time until they start appearing in active exploits. The latest versions of Outlook allow you to hide the Preview Pane, but it isn’t clear if this would mitigate these attacks. The best option is still to test and deploy the update, but considering how many of these patches exist, it’s likely further updates will be needed to fully address these issues.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23669"><strong>CVE-2026-23669</strong></a><strong> - Windows Print Spooler Remote Code Execution Vulnerability<br></strong>Just reading the title makes me twitch with remembrances of <a href="https://en.wikipedia.org/wiki/PrintNightmare">Print Nightmare</a> from a few years ago. This bug works in the same manner as those exploits. An authenticated attacker sends specially crafted messages to an affected system to gain arbitrary code execution. No user interaction is required. Let’s hope we don’t end up in a new nightmare of spooler exploits. Test and deploy this one quickly.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23668"><strong>CVE-2026-23668</strong></a><strong> - Windows Graphics Component Elevation of Privilege Vulnerability<br></strong>This vulnerability was submitted to the ZDI program by Marcin Wiązowski as two separate bugs, and it demonstrates the need for variant investigations when creating security patches. Both cases are caused by the lack of proper locking when performing operations on an object. However, in one case, it’s in the cdd.dll driver while the other is in the win32kfull driver. Either way, an attacker could use these to elevate privileges to SYSTEM and execute arbitrary code. Since the fix for both is to add object locking to the GDI object, the cases are combined into a single CVE. That’s not a problem, but it does show how variants can occur, and fixes should be as broad as possible.</p><p class="">Here’s the full list of CVEs released by Microsoft for March 2026:</p>





















  
  




  


  
    





<link rel="File-List" href="2026_PatchTable-March.fld/filelist.xml">













<table border="0" cellpadding="0" cellspacing="0" width="953">
 <col width="151" class="xl65">
 <col width="263" class="xl66">
 <col width="111" class="xl67" span="4">
 <col width="95" class="xl67">
 <col width="645" class="xl65">
 <tr height="47">
  <td width="151" class="xl65" height="47"><span> </span>CVE<span> </span></td>
  <td width="263" class="xl66"><span> </span>Title<span> </span></td>
  <td width="111" class="xl67"><span> </span>Severity<span> </span></td>
  <td width="111" class="xl67"><span> </span>CVSS<span> </span></td>
  <td width="111" class="xl67"><span> </span>Public</td>
  <td width="111" class="xl67"><span> </span>Exploited<span> </span></td>
  <td width="95" class="xl67"><span> </span>Type<span> </span></td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26127"><span><span> </span>CVE-2026-26127<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>.NET Denial of Service Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl68"><span> </span>Yes<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21262"><span><span> </span>CVE-2026-21262<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>SQL Server Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl68"><span> </span>Yes<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23651"><span><span> </span>CVE-2026-23651<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft ACI Confidential Containers
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">6.7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26124"><span><span> </span>CVE-2026-26124<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft ACI Confidential Containers
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">6.7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26122"><span><span> </span>CVE-2026-26122<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft ACI Confidential Containers
  Information Disclosure Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">6.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21536"><span><span> </span>CVE-2026-21536<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Devices Pricing Program Remote
  Code Execution Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">9.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26144"><span><span> </span>CVE-2026-26144<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Excel Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26110"><span><span> </span>CVE-2026-26110<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Office Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">8.4</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26113"><span><span> </span>CVE-2026-26113<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Office Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">8.4</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26125"><span><span> </span>CVE-2026-26125<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Payment Orchestrator Service Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67">8.6</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26131"><span><span> </span>CVE-2026-26131<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>.NET Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25177"><span><span> </span>CVE-2026-25177<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Active Directory Domain Services Elevation
  of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26117"><span><span> </span>CVE-2026-26117<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Arc Enabled Servers - Azure Connected
  Machine Agent Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26130"><span><span> </span>CVE-2026-26130<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>ASP.NET Core Denial of Service
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23661"><span><span> </span>CVE-2026-23661<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Azure IoT Explorer Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23662"><span><span> </span>CVE-2026-23662<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Azure IoT Explorer Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23664"><span><span> </span>CVE-2026-23664<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Azure IoT Explorer Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26121"><span><span> </span>CVE-2026-26121<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Azure IOT Explorer Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26118"><span><span> </span>CVE-2026-26118<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Azure MCP Server Tools Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23667"><span><span> </span>CVE-2026-23667<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Broadcast DVR Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25190"><span><span> </span>CVE-2026-25190<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>GDI Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25181"><span><span> </span>CVE-2026-25181<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>GDI+ Information Disclosure
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="97">
  <td class="xl72" height="97"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26030"><span><span> </span>CVE-2026-26030 *</span></a></td>
  <td width="263" class="xl66"><span> </span>GitHub: CVE-2026-26030 Microsoft Semantic
  Kernel InMemoryVectorStore filter functionality vulnerable<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">9.9</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23654"><span><span> </span>CVE-2026-23654 *</span></a></td>
  <td width="263" class="xl66"><span> </span>GitHub: Zero Shot SCFoundation Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26141"><span><span> </span>CVE-2026-26141<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Hybrid Worker Extension (Arc-enabled Windows
  VMs) Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23665"><span><span> </span>CVE-2026-23665 †</span></a></td>
  <td width="263" class="xl66"><span> </span>Linux Azure Diagnostic extension (LAD)
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23674"><span><span> </span>CVE-2026-23674<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>MapUrlToZone Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">SFB</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26123"><span><span> </span>CVE-2026-26123<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Authenticator Information
  Disclosure Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26148"><span><span> </span>CVE-2026-26148 †</span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Azure AD SSH Login extension for
  Linux Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.1</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25167"><span><span> </span>CVE-2026-25167<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Brokering File System Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.4</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26107"><span><span> </span>CVE-2026-26107<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Excel Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26108"><span><span> </span>CVE-2026-26108<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Excel Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26109"><span><span> </span>CVE-2026-26109<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Excel Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.4</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26112"><span><span> </span>CVE-2026-26112<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Excel Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26134"><span><span> </span>CVE-2026-26134<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft Office Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26106"><span><span> </span>CVE-2026-26106<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft SharePoint Server Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26114"><span><span> </span>CVE-2026-26114<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft SharePoint Server Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26105"><span><span> </span>CVE-2026-26105<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Microsoft SharePoint Server Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.1</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Spoofing</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24283"><span><span> </span>CVE-2026-24283<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Multiple UNC Provider Kernel Driver
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25165"><span><span> </span>CVE-2026-25165<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Performance Counters for Windows Elevation
  of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24282"><span><span> </span>CVE-2026-24282<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Push message Routing Service Elevation of
  Privilege Vulnerability</td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26115"><span><span> </span>CVE-2026-26115<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>SQL Server Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26116"><span><span> </span>CVE-2026-26116<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>SQL Server Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20967"><span><span> </span>CVE-2026-20967<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>System Center Operations Manager (SCOM)
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24285"><span><span> </span>CVE-2026-24285<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Win32k Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24291"><span><span> </span>CVE-2026-24291<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Accessibility Infrastructure
  (ATBroker.exe) Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25186"><span><span> </span>CVE-2026-25186<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Accessibility Infrastructure
  (ATBroker.exe) Information Disclosure Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23660"><span><span> </span>CVE-2026-23660 †</span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Admin Center in Azure Portal
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24293"><span><span> </span>CVE-2026-24293<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25176"><span><span> </span>CVE-2026-25176<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25178"><span><span> </span>CVE-2026-25178<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25179"><span><span> </span>CVE-2026-25179<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Ancillary Function Driver for
  WinSock Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23656"><span><span> </span>CVE-2026-23656<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows App Installer Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.9</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25171"><span><span> </span>CVE-2026-25171<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Authentication Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23671"><span><span> </span>CVE-2026-23671<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Bluetooth RFCOM Protocol Driver
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24292"><span><span> </span>CVE-2026-24292<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Connected Devices Platform Service
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24295"><span><span> </span>CVE-2026-24295<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Device Association Service Elevation
  of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24296"><span><span> </span>CVE-2026-24296<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Device Association Service Elevation
  of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25189"><span><span> </span>CVE-2026-25189<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows DWM Core Library Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25174"><span><span> </span>CVE-2026-25174<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Extensible File Allocation Table
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25168"><span><span> </span>CVE-2026-25168<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Graphics Component Denial of Service
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">6.2</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25169"><span><span> </span>CVE-2026-25169<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Graphics Component Denial of Service
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">6.2</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">DoS</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23668"><span><span> </span>CVE-2026-23668<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Graphics Component Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25180"><span><span> </span>CVE-2026-25180<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Graphics Component Information
  Disclosure Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Info</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25170"><span><span> </span>CVE-2026-25170<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Hyper-V Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24297"><span><span> </span>CVE-2026-24297<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Kerberos Security Feature Bypass
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">6.5</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">SFB</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24287"><span><span> </span>CVE-2026-24287<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24289"><span><span> </span>CVE-2026-24289<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26132"><span><span> </span>CVE-2026-26132<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Kernel Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24288"><span><span> </span>CVE-2026-24288<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Mobile Broadband Driver Remote Code
  Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">6.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25175"><span><span> </span>CVE-2026-25175<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows NTFS Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23669"><span><span> </span>CVE-2026-23669<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Print Spooler Remote Code Execution
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24290"><span><span> </span>CVE-2026-24290<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Projected File System Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23673"><span><span> </span>CVE-2026-23673<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Resilient File System (ReFS)
  Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25172"><span><span> </span>CVE-2026-25172<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Routing and Remote Access Service
  (RRAS) Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25173"><span><span> </span>CVE-2026-25173<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Routing and Remote Access Service
  (RRAS) Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26111"><span><span> </span>CVE-2026-26111<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Routing and Remote Access Service
  (RRAS) Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25185"><span><span> </span>CVE-2026-25185<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Shell Link Processing Spoofing
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">5.3</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">Spoofing</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24294"><span><span> </span>CVE-2026-24294<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows SMB Server Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26128"><span><span> </span>CVE-2026-26128<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows SMB Server Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25166"><span><span> </span>CVE-2026-25166<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows System Image Manager Assessment and
  Deployment Kit (ADK) Remote Code Execution Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25188"><span><span> </span>CVE-2026-25188<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Telephony Service Elevation of
  Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">8.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23672"><span><span> </span>CVE-2026-23672<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Windows Universal Disk Format File System
  Driver (UDFS) Elevation of Privilege Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25187"><span><span> </span>CVE-2026-25187<span> </span></span></a></td>
  <td width="263" class="xl66"><span> </span>Winlogon Elevation of Privilege
  Vulnerability<span> </span></td>
  <td class="xl70"><span> </span>Important<span> </span></td>
  <td class="xl67">7.8</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">EoP</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3536"><span><span> </span>CVE-2026-3536 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3536 Integer overflow in
  ANGLE<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3538"><span><span> </span>CVE-2026-3538 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3538 Integer overflow in
  Skia<span> </span></td>
  <td class="xl71"><span> </span>Critical<span> </span></td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3539"><span><span> </span>CVE-2026-3539 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3539 Object lifecycle
  issue in DevTools<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3540"><span><span> </span>CVE-2026-3540 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3540 Inappropriate
  implementation in WebAudio<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3541"><span><span> </span>CVE-2026-3541 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3541 Inappropriate
  implementation in CSS<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3542"><span><span> </span>CVE-2026-3542 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3542 Inappropriate
  implementation in WebAssembly<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3543"><span><span> </span>CVE-2026-3543 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3543 Inappropriate
  implementation in V8<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="47">
  <td class="xl72" height="47"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3544"><span><span> </span>CVE-2026-3544 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3544 Heap buffer overflow
  in WebCodecs<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 <tr height="69">
  <td class="xl72" height="69"><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3545"><span><span> </span>CVE-2026-3545 *</span></a></td>
  <td width="263" class="xl66"><span> </span>Chromium: CVE-2026-3545 Insufficient data
  validation in Navigation<span> </span></td>
  <td class="xl69"><span> </span>High</td>
  <td class="xl67"><span> </span>N/A</td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67"><span> </span>No<span> </span></td>
  <td class="xl67">RCE</td>
 </tr>
 &lt;![if supportMisalignedColumns]&gt;
 <tr height="0">
  <td width="151"></td>
  <td width="263"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="111"></td>
  <td width="95"></td>
 </tr>
 &lt;![endif]&gt;
</table>











  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Looking at the other Critical-rated bugs in this month’s release, they are all cloud-native and require no user action. Microsoft has already remediated the vulnerabilities.</p><p class="">Moving on to the other code execution bugs, the vulnerabilities in SharePoint Server pop out first. Both require authentication, but it’s essentially the lowest level of authentication, so these would be ideal cases for lateral movement within an enterprise. There are the standard open-and-own cases within Office components. There an interesting sounding bug in the Windows Mobile Broadband Driver that requires physical access, but Microsoft doesn’t elaborate on the attack scenario beyond that fact. The bug in the System Image Manager Assessment and Deployment Kit (ADK) requires authentication. The bug in GDI requires user interaction. The remaining code execution bugs are in the RRAS protocol. We’ve seen bugs in this component in the past, but never in the wild. I wouldn’t ignore these, but I wouldn’t rush them out either.</p><p class="">Similar to last month, updates for Elevation of Privilege (EoP) bugs make up nearly half of this month’s release. And as we saw last month, but most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges. The bugs in SQL Server allow attackers to elevate to SQL sysadmin privileges. The bug in the Azure MCP Server is more complex. It allows attackers to obtain the permissions associated with the MCP Server’s managed identity, which lets them perform actions that the managed identity is able to reach. The bug in the Azure AD SSH Login extension for Linux leads to root access, and it won’t be easy to patch. You’ll need to run the update instructions from the command line on each affected system. That’s the same case for the bug in the Linux Azure Diagnostic extension (LAD). There’s an odd bug in the Hybrid Worker Extension (Arc‑enabled Windows VMs) that leads to “ELEVATED” privileges, which is something I’ve never seen before. The bug in the Broadcast DVR component allows an attacker to go from low integrity level up to medium. There’s a bug listed as an EoP in the Push message Routing Service, but reading the description, Microsoft notes it could lead to an information disclosure. It’s likely this is an error and should be an Information Disclosure bug. The final EoP is in the Azure Portal Windows Admin Center and leads to SYSTEM. However, there’s no patch to remediate this bug. Instead, you need to install the latest version of the Windows Admin Center extension through the Azure Portal by hand. </p><p class="">There are two security feature bypass patches in the March release. The first is a bypass of the MapURLToZone method, which (as expected) allows attackers to bypass MapURLToZone protections. The third bypass is in Kerberos and could allow an attacker to either view some sensitive information or make changes to “disclosed” information. This is a race condition that occurs while the group policy is being reapplied, so the window to exploit this would be extremely small.</p><p class="">Looking at the remaining info disclosure bugs getting patched this month, only two result in info leaks consisting of unspecified memory contents or memory addresses. Ther others provide more interesting results. There are three bugs in the Azure IoT Explorer have some wide-ranging implications. According to Microsoft, exploitation could result in, “device connection information, authentication tokens, request data, file paths, and other information transmitted between the application and the IoT Hub.” The bug in Authenticator almost reads like a security feature bypass, as exploit results in the disclosure of a one‑time sign‑in code or authentication deep link. The attacker would receive the sign‑in information and could potentially use it to authenticate as the user, allowing access to information or services available to that account. The last info disclosure bug is in the Accessibility Infrastructure and allows an attacker to gain secrets or privileged information belonging to the user of the affected application.</p><p class="">There are only four spoofing bugs in the March release. The first is in SharePoint server and manifests as an XSS. The second bug is a Server-Side Request Forgery (SSRF) in the Azure IoT Explorer. The remaining two are a bit more cryptic. The bug in Windows Shell Link Processing results from the “exposure of sensitive information to an unauthorized actor,” and could lead to spoofing. That sounds like credential exposure, but it’s not explicitly called out. The final spoofing bug results from the insufficient verification of data authenticity in Windows App Installer. Again, this sounds vaguely like credential reflection, but without further information, we can only speculate. </p><p class="">Finally, there are four denial-of-service (DoS) bugs in the release, including one that’s listed as publicly known in the .NET Framework. As usual, Microsoft provides no actionable information about these bugs.</p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">I plan on being at RSA for the first time in my career, so if you’re around, please stop by and say hello. I like it when people say hello. Otherwise, I’ll be back on April 14 with my assessment of that patch Tuesday release. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The April 2026 Security Update Review]]></title>
<description><![CDATA[It’s time once again for Patch Tuesday, and this one is huge. We’ve also got multiple exploits in the wild, which adds another layer of urgency to this month’s release. Take a break from your regularly scheduled activities, and let’s take a look at the latest security patches from Adobe and Micro...]]></description>
<link>https://tsecurity.de/de/3694470/it-security-nachrichten/the-april-2026-security-update-review/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694470/it-security-nachrichten/the-april-2026-security-update-review/</guid>
<pubDate>Sat, 25 Jul 2026 19:00:42 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="">It’s time once again for Patch Tuesday, and this one is huge. We’ve also got multiple exploits in the wild, which adds another layer of urgency to this month’s release. Take a break from your regularly scheduled activities, and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:</p>





















  
  




  
















  
    
      
    
    
      
        
      
    
    
    



  






  <p class=""><strong>Adobe Patches for April 2026</strong></p><p class="">For April, Adobe released 12 bulletins addressing 61 unique CVEs in Adobe Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, ColdFusion, Bridge, Photoshop, Illustrator, Experience Manager Screens, and the Adobe DNG SDK. Three of the Cold Fusion bugs came through the TrendAI ZDI program. For this month, I’m introducing an Adobe table as well. I’d love to get your feedback on whether this is helpful.</p>





















  
  




  


  
    


<table>
<colgroup>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
  <col>
</colgroup>
<thead>
  <tr>
    <th>Bulletin ID</th>
    <th>Product</th>
    <th>CVE Count</th>
    <th>Highest Severity</th>
    <th>Highest CVSS</th>
    <th>Exploited</th>
    <th>Deployment Priority</th>
  </tr>
</thead>
<tbody>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/acrobat/apsb26-43.html" target="_blank">APSB26-43</a></td>
    <td>Adobe Acrobat Reader</td>
    <td>1</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>Yes</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/acrobat/apsb26-44.html" target="_blank">APSB26-44</a></td>
    <td>Adobe Acrobat Reader</td>
    <td>2</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>No</td>
    <td>2</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/indesign/apsb26-32.html" target="_blank">APSB26-32</a></td>
    <td>Adobe InDesign</td>
    <td>9</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/incopy/apsb26-33.html" target="_blank">APSB26-33</a></td>
    <td>Adobe InCopy</td>
    <td>2</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/framemaker/apsb26-36.html" target="_blank">APSB26-36</a></td>
    <td>Adobe FrameMaker</td>
    <td>11</td>
    <td>Critical</td>
    <td>8.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/connect/apsb26-37.html" target="_blank">APSB26-37</a></td>
    <td>Adobe Connect</td>
    <td>9</td>
    <td>Critical</td>
    <td>9.6</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/coldfusion/apsb26-38.html" target="_blank">APSB26-38</a></td>
    <td>Adobe ColdFusion</td>
    <td>7</td>
    <td>Critical</td>
    <td>9.3</td>
    <td>No</td>
    <td>1</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/bridge/apsb26-39.html" target="_blank">APSB26-39</a></td>
    <td>Adobe Bridge</td>
    <td>6</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/photoshop/apsb26-40.html" target="_blank">APSB26-40</a></td>
    <td>Adobe Photoshop</td>
    <td>1</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/illustrator/apsb26-42.html" target="_blank">APSB26-42</a></td>
    <td>Adobe Illustrator</td>
    <td>1</td>
    <td>Critical</td>
    <td>7.8</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/aem-screens/apsb26-34.html" target="_blank">APSB26-34</a></td>
    <td>Adobe Experience Manager Screens</td>
    <td>9</td>
    <td>Important</td>
    <td>5.4</td>
    <td>No</td>
    <td>3</td>
  </tr>
  <tr>
    <td><a href="https://helpx.adobe.com/security/products/dng-sdk/apsb26-41.html" target="_blank">APSB26-41</a></td>
    <td>Adobe DNG SDK</td>
    <td>3</td>
    <td>Important</td>
    <td>5.5</td>
    <td>No</td>
    <td>3</td>
  </tr>
</tbody>
</table>



  
  









  <p class="">Obviously, the active attack in Reader is the highest priority for this month, but don’t ignore the second bunch of Reader patches. Cold Fusion also gets a deployment priority of 1, so if you’re still running that platform, make sure you get the update. Otherwise, the FrameMaker and Connect patches fix 11 and nine bugs, respectively. InDesign and Experience Manager Screens also have nine CVEs addressed. </p><p class="">Outside of the Reader bug, none of the other bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. One of the Reader bugs and Cold Fusion have a deployment priority of one, the other Reader bug has a priority of two, while all of the other updates released by Adobe this month are listed as deployment priority 3.</p><p class=""><strong>Microsoft Patches for April 2026</strong></p><p class="">This month, Microsoft released a monstrous 163 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, SQL Server, Hyper-V Server, BitLocker, and the Windows Wallet Service. Counting the third-party and a huge Chromium release, it brings the total number of CVEs to a staggering 247 updates. Six of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, two are rated as Moderate, and the rest are rated Important in severity.</p><p class="">By my count, this is the second-largest monthly release in Microsoft’s history. There are many things we could speculate on to justify the size, but if Microsoft is like the other programs out there (including ours), they are likely seeing a rise in submissions found by AI tools. For us, our incoming rate has essentially tripled, making triage a challenge, to say the least. Whatever the reason, we have a lot of bugs to deal with this month. I should also point out that the Pwn2Own Berlin occurs next month, and it’s typical for vendors to patch as much as they can before the event.</p><p class="">There is one Microsoft bug listed as under active attack at the time of release, and one other that’s publicly known. Let’s take a closer look at some of the more interesting updates for this month, starting with the vulnerability being exploited in the wild:</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201" target="_blank"><strong>CVE-2026-32201</strong></a><strong> - Microsoft SharePoint Server Spoofing Vulnerability<br></strong>Microsoft doesn’t provide a lot of information about this bug, but Spoofing bugs in SharePoint often manifest as cross-site scripting (XSS) bugs. They do note that attackers could view information or make changes to disclosed information. As always, they don’t provide any information on how widespread these attacks are, but I wouldn’t wait to test and deploy this fix – especially if you have internet-connected SharePoint servers.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825" target="_blank"><strong>CVE-2026-33825</strong></a><strong> - Microsoft Defender Elevation of Privilege Vulnerability<br></strong>This bug is listed as publicly known, and this time, we know exactly <a href="https://deadeclipse666.blogspot.com/2026/04/public-disclosure.html" target="_blank">where</a> it was disclosed. There have been some questions about how exploitable this bug may be, but it does look like it’s a real problem – just with some reliability issues in its current state. I won’t add on to the commentary from the researcher about working with Microsoft. I’m just glad they are offering a fix for the vulnerability. If you rely on Defender, test and deploy this one quickly.</p><p class="">-   <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33827" target="_blank"><strong>CVE-2026-33827</strong></a><strong> - Windows TCP/IP Remote Code Execution Vulnerability<br></strong>This vulnerability allows remote, unauthenticated attackers to exploit code on affected systems without user interaction. That adds up to a wormable bug – at least on systems with IPv6 and IPSec enabled. It is a race condition, which sets exploitability to High on the CVSS scale, but we see race conditions exploited at Pwn2Own all the time, so don’t rely on that obstacle. If you’re running IPv6, I would test and deploy this fix quickly before public exploits become available.</p><p class="">-    <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824" target="_blank"><strong>CVE-2026-33824</strong></a><strong> - Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability<br></strong>Speaking of wormable bugs, here’s our second one this month. By the title, we can tell that systems with IKE enabled are affected, but that leaves plenty of targets for attackers. Microsoft also notes a significant mitigation for this bug. Blocking UDP ports 500 and 4500 at the perimeter prevents external attackers from reaching the affected service. However, insiders could still target this for lateral movement within an enterprise. For enterprises using IKE, get this fix tested and deployed with haste.</p><p class="">Here’s the full list of CVEs released by Microsoft for April 2026:</p>





















  
  




  


  
    




<title>April 2026 Patch Tuesday</title>



<table>
<thead><tr>
  <th>CVE</th>
  <th>Title</th>
  <th>Severity</th>
  <th>CVSS</th>
  <th>Public</th>
  <th>Exploited</th>
  <th>Type</th>
</tr></thead>
<tbody>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201">CVE-2026-32201</a></td>
  <td>Microsoft SharePoint Server Spoofing Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>Yes</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5281">CVE-2026-5281 *</a></td>
  <td>Chromium: CVE-2026-5281 Use after free in Dawn</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>Yes</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825">CVE-2026-33825</a></td>
  <td>Microsoft Defender Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>Yes</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23666">CVE-2026-23666</a></td>
  <td>.NET Framework Denial of Service Vulnerability</td>
  <td>Critical</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32190">CVE-2026-32190</a></td>
  <td>Microsoft Office Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33114">CVE-2026-33114</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33115">CVE-2026-33115</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32157">CVE-2026-32157</a></td>
  <td>Remote Desktop Client Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33826">CVE-2026-33826</a></td>
  <td>Windows Active Directory Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824">CVE-2026-33824</a></td>
  <td>Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>9.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33827">CVE-2026-33827</a></td>
  <td>Windows TCP/IP Remote Code Execution Vulnerability</td>
  <td>Critical</td>
  <td>8.1</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26171">CVE-2026-26171</a></td>
  <td>.NET Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32226">CVE-2026-32226</a></td>
  <td>.NET Framework Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>5.9</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32178">CVE-2026-32178</a></td>
  <td>.NET Spoofing Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32203">CVE-2026-32203</a></td>
  <td>.NET and Visual Studio Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33116">CVE-2026-33116</a></td>
  <td>.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-20585">CVE-2023-20585 *</a></td>
  <td>AMD: CVE-2023-20585 IOMMU Write Buffer Vulnerability</td>
  <td>Important</td>
  <td>5.3</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32072">CVE-2026-32072</a></td>
  <td>Active Directory Spoofing Vulnerability</td>
  <td>Important</td>
  <td>6.2</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25184">CVE-2026-25184</a></td>
  <td>Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32171">CVE-2026-32171</a></td>
  <td>Azure Logic Apps Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32168">CVE-2026-32168</a></td>
  <td>Azure Monitor Agent Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32192">CVE-2026-32192</a></td>
  <td>Azure Monitor Agent Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32181">CVE-2026-32181</a></td>
  <td>Connected User Experiences and Telemetry Service Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27924">CVE-2026-27924</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32152">CVE-2026-32152</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32154">CVE-2026-32154</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27923">CVE-2026-27923</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32155">CVE-2026-32155</a></td>
  <td>Desktop Window Manager Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23653">CVE-2026-23653</a></td>
  <td>GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.7</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32631">CVE-2026-23653 *</a></td>
  <td> GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes </td>
  <td>Important</td>
  <td>7.4</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33096">CVE-2026-33096</a></td>
  <td>HTTP.sys Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25250">CVE-2026-25250 *</a></td>
  <td>MITRE: CVE-2026-25250 Secure Boot disable Eazy Fix</td>
  <td>Important</td>
  <td>6</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26181">CVE-2026-26181</a></td>
  <td>Microsoft Brokering File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32219">CVE-2026-32219</a></td>
  <td>Microsoft Brokering File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32091">CVE-2026-32091</a></td>
  <td>Microsoft Brokering File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26152">CVE-2026-26152</a></td>
  <td>Microsoft Cryptographic Services Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33103">CVE-2026-33103</a></td>
  <td>Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32188">CVE-2026-32188</a></td>
  <td>Microsoft Excel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>7.1</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32189">CVE-2026-32189</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32197">CVE-2026-32197</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32198">CVE-2026-32198</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32199">CVE-2026-32199</a></td>
  <td>Microsoft Excel Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32184">CVE-2026-32184</a></td>
  <td>Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26155">CVE-2026-26155</a></td>
  <td>Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27914">CVE-2026-27914</a></td>
  <td>Microsoft Management Console Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26149">CVE-2026-26149</a></td>
  <td>Microsoft Power Apps Security Feature Bypass</td>
  <td>Important</td>
  <td>9</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32200">CVE-2026-32200</a></td>
  <td>Microsoft PowerPoint Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26143">CVE-2026-26143</a></td>
  <td>Microsoft PowerShell Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33120">CVE-2026-33120 †</a></td>
  <td>Microsoft SQL Server Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20945">CVE-2026-20945</a></td>
  <td>Microsoft SharePoint Server Spoofing Vulnerability</td>
  <td>Important</td>
  <td>4.6</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33822">CVE-2026-33822</a></td>
  <td>Microsoft Word Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33095">CVE-2026-33095</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23657">CVE-2026-23657</a></td>
  <td>Microsoft Word Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32081">CVE-2026-32081</a></td>
  <td>Package Catalog Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26170">CVE-2026-26170</a></td>
  <td>PowerShell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26183">CVE-2026-26183</a></td>
  <td>Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26160">CVE-2026-26160</a></td>
  <td>Remote Desktop Licensing Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26159">CVE-2026-26159</a></td>
  <td>Remote Desktop Licensing Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26151">CVE-2026-26151</a></td>
  <td>Remote Desktop Spoofing Vulnerability</td>
  <td>Important</td>
  <td>7.1</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32085">CVE-2026-32085</a></td>
  <td>Remote Procedure Call Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32167">CVE-2026-32167</a></td>
  <td>SQL Server Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>6.7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32176">CVE-2026-32176</a></td>
  <td>SQL Server Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>6.7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0390">CVE-2026-0390</a></td>
  <td>UEFI Secure Boot Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>6.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32220">CVE-2026-32220</a></td>
  <td>UEFI Secure Boot Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.4</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32212">CVE-2026-32212</a></td>
  <td>Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32214">CVE-2026-32214</a></td>
  <td>Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32079">CVE-2026-32079</a></td>
  <td>Web Account Manager Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33104">CVE-2026-33104</a></td>
  <td>Win32k Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32196">CVE-2026-32196</a></td>
  <td>Windows Admin Center Spoofing Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26178">CVE-2026-26178</a></td>
  <td>Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32073">CVE-2026-32073</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26168">CVE-2026-26168</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26173">CVE-2026-26173</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26177">CVE-2026-26177</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26182">CVE-2026-26182</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27922">CVE-2026-27922</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33099">CVE-2026-33099</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33100">CVE-2026-33100</a></td>
  <td>Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32088">CVE-2026-32088</a></td>
  <td>Windows Biometric Service Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27913">CVE-2026-27913</a></td>
  <td>Windows BitLocker Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>7.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26175">CVE-2026-26175</a></td>
  <td>Windows Boot Manager Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.6</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32162">CVE-2026-32162</a></td>
  <td>Windows COM Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20806">CVE-2026-20806</a></td>
  <td>Windows COM Server Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26176">CVE-2026-26176</a></td>
  <td>Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27926">CVE-2026-27926</a></td>
  <td>Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32070">CVE-2026-32070</a></td>
  <td>Windows Common Log File System Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33098">CVE-2026-33098</a></td>
  <td>Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26153">CVE-2026-26153</a></td>
  <td>Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32087">CVE-2026-32087</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32093">CVE-2026-32093</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32086">CVE-2026-32086</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32150">CVE-2026-32150</a></td>
  <td>Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27931">CVE-2026-27931</a></td>
  <td>Windows GDI Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27930">CVE-2026-27930</a></td>
  <td>Windows GDI Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32221">CVE-2026-32221</a></td>
  <td>Windows Graphics Component Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>8.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27906">CVE-2026-27906</a></td>
  <td>Windows Hello Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.4</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27928">CVE-2026-27928</a></td>
  <td>Windows Hello Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>8.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26156">CVE-2026-26156</a></td>
  <td>Windows Hyper-V Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32149">CVE-2026-32149</a></td>
  <td>Windows Hyper-V Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.3</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27910">CVE-2026-27910</a></td>
  <td>Windows Installer Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27912">CVE-2026-27912</a></td>
  <td>Windows Kerberos Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26179">CVE-2026-26179</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26180">CVE-2026-26180</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32195">CVE-2026-32195</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26163">CVE-2026-26163</a></td>
  <td>Windows Kernel Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32215">CVE-2026-32215</a></td>
  <td>Windows Kernel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32217">CVE-2026-32217</a></td>
  <td>Windows Kernel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32218">CVE-2026-32218</a></td>
  <td>Windows Kernel Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26169">CVE-2026-26169</a></td>
  <td>Windows Kernel Memory Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.1</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27929">CVE-2026-27929</a></td>
  <td>Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32071">CVE-2026-32071</a></td>
  <td>Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20930">CVE-2026-20930</a></td>
  <td>Windows Management Services Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26162">CVE-2026-26162</a></td>
  <td>Windows OLE Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33101">CVE-2026-33101</a></td>
  <td>Windows Print Spooler Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32084">CVE-2026-32084</a></td>
  <td>Windows Print Spooler Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27927">CVE-2026-27927</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26184">CVE-2026-26184</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32069">CVE-2026-32069</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32074">CVE-2026-32074</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32078">CVE-2026-32078</a></td>
  <td>Windows Projected File System Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26167">CVE-2026-26167</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32158">CVE-2026-32158</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32159">CVE-2026-32159</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32160">CVE-2026-32160</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26172">CVE-2026-26172</a></td>
  <td>Windows Push Notifications Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20928">CVE-2026-20928</a></td>
  <td>Windows Recovery Environment Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>4.6</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32216">CVE-2026-32216</a></td>
  <td>Windows Redirected Drive Buffering System Denial of Service Vulnerability</td>
  <td>Important</td>
  <td>5.5</td>
  <td>No</td>
  <td>No</td>
  <td>DoS</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27909">CVE-2026-27909</a></td>
  <td>Windows Search Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26161">CVE-2026-26161</a></td>
  <td>Windows Sensor Data Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26174">CVE-2026-26174</a></td>
  <td>Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32224">CVE-2026-32224</a></td>
  <td>Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26154">CVE-2026-26154</a></td>
  <td>Windows Server Update Service (WSUS) Tampering Vulnerability</td>
  <td>Important</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>Tampering</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26165">CVE-2026-26165</a></td>
  <td>Windows Shell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26166">CVE-2026-26166</a></td>
  <td>Windows Shell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27918">CVE-2026-27918</a></td>
  <td>Windows Shell Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32151">CVE-2026-32151</a></td>
  <td>Windows Shell Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32225">CVE-2026-32225</a></td>
  <td>Windows Shell Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>8.8</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202">CVE-2026-32202</a></td>
  <td>Windows Shell Spoofing Vulnerability</td>
  <td>Important</td>
  <td>4.3</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32082">CVE-2026-32082</a></td>
  <td>Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32083">CVE-2026-32083</a></td>
  <td>Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32068">CVE-2026-32068</a></td>
  <td>Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32183">CVE-2026-32183</a></td>
  <td>Windows Snipping Tool Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32089">CVE-2026-32089</a></td>
  <td>Windows Speech Brokered Api Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32090">CVE-2026-32090</a></td>
  <td>Windows Speech Brokered Api Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32153">CVE-2026-32153</a></td>
  <td>Windows Speech Runtime Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27907">CVE-2026-27907</a></td>
  <td>Windows Storage Spaces Controller Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32076">CVE-2026-32076</a></td>
  <td>Windows Storage Spaces Controller Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27908">CVE-2026-27908</a></td>
  <td>Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27921">CVE-2026-27921</a></td>
  <td>Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27915">CVE-2026-27915</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27919">CVE-2026-27919</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32075">CVE-2026-32075</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27916">CVE-2026-27916</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27920">CVE-2026-27920</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32077">CVE-2026-32077</a></td>
  <td>Windows UPnP Device Host Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27925">CVE-2026-27925</a></td>
  <td>Windows UPnP Device Host Information Disclosure Vulnerability</td>
  <td>Important</td>
  <td>6.5</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32156">CVE-2026-32156</a></td>
  <td>Windows UPnP Device Host Remote Code Execution Vulnerability</td>
  <td>Important</td>
  <td>7.4</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32223">CVE-2026-32223</a></td>
  <td>Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>6.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32165">CVE-2026-32165</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27911">CVE-2026-27911</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32163">CVE-2026-32163</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32164">CVE-2026-32164</a></td>
  <td>Windows User Interface Core Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23670">CVE-2026-23670</a></td>
  <td>Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability</td>
  <td>Important</td>
  <td>5.7</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27917">CVE-2026-27917</a></td>
  <td>Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32080">CVE-2026-32080</a></td>
  <td>Windows WalletService Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32222">CVE-2026-32222</a></td>
  <td>Windows Win32k Elevation of Privilege Vulnerability</td>
  <td>Important</td>
  <td>7.8</td>
  <td>No</td>
  <td>No</td>
  <td>EoP</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21637">CVE-2026-21637 *</a></td>
  <td> HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers</td>
  <td> Moderate</td>
  <td>7.5</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33119">CVE-2026-33119</a></td>
  <td>Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability</td>
  <td>Moderate</td>
  <td>5.4</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33829">CVE-2026-33829</a></td>
  <td>Windows Snipping Tool Spoofing Vulnerability</td>
  <td>Moderate</td>
  <td>4.3</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5858">CVE-2026-5858 *</a></td>
  <td>Chromium: CVE-2026-5858 Heap buffer overflow in WebML</td>
  <td>Critical</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5859">CVE-2026-5859 *</a></td>
  <td>Chromium: CVE-2026-5859 Integer overflow in WebML</td>
  <td>Critical</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5272">CVE-2026-5272 *</a></td>
  <td>Chromium: CVE-2026-5272 Heap buffer overflow in GPU</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5273">CVE-2026-5273 *</a></td>
  <td>Chromium: CVE-2026-5273 Use after free in CSS</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5274">CVE-2026-5274 *</a></td>
  <td>Chromium: CVE-2026-5274 Integer overflow in Codecs</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5275">CVE-2026-5275 *</a></td>
  <td>Chromium: CVE-2026-5275 Heap buffer overflow in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5276">CVE-2026-5276 *</a></td>
  <td>Chromium: CVE-2026-5276 Insufficient policy enforcement in WebUSB</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5277">CVE-2026-5277 *</a></td>
  <td>Chromium: CVE-2026-5277 Integer overflow in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5279">CVE-2026-5279 *</a></td>
  <td>Chromium: CVE-2026-5279 Object corruption in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5280">CVE-2026-5280 *</a></td>
  <td>Chromium: CVE-2026-5280 Use after free in WebCodecs</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5283">CVE-2026-5283 *</a></td>
  <td>Chromium: CVE-2026-5283 Inappropriate implementation in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5284">CVE-2026-5284 *</a></td>
  <td>Chromium: CVE-2026-5284 Use after free in Dawn</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5285">CVE-2026-5285 *</a></td>
  <td>Chromium: CVE-2026-5285 Use after free in WebGL</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5286">CVE-2026-5286 *</a></td>
  <td>Chromium: CVE-2026-5286 Use after free in Dawn</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5287">CVE-2026-5287 *</a></td>
  <td>Chromium: CVE-2026-5287 Use after free in PDF</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5289">CVE-2026-5289 *</a></td>
  <td>Chromium: CVE-2026-5289 Use after free in Navigation</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5290">CVE-2026-5290 *</a></td>
  <td>Chromium: CVE-2026-5290 Use after free in Compositing</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5860">CVE-2026-5860 *</a></td>
  <td>Chromium: CVE-2026-5860 Use after free in WebRTC</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5861">CVE-2026-5861 *</a></td>
  <td>Chromium: CVE-2026-5861 Use after free in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5862">CVE-2026-5862 *</a></td>
  <td>Chromium: CVE-2026-5862 Inappropriate implementation in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5863">CVE-2026-5863 *</a></td>
  <td>Chromium: CVE-2026-5863 Inappropriate implementation in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5864">CVE-2026-5864 *</a></td>
  <td>Chromium: CVE-2026-5864 Heap buffer overflow in WebAudio</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5865">CVE-2026-5865 *</a></td>
  <td>Chromium: CVE-2026-5865 Type Confusion in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5866">CVE-2026-5866 *</a></td>
  <td>Chromium: CVE-2026-5866 Use after free in Media</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5867">CVE-2026-5867 *</a></td>
  <td>Chromium: CVE-2026-5867 Heap buffer overflow in WebML</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5868">CVE-2026-5868 *</a></td>
  <td>Chromium: CVE-2026-5868 Heap buffer overflow in ANGLE</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5869">CVE-2026-5869 *</a></td>
  <td>Chromium: CVE-2026-5869 Heap buffer overflow in WebML</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5870">CVE-2026-5870 *</a></td>
  <td>Chromium: CVE-2026-5870 Integer overflow in Skia</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5871">CVE-2026-5871 *</a></td>
  <td>Chromium: CVE-2026-5871 Type Confusion in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5872">CVE-2026-5872 *</a></td>
  <td>Chromium: CVE-2026-5872 Use after free in Blink</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5873">CVE-2026-5873 *</a></td>
  <td>Chromium: CVE-2026-5873 Out of bounds read and write in V8</td>
  <td>High</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5291">CVE-2026-5291 *</a></td>
  <td>Chromium: CVE-2026-5291 Inappropriate implementation in WebGL</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5292">CVE-2026-5292 *</a></td>
  <td>Chromium: CVE-2026-5292 Out of bounds read in WebCodecs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5874">CVE-2026-5874 *</a></td>
  <td>Chromium: CVE-2026-5874 Use after free in PrivateAI</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5875">CVE-2026-5875 *</a></td>
  <td>Chromium: CVE-2026-5875 Policy bypass in Blink</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5876">CVE-2026-5876 *</a></td>
  <td>Chromium: CVE-2026-5876 Side-channel information leakage in Navigation</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5877">CVE-2026-5877 *</a></td>
  <td>Chromium: CVE-2026-5877 Use after free in Navigation</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5878">CVE-2026-5878 *</a></td>
  <td>Chromium: CVE-2026-5878 Incorrect security UI in Blink</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5879">CVE-2026-5879 *</a></td>
  <td>Chromium: CVE-2026-5879 Insufficient validation of untrusted input in ANGLE</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5880">CVE-2026-5880 *</a></td>
  <td>Chromium: CVE-2026-5880 Incorrect security UI in browser UI</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5881">CVE-2026-5881 *</a></td>
  <td>Chromium: CVE-2026-5881 Policy bypass in LocalNetworkAccess</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5882">CVE-2026-5882 *</a></td>
  <td>Chromium: CVE-2026-5882 Incorrect security UI in Fullscreen</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5883">CVE-2026-5883 *</a></td>
  <td>Chromium: CVE-2026-5883 Use after free in Media</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5884">CVE-2026-5884 *</a></td>
  <td>Chromium: CVE-2026-5884 Insufficient validation of untrusted input in Media</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5885">CVE-2026-5885 *</a></td>
  <td>Chromium: CVE-2026-5885 Insufficient validation of untrusted input in WebML</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5886">CVE-2026-5886 *</a></td>
  <td>Chromium: CVE-2026-5886 Out of bounds read in WebAudio</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5887">CVE-2026-5887 *</a></td>
  <td>Chromium: CVE-2026-5887 Insufficient validation of untrusted input in Downloads</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5888">CVE-2026-5888 *</a></td>
  <td>Chromium: CVE-2026-5888 Uninitialized Use in WebCodecs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5889">CVE-2026-5889 *</a></td>
  <td>Chromium: CVE-2026-5889 Cryptographic Flaw in PDFium</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5890">CVE-2026-5890 *</a></td>
  <td>Chromium: CVE-2026-5890 Race in WebCodecs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5891">CVE-2026-5891 *</a></td>
  <td>Chromium: CVE-2026-5891 Insufficient policy enforcement in browser UI</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5892">CVE-2026-5892 *</a></td>
  <td>Chromium: CVE-2026-5892 Insufficient policy enforcement in PWAs</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5893">CVE-2026-5893 *</a></td>
  <td>Chromium: CVE-2026-5893 Race in V8</td>
  <td>Medium</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5894">CVE-2026-5894 *</a></td>
  <td>Chromium: CVE-2026-5894 Inappropriate implementation in PDF</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5895">CVE-2026-5895 *</a></td>
  <td>Chromium: CVE-2026-5895 Incorrect security UI in Omnibox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5896">CVE-2026-5896 *</a></td>
  <td>Chromium: CVE-2026-5896 Policy bypass in Audio</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5897">CVE-2026-5897 *</a></td>
  <td>Chromium: CVE-2026-5897 Incorrect security UI in Downloads</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5898">CVE-2026-5898 *</a></td>
  <td>Chromium: CVE-2026-5898 Incorrect security UI in Omnibox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5899">CVE-2026-5899 *</a></td>
  <td>Chromium: CVE-2026-5899 Incorrect security UI in History Navigation</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5900">CVE-2026-5900 *</a></td>
  <td>Chromium: CVE-2026-5900 Policy bypass in Downloads</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5901">CVE-2026-5901 *</a></td>
  <td>Chromium: CVE-2026-5901 Policy bypass in DevTools</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5902">CVE-2026-5902 *</a></td>
  <td>Chromium: CVE-2026-5902 Race in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5903">CVE-2026-5903 *</a></td>
  <td>Chromium: CVE-2026-5903 Policy bypass in IFrameSandbox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5904">CVE-2026-5904 *</a></td>
  <td>Chromium: CVE-2026-5904 Use after free in V8</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5905">CVE-2026-5905 *</a></td>
  <td>Chromium: CVE-2026-5905 Incorrect security UI in Permissions</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5906">CVE-2026-5906 *</a></td>
  <td>Chromium: CVE-2026-5906 Incorrect security UI in Omnibox</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5907">CVE-2026-5907 *</a></td>
  <td>Chromium: CVE-2026-5907 Insufficient data validation in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5908">CVE-2026-5908 *</a></td>
  <td>Chromium: CVE-2026-5908 Integer overflow in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5909">CVE-2026-5909 *</a></td>
  <td>Chromium: CVE-2026-5909 Integer overflow in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5910">CVE-2026-5910 *</a></td>
  <td>Chromium: CVE-2026-5910 Integer overflow in Media</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5911">CVE-2026-5911 *</a></td>
  <td>Chromium: CVE-2026-5911 Policy bypass in ServiceWorkers</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5912">CVE-2026-5912 *</a></td>
  <td>Chromium: CVE-2026-5912 Integer overflow in WebRTC</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5913">CVE-2026-5913 *</a></td>
  <td>Chromium: CVE-2026-5913 Out of bounds read in Blink</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>Info</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5914">CVE-2026-5914 *</a></td>
  <td>Chromium: CVE-2026-5914 Type Confusion in CSS</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>RCE</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5915">CVE-2026-5915 *</a></td>
  <td>Chromium: CVE-2026-5915 Insufficient validation of untrusted input in WebML</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5918">CVE-2026-5918 *</a></td>
  <td>Chromium: CVE-2026-5918 Inappropriate implementation in Navigation</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5919">CVE-2026-5919 *</a></td>
  <td>Chromium: CVE-2026-5919 Insufficient validation of untrusted input in WebSockets</td>
  <td>Low</td>
  <td>N/A</td>
  <td>No</td>
  <td>No</td>
  <td>SFB</td>
</tr>
<tr>
  <td><a target="_blank" href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33118">CVE-2026-33118</a></td>
  <td>Microsoft Edge (Chromium-based) Spoofing Vulnerability</td>
  <td>Low</td>
  <td>4.3</td>
  <td>No</td>
  <td>No</td>
  <td>Spoofing</td>
</tr>
</tbody></table>
  
  









  <p class=""><em>* Indicates this CVE had been released by a third party and is now being included in Microsoft releases</em>.</p><p class=""><em>† Indicates further administrative actions are required to fully address the vulnerability.</em></p><p class=""><em> </em></p><p class="">Looking at the other Critical-rated bugs in this month’s release, there are three Office-related bugs where the Preview Pane is once again listed as an exploit vector. I would still like to have a full-proof way of disabling the Preview Pane, but I don’t see that as an option. There’s a bug in the RDP client, but that involves connecting to a malicious RDP server. The bug in Active Directory requires authentication and a network adjacent attacker. The final Critical-rated bug is an interesting DoS in .NET Framework. An unauthenticated attacker could deny service over a network – presumably crippling any affected app made in .NET. You rarely see Critical-rated DoS bugs, but this one deserves the moniker.</p><p class="">Moving on to the other code execution bugs, you have quite a few open-and-own bugs in Office components, most notably Excel, where the Preview Pane is not an attack vector. The bug in SQL Server requires authentication, and as usual, additional steps are needed to ensure you have the correct update to remediate this vulnerability. The two bugs in Hyper-V almost reads like a privilege escalation since it allows unauthorized attackers to execute code locally. That’s the same for the bugs in the Windows Snipping Tool and the UPnP Device host. </p><p class="">More than half of this release addresses Elevation of Privilege (EoP) bugs. However, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. The bugs in SQL Server could allow an attacker to gain SQL sysadmin privileges. One of the kernel bugs simply states an attacker could “elevate privileges locally”. How obtuse. That’s similar for the bug in afd.sys and Desktop Windows Manager, but Microsoft also states that these bugs could crash an affected system. There are several bugs that result in a sandbox escape, including Windows Push Notifications, AFD for Winsock, Management Services, and User Interface Core. Of these, CVE-2026-26167 (Push Notifications) is the most notable — it's the only one with low attack complexity, meaning no race condition needed. The rest all require winning a race condition (AC:H). The bugs in UPnP are interesting as they allow attackers to gain access to a limited set of administrator-protected objects. Not a full escalation but definitely getting access to resources they shouldn’t. The vulnerability in the Brokering File System allows attackers to gain the level of the logged on user, so don’t do your normal activities as a user with admin privileges. The bug in Azure Monitor Agent leads to root-level access. </p><p class="">There are a dozen different security features bypass bugs in the April release. Some of these are obvious by the title alone. For example, the bugs in Windows Hello bypass safety features within the Hello app itself. The bug in the Biometric Service allows attackers to bypass biometric protections. The vulns in BitLocker and Secure Boot bypass protections in those components. The bug in Power Apps allows attackers to bypass a security warning dialog and trick targets into triggering an external protocol call that performs unintended actions on the user’s device. The bug in Windows Shell allows attackers to bypass Mark of the Web (MotW) protections. The bug in PowerShell could almost be described as a code execution bug as exploiting it bypasses dynamic-expression security checks, which could result in code execution. The vulnerability in the Windows Recovery Environment allows local attackers to bypass BitLocker device encryption. Finally, the bug in Virtualization‑Based Security (VBS) is the most interesting of the bunch – and not just because VBS is a (relatively) new feature. The problem allows attackers to manipulate allow a compromised Windows kernel to modify memory belonging to the secure kernel, breaking the intended isolation guarantees provided by VBS. Somewhat of a sandbox escape, but this time, you’re escaping from Virtual Trust Level 0 (VTL0) to Virtual Trust Level 1 (VTL1). Neat.</p><p class="">Moving on to the Information Disclosure bugs fixed this month, we have 20 different CVEs. Fortunately, most of these simply result in info leaks consisting of unspecified memory contents or memory addresses. While useful in crafting exploits, they aren’t exactly exciting on their own. There are also several bugs that disclose addresses from an object a contained in a sandboxed execution environment. This includes bugs in the Print Spooler, Package Catalog, and Web Account Manager. The bug in Dynamics 365 discloses the ever ineffable “sensitive information”. There are three different info disclosure bugs in UPnP. Two allow an attacker to read from the file system, while the third discloses anything available to the LOCAL SERVICE account. The final info disclosure bug resides in Copilot and Visual Studio and allows attackers to disclose the contents of the Model Context Protocol (MCP) when using Copilot. There are those who think MCP is dead (thanks to agentic AI agents), but if you’re using a custom MCP, I doubt you would want it leaked.</p><p class="">The April release contains just a handful of Spoofing bugs. Some, like the bugs in .NET, Active Directory, and Windows Shell, just say that they allow spoofing over a network. Others, like the bug in Windows Snipping Tool, say similar but also note that it could be used to relay NTLMv2 hashes. The patch for RDP <a href="https://go.microsoft.com/fwlink/?linkid=2347342">notes</a> that there are new warning dialogs coming this month. The bug in the Windows Admin Center would allow an attacker to interact with other tenant’s applications and content. Finally, the spoofing bug in SharePoint is another XSS issue.</p><p class="">There are eight DoS bugs in the April release, but as always, Microsoft provides no actionable information about the vulnerabilities. Microsoft does offer a mitigation for the http.sys bug that can be applied while you test and deploy the patch, but I would rely on the patch rather than the mitigation. Another exception is the bug for Connected User Experiences and Telemetry Service, which allows attackers to deny service locally rather than over the network.</p><p class="">The final(!) bug in the April release is a Tampering bug in WSUS that reads like a DoS. According to Microsoft, “An attacker can send specially crafted packets which could affect availability of the service and result in Denial of Service (DoS).” But sure – let’s call it Tampering. </p><p class="">No new advisories are being released this month.</p><p class=""><strong>Looking Ahead</strong></p><p class="">I will be in Berlin for the next Patch Tuesday, which will be May 12, and I’ll provide my full thoughts then on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite]]></title>
<description><![CDATA[Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite
Executive summary 
A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboratio...]]></description>
<link>https://tsecurity.de/de/3694430/it-security-nachrichten/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694430/it-security-nachrichten/russian-state-supported-cyber-actors-conduct-phishing-campaign-targeting-users-of-zimbra-collaboration-suite/</guid>
<pubDate>Sat, 25 Jul 2026 18:59:26 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div class="c-page-title__buttons"><a class="c-button" href="https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF">Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite</a></div>
<h2><strong>Executive summary</strong> </h2>
<p>A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threat (APT) group’s activity is tracked in the cybersecurity community under several names (see <a href="https://www.cisa.gov/#cyber1">Cybersecurity industry tracking</a>), primarily as “LAUNDRY BEAR,” a name initially coined by the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD) [<a href="https://www.cisa.gov/#wc1">1</a>].</p>
<p>LAUNDRY BEAR’s targeting is almost certainly to gather sensitive information for the Russian Federation, with these actors primarily focusing on the covert acquisition of email data. Previous campaigns indicated LAUNDRY BEAR relied on unsophisticated initial access techniques—including password spraying, phishing, and pass-the-cookie—allowing the group to successfully run high-volume operations. The latest campaign targeting ZCS uses a novel exploit that was a zero-day vulnerability when first exploited and continues to be successfully exploited. The vulnerability, Common Vulnerabilities and Exposures (CVE) <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>, was patched in November 2025. This demonstrates LAUNDRY BEAR’s intent and ability to deploy increasingly sophisticated technical capabilities.</p>
<p>Unlike traditional phishing campaigns that persuade a user into taking an action, such as clicking a link or opening a file, LAUNDRY BEAR’s latest campaign leverages a view-based exploit that only requires a user to view a malicious email within a vulnerable version of the webmail service. Once viewed, the exploit attempts to exfiltrate the victim’s last 90 days of email communications, the organization email directory (i.e., Global Address List [GAL]), and other sensitive information to servers controlled by LAUNDRY BEAR. The exploit also attempts to establish persistent access to victim accounts through a variety of means as detailed in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section.</p>
<p>This Cybersecurity Advisory (CSA) warns of this ongoing malicious threat activity and urges organizations to update their vulnerable software and implement additional mitigations to thwart these Russian state-supported actors’ continued success. The CSA is being released by the following authoring and co-sealing agencies:</p>
<ul>
<li>United States National Security Agency (NSA)</li>
<li>United States Federal Bureau of Investigation (FBI)</li>
<li>Netherlands Defence Intelligence and Security Service (MIVD)</li>
<li>Netherlands General Intelligence and Security Service (AIVD)</li>
<li>United States Cybersecurity and Infrastructure Security Agency (CISA)</li>
<li>United States Defense Counterintelligence and Security Agency (DCSA)</li>
<li>United States Department of Defense Cyber Crime Center (DC3)</li>
<li>United States Department of the Treasury</li>
<li>United States Naval Criminal Investigative Service (NCIS)</li>
<li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li>
<li>Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>United Kingdom National Cyber Security Centre (NCSC-UK)</li>
<li>Czech Republic National Cyber and Information Security Agency (NÚKIB)<a href="https://www.cisa.gov/#f1"><sup>1</sup></a></li>
<li>Danish Defence Intelligence Service (DDIS)<a href="https://www.cisa.gov/#f2"><sup>2</sup></a></li>
<li>Estonian Foreign Intelligence Service (EFIS)<a href="https://www.cisa.gov/#f3"><sup>3</sup></a></li>
<li>Finnish Defence Intelligence (FDI)<a href="https://www.cisa.gov/#f4"><sup>4</sup></a></li>
<li>Finnish Security and Intelligence Service (SUPO)<a href="https://www.cisa.gov/#f5"><sup>5</sup></a></li>
<li>French General Directorate for Internal Security (DGSI)<a href="https://www.cisa.gov/#f6"><sup>6</sup></a></li>
<li>French National Cybersecurity Agency (ANSSI)<a href="https://www.cisa.gov/#f7"><sup>7</sup></a></li>
<li>Italian External Intelligence and Security Agency (AISE)<a href="https://www.cisa.gov/#f8"><sup>8</sup></a></li>
<li>Italian Internal Intelligence and Security Agency (AISI)<a href="https://www.cisa.gov/#f9"><sup>9</sup></a></li>
<li>Security and Intelligence Service of the Republic of Moldova (SIS RM)<a href="https://www.cisa.gov/#f10"><sup>10</sup></a></li>
<li>Polish Foreign Intelligence Agency (AW)<a href="https://www.cisa.gov/#f11"><sup>11</sup></a></li>
<li>The Military Counterintelligence Service of Poland (SKW)<a href="https://www.cisa.gov/#f12"><sup>12</sup></a></li>
<li>Spain National Intelligence Centre (CNI)<a href="https://www.cisa.gov/#f13"><sup>13</sup></a></li>
<li>Sweden National Cyber Security Centre (NCSC-SE)<a href="https://www.cisa.gov/#f14"><sup>14</sup></a></li>
</ul>
<p>The authoring agencies urge any organizations using ZCS to implement the recommendations listed within the <a href="https://www.cisa.gov/#mitigations1">Mitigations</a> section of this advisory to reduce the risk associated with this activity. This CSA also includes specific remediations for organizations to implement if they discover the presence of the listed <a href="https://www.cisa.gov/#ioc1">Indicators of compromise</a> (IOCs).  </p>
<p>As more organizations update their ZCS software based on this CSA, LAUNDRY BEAR may discontinue the current campaign exploiting this vulnerability; however, based on the success of this and previous campaigns, it is very likely that the group will continue to target ZCS and other email systems used by organizations in Western countries. The actors will almost certainly continue to rely on email to engage potential victims by exploiting novel vulnerabilities and, when necessary, use social engineering techniques to assist with their efforts. The authoring agencies recommend organizations regularly update their mail service software and continuously monitor their email systems and emails for malicious activity.</p>
<p>For a downloadable list of IOCs, see:</p>
<ul>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-204A.stix_.xml">AA26-204A.stix.xml</a> (STIX XML)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-204A.stix_.json">AA26-204A.stix.json</a> (STIX JSON)</li>
</ul>
<h2><strong>Cybersecurity industry tracking</strong><a class="ck-anchor"></a></h2>
<p>The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to these Russian state-supported cyber actors. While not exhaustive, the following are threat group names commonly used for these actors within the cybersecurity community:</p>
<ul>
<li>LAUNDRY BEAR</li>
<li>Void Blizzard [<a href="https://www.cisa.gov/#wc2">2</a>]</li>
<li>CL-STA-1114 [<a href="https://www.cisa.gov/#wc3">3</a>]</li>
<li>TA488 (formerly UNK_PitStop) [<a href="https://www.cisa.gov/#wc4">4</a>]</li>
</ul>
<p><strong>Note:</strong> Cybersecurity companies have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the U.S. government’s understanding for all activity related to these groupings.</p>
<h2><strong>Background</strong></h2>
<p>Public advisories from Netherlands General Intelligence and Security Service (AIVD), Netherlands Defence Intelligence and Security Service (MIVD), and Microsoft highlighted these Russian state-supported advanced persistent threat (APT) actors in May 2025, calling them LAUNDRY BEAR and Void Blizzard respectively [<a href="https://www.cisa.gov/#wc1">1</a>] [<a href="https://www.cisa.gov/#wc2">2</a>]. Both advisories assessed that the group was engaged in malicious cyber activity as early as April 2024.  </p>
<p>The May 2025 advisories highlighted a cluster of activity targeting cloud-based email environments, including Microsoft Exchange in particular, and abusing legitimate APIs to perform data exfiltration in bulk [<a href="https://attack.mitre.org/versions/v19/techniques/T1114/002/" target="_blank">T1114.002</a>]. The group relied on unsophisticated means of initial access, including procuring stolen credentials on criminal marketplaces [<a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank">T1078</a>], and using social engineering techniques to lure targets into interacting with a malicious site masquerading as a legitimate one. As of April 2025, one of these sites resembled a European Defence &amp; Security Summit registration portal that required registrants to sign in to their Microsoft account to view. Once a user entered their Microsoft credentials into this malicious site, LAUNDRY BEAR’s modified version of the open source adversary emulation toolkit, Evilginx, intercepted the user’s credentials. LAUNDRY BEAR then used this authentication data, including passwords and session tokens, to access the compromised account and conduct mass email exfiltration, as well as harvest other information. This method of compromise is commonly known as an adversary-in-the-middle (AiTM) technique [<a href="https://attack.mitre.org/versions/v19/techniques/T1557/" target="_blank">T1557</a>].  </p>
<p>Beginning around July 2025, LAUNDRY BEAR shifted toward a more technical method of email compromise, highlighting their continued efforts to covertly acquire email communications from a variety of Western organizations of interest and deliver them to the Russian Federation. Using a custom-developed capability [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/001/" target="_blank">T1587.001</a>] named “<em>Улей</em>” or “<em>Ulej</em>” (Russian for beehive), LAUNDRY BEAR successfully targeted and exfiltrated sensitive user information from organizations who use the Zimbra Collaboration Suite (ZCS) product [<a href="https://attack.mitre.org/versions/v19/techniques/T1114/" target="_blank">T1114</a>]. Data LAUNDRY BEAR attempted to exfiltrate from compromised accounts included:</p>
<ul>
<li>Last 90 days of emails,</li>
<li>Email address,</li>
<li>Password [<a href="https://attack.mitre.org/versions/v19/techniques/T1589/001/" target="_blank">T1589.001</a>],</li>
<li>Global Address List (GAL) [<a href="https://attack.mitre.org/versions/v19/techniques/T1087/" target="_blank">T1087</a>],</li>
<li>Two-factor authentication (2FA) tokens, and</li>
<li>Newly-created Application Passcode [<a href="https://attack.mitre.org/versions/v19/techniques/T1098/" target="_blank">T1098</a>].</li>
</ul>
<p>The covert and persistent nature of this activity, along with the absence of any known financial extortion, almost certainly indicates this group’s involvement in espionage activities with Russian government backing. Additionally, extensive Ukrainian targeting, prior to use against U.S. and other NATO allies, outlines an increasing trend within Russian cyber threat groups to target Ukrainian users first—both as a priority target and as a testbench for malicious cyber techniques before broader global deployment.</p>
<h2><strong>Targeting details</strong></h2>
<p>LAUNDRY BEAR has targeted and compromised users in various organizations, including those associated with:</p>
<ul>
<li>the Defense Industrial Base (DIB),  </li>
<li>the federal and local government,</li>
<li>education,</li>
<li>energy,</li>
<li>law enforcement,  </li>
<li>media,  </li>
<li>non-governmental organizations, and</li>
<li>technology.</li>
</ul>
<h2><strong>Technical details</strong></h2>
<p><strong>Note:</strong> This advisory uses the <a href="https://attack.mitre.org/versions/v19/matrices/enterprise/" target="_blank">MITRE ATT&amp;CK® Matrix for Enterprise</a> framework, version 19. This advisory also uses <a href="https://d3fend.mitre.org/" target="_blank">MITRE D3FEND<sup>TM</sup></a> version 1.4.0<a href="https://www.cisa.gov/#f15"><sup>15</sup></a>. See <a href="https://www.cisa.gov/#appendixa">Appendix A</a> and <a href="https://www.cisa.gov/#appendixb">Appendix B</a> for tables of the activity mapped to MITRE ATT&amp;CK and D3FEND tactics, techniques, and countermeasures.</p>
<p><em>Ulej </em>is a novel data exfiltration and aggregation capability, that currently (as of the publication of this report) supports a campaign specifically targeting users of ZCS webmail servers. This capability is used to exploit <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> [Common Weakness Enumeration (CWE) <a href="https://cwe.mitre.org/data/definitions/79.html" target="_blank">CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'</a>)], but likely could be adapted to exploit other vulnerabilities. It exfiltrates emails and other sensitive user data from a victim’s system immediately after exploitation and stores the data in an actor-controlled unattributable virtual private server (VPS) [<a href="https://attack.mitre.org/versions/v19/techniques/T1074/002/" target="_blank">T1074.002</a>] running LAUNDRY BEAR’s “Flowerbed” collection framework. The collected data is almost certainly further exfiltrated to internal network resources for review and long-term retention.</p>
<h3><em><strong>Reconnaissance</strong></em></h3>
<p>LAUNDRY BEAR uses the <em>Ulej </em>capability to exploit the <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> vulnerability in organizations using ZCS. This campaign’s targeted victimology and limited exploitation capabilities likely indicate this group manually identifies and targets the victim organizations. LAUNDRY BEAR likely identifies organizations with public-facing Zimbra infrastructure by port scanning [<a href="https://attack.mitre.org/versions/v19/techniques/T1595/" target="_blank">T1595</a>] and fingerprinting datasets easily procured through various commercial vendors [<a href="https://attack.mitre.org/versions/v19/techniques/T1596/005/" target="_blank">T1596.005</a>].  </p>
<p>After identifying a target organization, the group likely compiles email addresses for individual users to target with the exploit [<a href="https://attack.mitre.org/versions/v19/techniques/T1589/002/" target="_blank">T1589.002</a>] from datasets offered by commercial vendors [<a href="https://attack.mitre.org/versions/v19/techniques/T1597/002/" target="_blank">T1597.002</a>], open source intelligence [<a href="https://attack.mitre.org/versions/v19/techniques/T1593/" target="_blank">T1593</a>], or previously exfiltrated data [<a href="https://attack.mitre.org/versions/v19/techniques/T1597/" target="_blank">T1597</a>].  </p>
<h3><em><strong>Resource development </strong></em><a class="ck-anchor"></a></h3>
<p>The actors procure VPSs from a variety of providers [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank">T1583.003</a>], including those with Know Your Customer (KYC) requirements, and often use fabricated identities. LAUNDRY BEAR primarily uses Mullvad VPN [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/">T1583</a>] when interacting with these servers, further demonstrating the group’s intent to mask their identity and maintain operations security (OPSEC). After the server is provisioned, an automated process deploys the Docker containers necessary for <em>Ulej’s</em> Flowerbed framework [<a href="https://attack.mitre.org/versions/v19/techniques/T1608/">T1608</a>], which then receives and aggregates the data <em>Ulej</em> exfiltrates. These servers are typically only used for 7-60 days before moving to new infrastructure.</p>
<h4><strong>Flowerbed framework</strong></h4>
<p>Flowerbed is a Python project that uses Docker for containerization. The project includes four different Docker containers:</p>
<ul>
<li>Catcher,</li>
<li>Certbot,</li>
<li>Nginx, and</li>
<li>Gardener.</li>
</ul>
<p>Catcher acts as both a DNS and HTTP server to receive and aggregate exfiltrated victim information [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/">T1048</a>]. For additional information on Catcher, refer to the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section of this advisory. Flowerbed’s next container, Certbot, is based on one of the official Certbot containers, which allows for automated generation of Let’s Encrypt certificates using DNS challenges through Cloudflare. This certificate can then be used by the Nginx container, which serves as an HTTPS reverse proxy for Catcher, enabling Flowerbed to disguise some of its exfiltration activity through an encrypted communications channel [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/002/" target="_blank">T1048.002</a>]. The Nginx reverse proxy also validates that the Server Name Indicator (SNI) value contains “*.i.*” prior to forwarding the traffic to Catcher. If the SNI does not contain that string, the Nginx server returns a 444 error to the client. This is likely an attempt to reject non-Ulej connections. Finally, the Gardener container functions as a health check for the Catcher service. Gardener is a simple Python script that validates Catcher correctly receives and processes data.</p>
<p>The simplistic Flowerbed codebase has indications that artificial intelligence (AI) played a role in its development. This highlights how AI is increasingly being used to develop malicious capabilities [<a href="https://attack.mitre.org/versions/v19/techniques/T1588/007/" target="_blank">T1588.007</a>]. The dependence on AI for a simple capability, such as Flowerbed, alongside a previous reliance on open source capabilities, such as Evilginx2 [<a href="https://attack.mitre.org/versions/v19/techniques/T1588/002/" target="_blank">T1588.002</a>], likely indicates a lack of advanced technical knowledge within LAUNDRY BEAR, especially in relation to true software development capabilities.</p>
<h3><em><strong>Initial access</strong></em></h3>
<p>To gain initial access, LAUNDRY BEAR sends an email containing a malicious JavaScript payload to the target [<a href="https://attack.mitre.org/versions/v19/techniques/T1566/" target="_blank">T1566</a>]. Through exploitation of <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>, this JavaScript payload is immediately executed once the user views the malicious email [<a href="https://attack.mitre.org/versions/v19/techniques/T1203/" target="_blank">T1203</a>], such as the one shown in <a href="https://www.cisa.gov/#figure1"><strong>Figure 1</strong></a>, in the ZCS webmail platform. Since at least November 2025, LAUNDRY BEAR began sending these phishing emails from victim infrastructure through compromised accounts [<a href="https://attack.mitre.org/versions/v19/techniques/T1199/" target="_blank">T1199</a>], as shown in the email metadata in <a href="https://www.cisa.gov/#figure2"><strong>Figure 2</strong></a>. These compromised accounts were likely previous victims of this, or another LAUNDRY BEAR, campaign and their use is intended to further obfuscate and frustrate anti-phishing tools and training.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure1.png?itok=yrzcl7tK" width="604" height="235" alt="Figure 1: Example of malicious email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 1: Example of malicious email</strong></em></figcaption>
  </figure>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure2.png?itok=vEulmmyx" width="604" height="102" alt="Figure 2: Headers from an example malicious email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 2: Headers from an example malicious email</strong></em></figcaption>
  </figure>
<p>According to the National Vulnerability Database (NVD), <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-66376" target="_blank">CVE-2025-66376</a> was initially published on 5 January 2026. This vulnerability allows for execution of a JavaScript payload included in email content due to improper sanitization of Cascading Style Sheet’s (CSS) @import directives within an email [<a href="https://www.cisa.gov/#wc5">5</a>]. Because the activity attributed to this campaign began in July 2025—months before Synacor released a patch and the CVE was published—the payload initially exploited a zero-day vulnerability at that time [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/004/" target="_blank">T1587.004</a>].  </p>
<p><strong>Utilization of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability.</strong></p>
<p>Hidden in LAUNDRY BEAR’s email is a Base64 encoded payload within the “onload” field of a Scalable Vector Graphics (SVG) element [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/017/" target="_blank">T1027.017</a>], as shown in <a href="https://www.cisa.gov/#figure3"><strong>Figure 3</strong></a>. Leading up to the inclusion of this payload in the SVG element are various instances of @import directives, as required to leverage <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376">CVE-2025-66376</a>. This payload includes an XOR encrypted final script encoded in a Base64 inner payload (see <a href="https://www.cisa.gov/#figure3"><strong>Figure 3</strong></a>) [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/013/" target="_blank">T1027.013</a>]. The outer payload decodes and decrypts the inner payload using an XOR function and a hardcoded key and then executes the script contained within the inner payload containing the collection and exfiltration logic. By changing the key used for the XOR encryption of the inner payload or adding additional @import directives with non-functional code [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/010/" target="_blank">T1027.010</a>], LAUNDRY BEAR can easily generate new payloads that bypass basic threat detection signatures. This malicious payload attempts to collect and exfiltrate information in 12 asynchronous stages [<a href="https://attack.mitre.org/versions/v19/techniques/T1119/">T1119</a>]. The stages in order of appearance within the payload are as follows:</p>
<ol>
<li>sendStartPing,</li>
<li>gather_email,</li>
<li>gather_environment,</li>
<li>gather_2fa_codes,</li>
<li>gather_app_password,</li>
<li>gather_device_status,</li>
<li>gather_oauth_consumers,</li>
<li>gather_autocomplete_password,</li>
<li>enable_mail_protocols,</li>
<li>gather_gal,</li>
<li>sendArchives, and</li>
<li>sendFinishPing. </li>
</ol>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure3_0.png?itok=M-bj5-nb" width="607" height="577" alt="Figure 3: Malicious payload of example email">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 3: Malicious payload of example email</strong></em></figcaption>
  </figure>
<p>Use of a zero-day exploit within this campaign demonstrates the ability for even emerging threat groups like LAUNDRY BEAR to operationalize novel exploits into a highly successful capability [<a href="https://attack.mitre.org/versions/v19/techniques/T1587/" target="_blank">T1587</a>].</p>
<h3><em><strong>Persistence and credential access</strong></em><a class="ck-anchor"></a></h3>
<p>To establish sustained persistence into the victim’s email account, the script attempts to modify account preferences and collect authentication information. Any collected credentials are later exfiltrated, as further described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section below. Other campaigns attributed to LAUNDRY BEAR also demonstrated the group’s ability to circumvent multi-factor authentication through session token replay [<a href="https://attack.mitre.org/versions/v19/techniques/T1550/004/" target="_blank">T1550.004</a>], and the Zimbra campaign follows a similar trend.</p>
<p>The script used in this campaign tries to discover the victim’s email address during the <em>gather_email</em> stage [<a href="https://attack.mitre.org/techniques/T1087/" target="_blank">T1087</a>]. The script searches for this email address in two ways. First, it examines the <em>batchInfoResponse </em>variable, which an HTML script element on the webpage can define, for an email address. Even if the script finds an email address there, it also checks whether it acquired a Cross-Site Request Forgery (CSRF) token as described later in the <a href="https://www.cisa.gov/#collection1">Collection</a> section of this advisory. If so, the script uses the “GetIdentitiesRequest” Simple Object Access Protocol (SOAP) command under the “ZimbraAccount” namespace to determine the victim’s email address [<a href="https://attack.mitre.org/versions/v19/techniques/T1185/" target="_blank">T1185</a>] and then exfiltrates it. However, if the script does not have a CSRF token or the SOAP request fails, the script exfiltrates the email value recovered from the first method instead. If both attempts fail to capture the victim’s email, the script sends a JavaScript Object Notation (JSON) payload with a key of “email” and value of <em>null </em>over HTTPS and does not attempt DNS exfiltration.</p>
<p>During the <em>gather_autocomplete_password</em> stage, the script attempts to collect the victim’s saved password via the autocomplete feature of the victim’s password manager. The script injects two HTML div elements requesting login credentials onto the page outside of the victim’s view, as shown in <a href="https://www.cisa.gov/#figure4"><strong>Figure 4</strong></a><strong> </strong>and <a href="https://www.cisa.gov/#figure5"><strong>Figure 5</strong></a>. After waiting five seconds, the script then attempts to extract the password provided automatically by the password manager from the input element shown in <a href="https://www.cisa.gov/#figure4"><strong>Figure 4</strong></a>. If there is no value in that input field, it checks the password input field shown in <a href="https://www.cisa.gov/#figure5"><strong>Figure 5</strong></a>. If neither input field contains a value, a JSON payload with a key of “autocomplete_password” and value of <em>null </em>is sent over HTTPS and DNS exfiltration is not attempted.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure4.png?itok=ZOZ8JHZC" width="1024" height="188" alt="Figure 4: First illegitimate login HTML element">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 4: First illegitimate login HTML element</strong></em></figcaption>
  </figure>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/figure5.png?itok=8xZU_GCa" width="1024" height="115" alt="Figure 5: Second illegitimate login HTML element">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 5: Second illegitimate login HTML element</strong></em></figcaption>
  </figure>
<p>LAUNDRY BEAR almost certainly relies on a mail client using the Internet Message Access Protocol (IMAP) for persistent access to the victim’s mailbox. During the <em>enable_mail_protocols</em> stage, a SOAP request leveraging the “ModifyPrefsRequest” command under the “ZimbraAccount” namespace is sent. This request attempts to set the “zimbraPrefImapEnabled” preference to TRUE. While the default setting for “zimbraPrefImapEnabled” is not well documented, this action is almost certainly intended to ensure that IMAP access to the victim’s mailbox is enabled.</p>
<p>ZCS does not support 2FA for some mail clients, including IMAP. To support users who rely on IMAP clients, ZCS allows for the generation of Application Passcodes. Application Passcodes are randomly generated passwords that can be used for clients that cannot support the normal 2FA process to authenticate. During the <em>gather_app_password</em> stage, the script makes a SOAP request using the “CreateAppSpecificPasswordRequest” command under the “ZimbraAccount” namespace to create a new Application Passcode [<a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank">T1556.006</a>]. The SOAP request uses “ZimbraWeb” as the name of the application.</p>
<p>Additionally, the script also attempts to collect 2FA tokens. During the <em>gather_2fa_codes</em> stage, the script makes a SOAP request using the “GetScratchCodesRequest” command under the “ZimbraAccount” namespace. The script then attempts to exfiltrate any non-null 2FA codes collected this way. The number of codes can vary, and each code is exfiltrated to Flowerbed individually.</p>
<h3><em><strong>Collection</strong></em><a class="ck-anchor"></a></h3>
<p>As demonstrated in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section, this script relies heavily on SOAP requests to collect victim information. To make these requests, the script aims to acquire the victim’s current CSRF token, which it attempts to access within the webpage’s local storage using localStorage.getItem("csrfToken"). If the script is unable to acquire this CSRF token, it will be unable to make any SOAP requests. In addition to the SOAP commands documented in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> section, other SOAP commands executed to collect victim information are shown in <a href="https://www.cisa.gov/#table1"><strong>Table 1</strong></a>.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 1: Additional SOAP commands used</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>SOAP Command </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>Namespace </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p><strong>Stage </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetInfoRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetDeviceStatusRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraSync </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_device_status </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>GetOAuthConsumersRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_oauth_consumers </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>SearchGalRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>zimbraAccount </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW195872110 BCX8">
<div class="OutlineElement Ltr SCXW195872110 BCX8">
<p>gather_gal </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>The script attempts to collect the victim’s GAL through brute force by searching for each two-character combination from a character set of “abcdefghijklmnopqrstuvwxyz1234567890.-_”. These queries are conducted using 20 batches of SOAP requests with 77 “SearchGalRequest” SOAP commands in each batch except for the last request containing only 58.</p>
<p>During the <em>gather_environment</em> stage, the script attempts to determine which type of ZCS webmail client the victim is using. The script checks the user’s current URL to determine the client type being used, checking for certain indicators (shown in <a href="https://www.cisa.gov/#table2"><strong>Table 2</strong></a>) to determine the client type. The corresponding value is then used as the payload when exfiltrating the client type.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 2: ZCS webmail client types</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Indicator </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Client Type </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p><strong>Associated Value </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>?client=advanced </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Advanced </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>c </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>/h/ </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Standard </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>h </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>/modern/ </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>Modern </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW28945023 BCX8">
<div class="OutlineElement Ltr SCXW28945023 BCX8">
<p>m </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>As part of collection, the script attempts to harvest any emails not marked as “junk” from the last 90 days from the victim’s account. Emails are collected daily by an HTTP GET request to the URL path, “/home/~/?fmt=tgz&amp;meta=0&amp;query=date:-{DAY_OFFSET}d AND (not in:junk)”. The <em>{DAY_OFFSET}</em> value would be between 0 and 89 representing how many days ago the email was sent or received. To prevent redundant collection and exfiltration of emails, a variable with a name based on the email date being queried, using a format of <em>zd_comp_YYYY-MM-DD</em>, and value of <em>true</em>, is saved to the <em>window.top.localStorage</em> property. This variable is saved regardless of whether the email is successfully exfiltrated.  </p>
<p>According to Mozilla documentation, if the user is not in a private browsing session, any data stored to localStorage does not typically expire. This means that if the user happens to execute the script again from the same computer, the script avoids attempting to re-exfiltrate previously captured emails. However, the script always attempts to pull any emails with a <em>{DAY_OFFSET} </em>of zero. In other words, the script always pulls emails sent or received the same day it is run. After email results are returned from the query for each day of email activity, those results are then passed to Flowerbed as described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section.</p>
<p>The script also provides LAUNDRY BEAR with telemetry on any errors that occur during the collection process. This is accomplished by executing any collection or exfiltration code through helper functions that contain error handling logic. If an error occurs, a payload containing information on the error itself, the context of the error happening, and the stage in which the error occurred is sent to Flowerbed as described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section below. For cases where the error occurs within a SOAP request, “:api” is concatenated to the stage value in the payload. If an error occurs during the batch SOAP requests that occur when collecting the GAL of the victim, the stage value will use a format of <em>gather_gal:{VAL}:api</em>. The <em>{VAL}</em> placeholder indicates which batch request, a number from 0 to 19, the error occurred in. Errors that occur during the password autocomplete interception process will use “gather_autocomplete_password:dom” for the stage value. Finally, if an error occurs when attempting to collect or exfiltrate a specific day’s emails, the stage will include which day the error occurred on, using the previously defined placeholder <em>{DAY_OFFSET},</em> with a format of <em>sendArchive:day-{DAY_OFFSET}</em>.</p>
<h3><em><strong>Exfiltration</strong></em><a class="ck-anchor"></a></h3>
<p>At the end of each stage in the collection process, the script attempts to exfiltrate acquired information to Flowerbed. The script primarily relies on two forms of data exfiltration: DNS [<a href="https://attack.mitre.org/versions/v19/techniques/T1048/003/" target="_blank">T1048.003</a>] and HTTPS. Some information is exfiltrated over both the DNS and HTTPS channels.</p>
<p>Prior to exfiltration, a randomized 10- or 11-character alphanumeric string is generated as an identifier for the victim. This identifier is included in the URL of both the DNS- and HTTPS-based exfiltration.  </p>
<h4><strong>DNS exfiltration</strong></h4>
<p>DNS exfiltration occurs through DNS A record queries. To ensure data exfiltrated through DNS is not corrupted when traversing through non-actor-controlled DNS infrastructure, <em>Ulej </em>maintains compliance with RFC 1035, Domain Names - Implementation and Specification, specifically accounting for the case insensitivity and subdomain length requirements. Base32 encoding is used to create a case-insensitive payload. Once the payload is encoded, a period (“.”) is added every 60 characters to ensure each subdomain is under 63 characters long. The script then creates a new image object sourced from a URL with the scheme defined in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a>. Any traffic involving DNS exfiltration will have “d-“ prefixing the victim identifier, and the subdomain immediately following indicates the type of information being exfiltrated.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure6.png?itok=Tv8RT8o8" width="1024" height="49" alt="Figure 6: Structure for information exfiltrated by DNS">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 6: Structure for information exfiltrated by DNS</strong></em></figcaption>
  </figure>
<p>When the script generates an image object, the browser tries to retrieve the complete domain of the URL specified as the source of the image. This triggers a DNS request sent to the actor-controlled server and processed by Flowerbed. <a href="https://www.cisa.gov/#table3"><strong>Table 3</strong></a> lists both the information exfiltrated via DNS and their corresponding data type identifiers in the DNS queries.  </p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 3: DNS exfiltration</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p><strong>Data Type </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Victim’s Email Address </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_email </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>e </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Client Type </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>c </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Zimbra Version </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment  </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>v </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>URL at Time of Exploitation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>url </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>2FA Scratch Codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_2fa_codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>2fa </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Newly Created Application Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_app_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>pa </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>Harvested Autocomplete Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>gather_autocomplete_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW258158484 BCX8">
<div class="OutlineElement Ltr SCXW258158484 BCX8">
<p>pw </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<h4><strong>HTTPS exfiltration</strong></h4>
<p>Any information exfiltrated via DNS is also exfiltrated through HTTPS, as well as additional data including email content, contacts, attachments, and error logging information. By using Let’s Encrypt certificates, this group can quickly deploy new infrastructure and leverage encrypted HTTPS communications with valid server certificates when exfiltrating information from the victim’s environment. The HTTPS exfiltration capability only uses two HTTP content types, defined in <a href="https://www.cisa.gov/#table4"><strong>Table 4</strong></a>. Traffic associated with HTTPS exfiltration will use the URL scheme shown in <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>.  </p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 4: HTTPS exfiltration types</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p><strong>Content Type </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p><strong>URL Path </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>application/json </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>/v/p </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>application/octet-stream </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW3397685 BCX8">
<div class="OutlineElement Ltr SCXW3397685 BCX8">
<p>/v/d </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%207.png?itok=CdTcyMdN" width="1024" height="50" alt="Figure 7: Structure for information exfiltrated by HTTPS">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 7: Structure for information exfiltrated by HTTPS</strong></em></figcaption>
  </figure>
<p>Some of the data transmitted via HTTPS uses the standard JSON content type format. The script includes the information in a POST request to actor-controlled infrastructure.  </p>
<p><a href="https://www.cisa.gov/#table5"><strong>Table 5</strong></a> provides a summary of the JSON-based exfiltration.</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 5: HTTPS JSON exfiltration  </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p><strong>JSON Key(s) </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Victim’s Email Address </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_email </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>email </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Client Type, Version, and Current URL </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>client, version, full_url </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Newly Created Application Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_app_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>app_password </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>Harvested Autocomplete Password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>gather_autocomplete_password </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW25077005 BCX8">
<div class="OutlineElement Ltr SCXW25077005 BCX8">
<p>autocomplete_password </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>The script transmits all HTTPS exfiltration not identified in <a href="https://www.cisa.gov/#table5"><strong>Table 5</strong></a> using the Octet-Stream content type as binary data. The POST requests for this method include a filename in the “X-Filename” header. Traditionally, developers use headers prefixed with “X-” to denote custom headers that do not follow a defined standard. The purpose of including this header remains unclear since the Catcher capability ignores the provided filename when saving the data. <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> summarizes the data exfiltrated in this format.</p>
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<div class="TableContainer Ltr SCXW189907655 BCX8">
<div class="WACAltTextDescribedBy SCXW189907655 BCX8"><a class="ck-anchor"></a></div>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong> Table 6: HTTPS binary exfiltration</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>Type of Information </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>Exfiltration Stage </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p><strong>X-Filename Header </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetInfoRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_environment </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetScratchCodesRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_2fa_codes </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetDeviceStatusRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_device_status </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>SOAP request for GetOAuthConsumersRequest </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_oauth_consumers </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>zimbra_batch_analytics.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>Victim Organization’s Global Address List </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>gather_gal </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>telemetry_{1-20}.json </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>Last 90 Days of Victim’s Emails </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>sendArchives </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW189907655 BCX8">
<div class="OutlineElement Ltr SCXW189907655 BCX8">
<p>telemetryData_{0-89}.json </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<p>The script sends all exfiltrated data identified in <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> to the Catcher service exactly as received from the SOAP request in a JSON payload, except for email exfiltration. For email exfiltration, the script sends it as a GZIP compressed archive [<a href="https://attack.mitre.org/versions/v19/techniques/T1560/" target="_blank">T1560</a>]. Although most of the exfiltration consists of valid JSON, the script still attempts to exfiltrate all information identified in <a href="https://www.cisa.gov/#table6"><strong>Table 6</strong></a> using the application/octet-stream content typing rather than application/json.</p>
<p>At the beginning and end of the collection and exfiltration activity, during the <em>sendStartPing</em> and <em>sendFinishPing </em>stages respectively, the script submits a POST request with a JSON payload to indicate that the script is starting or finishing execution. Throughout execution, the script also logs error events and send the logs using similar JSON payloads. The script sends the JSON in a POST request to the URL documented in <a href="https://www.cisa.gov/#figure2"><strong>Figure 2</strong></a>, using a URL path of “/v/p” and with a “subtype” key that shows which type of action it logged (<em>start, finish, or error</em>).  </p>
<h4><strong>Catcher</strong></h4>
<p><em>Ulej </em>exfiltrates information to Flowerbed to be handled by a service named Catcher. Catcher is a containerized Python application, running in Docker as part of Flowerbed, which is detailed in the <a href="https://www.cisa.gov/#resourcedev1">Resource development</a> section. It receives exfiltrated data and temporarily stores it, enabling its eventual transfer to infrastructure designed for long-term, secure storage.</p>
<p>Catcher acts as an HTTP server over port 8000 and a DNS server on port 53. As described in the <a href="https://www.cisa.gov/#resourcedev1">Resource development</a> section, the Flowerbed project uses an additional Docker container running an Nginx reverse proxy to enable HTTPS support. This reverse proxy uses a certificate generated by Let’s Encrypt and forwards all traffic with an SNI containing “*.i.*” to port 8000 within the Catcher container.</p>
<p>The DNS service can accept A, AAAA, MX, TXT, and CAA queries. For any MX, AAAA, or CAA queries, the server will always provide an empty response. The system only supports TXT records as needed to process Automatic Certificate Management Environment (ACME) requests, which enable the assignment of Let’s Encrypt certificates. If the server receives an A query, Catcher will always respond with the public IP address of the Flowerbed server.  </p>
<p>However, if a query includes a domain formatted as shown in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a> and <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>, the service saves a log file in JSON format to disk containing the following details of the DNS query:</p>
<ul>
<li>Time of query,</li>
<li>Source IP address for query,</li>
<li>Queried domain, and</li>
<li>Type of query.</li>
</ul>
<p>The HTTP server typically responds with OK, except in cases where the path is “pixel.gif” when the response contains a 1x1 gif image with a SHA-256 hash of ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629. Like the DNS service, the HTTP service will only log entries when the domain found in the host header of the request follows the expected formatting as seen in <a href="https://www.cisa.gov/#figure6"><strong>Figure 6</strong></a> and <a href="https://www.cisa.gov/#figure7"><strong>Figure 7</strong></a>. As the HTTPS exfiltration uses non-standardized binary and JSON-formatted payloads when exfiltrating to Catcher, Catcher will check the content type of the request. If the content type is set to “application/json”, Catcher encodes the data in Base64 and includes it in the JSON log entry written to disk. If the content type is set to any other value, Catcher leaves the Base64 payload in the JSON log entry blank and saves the payload to a separate file with the same filename as the JSON log entry with a “.bin” file extension. An HTTPS exfiltration event causes Catcher to save a JSON formatted log file to disk containing the following information from the HTTP request:</p>
<ul>
<li>Time,</li>
<li>Source IP address,</li>
<li>Request method,</li>
<li>Host,</li>
<li>Path,</li>
<li>Query string,</li>
<li>Headers, and</li>
<li>Base64 payload.</li>
</ul>
<p>These JSON event log files and binary output files are then initially saved to the directory <em>/root/hits/tmp</em> and later moved to the <em>/root/hits/ready</em> directory once processed. This prevents incomplete files, which are still being uploaded to Catcher, from premature exfiltration from the server. Approximately every 60 seconds, a likely automated workflow establishes a Secure Shell (SSH) connection with the server hosting Flowerbed for a few seconds, almost certainly exfiltrating the data processed by Catcher to non-public-facing infrastructure. The command in <a href="https://www.cisa.gov/#figure8"><strong>Figure 8</strong></a> also executes hourly to remove all files last modified at least two days ago from the <em>/root/hits/ready</em> directory.</p>
<p><a class="ck-anchor"></a></p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%208-Command%20used%20for%20automated%20directory%20cleanup.png?itok=IqvZvbLK" width="1024" height="92" alt="Figure 8: Command used for automated directory cleanup">



</div>
      <figcaption class="c-figure__caption"><em><strong>Figure 8: Command used for automated directory cleanup</strong></em></figcaption>
  </figure>
<h2><strong>Response strategies</strong></h2>
<h3><em><strong>Mitigations</strong></em><a class="ck-anchor"></a></h3>
<p>In many cases, by the time an organization identifies a compromise related to this campaign, numerous sensitive and proprietary emails have already been exfiltrated. The significant risk posed by this cyber threat emphasizes the importance for organizations that use ZCS and other similar webmail solutions to take proactive steps to mitigate this risk.</p>
<p>All organizations that use the ZCS webmail service should <strong>immediately prioritize</strong> ensuring that their ZCS is not running a vulnerable version. A patch for <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a> was released for both 10.1.13 and 10.0.18 versions of ZCS [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening">D3-AH</a>]. If immediate patching is not feasible, organizations should advise employees to use alternative mail clients to access email and avoid using the Classic ZCS webmail client until ZCS is updated to a non-vulnerable version [<a href="https://d3fend.mitre.org/tactic/d3f:Isolate/" target="_blank">d3f:Isolate</a>].</p>
<p>System administrators should closely monitor any Internet-connected ZCS or other email systems and the workstations that access those systems and promptly apply available software updates [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening" target="_blank">D3-AH</a>]. Administrators can maintain awareness of active vulnerability exploitation by referencing open source resources, including <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">CISA’s Known Exploited Vulnerabilities Catalog</a> and <a href="https://www.ncsc.gov.uk/collection/vulnerability-management/guidance/responding-to-active-exploitation" target="_blank">NCSC-UK’s Responding to active exploitation of vulnerabilities</a> guidance.</p>
<p>Organizations should consider using a third-party authentication service that supports passkeys for authentication to mediate access to ZCS and other services that do not natively support passkeys. By doing so, organizations can work to eliminate the possibility of automated password collection from autocomplete or password reuse [<a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank">D3-CH</a>]. However, Application Passcodes may still be necessary and should be monitored closely.  </p>
<p>Organizations should implement network monitoring capabilities with collection and short-term retention of packet capture or NetFlow data and maintain log collection and storage [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MaintainLogCollectionStorage3Q">CPG 3.Q</a>]. This will allow organizations to monitor for and identify suspicious network activity [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#IdentifyAdverseEvents4B">CPG 4.B</a>], such as:</p>
<ul>
<li>Significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis" target="_blank">D3-NTA</a>];</li>
<li>Frequent DNS queries for a suspicious domain with seemingly random subdomains [<a href="https://d3fend.mitre.org/technique/d3f:DNSTrafficAnalysis" target="_blank">D3-DNSTA</a>];</li>
<li>A sudden spike of connections to a server associated with a recently established domain [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation">D3-NTCD</a>]; and  </li>
<li>Connections to internal services, such as webmail, from VPN providers frequently leveraged by this group for nefarious activity, such as Mullvad VPN [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation">D3-NTCD</a>].</li>
</ul>
<p>Additionally, for organizations that can inspect the content of outbound HTTPS connections via break-and-inspect infrastructure, security teams should identify traffic matching the characteristics described in the <a href="https://www.cisa.gov/#exfil1">Exfiltration</a> section of this advisory.</p>
<h3><em><strong>Indicators of compromise (IOCs)</strong></em><a class="ck-anchor"></a></h3>
<h4><strong>Flowerbed infrastructure</strong></h4>
<p>The following indicators have been attributed to use by LAUNDRY BEAR for their campaign targeting ZCS’s webmail service as of the publication of this advisory. (<strong>Disclaimer: </strong>Due to the frequency of operational structure changes by this group, these indicators are intended solely for historic attribution purposes. Some indicators, such as IPs, compromised emails, and domains, may be outdated, so organizations should check for current activity before acting on these IOCs.) <a href="https://www.cisa.gov/#table7"><strong>Table 7</strong></a> provides details about the server infrastructure used to host Flowerbed, and <a href="https://www.cisa.gov/#table8"><strong>Table 8</strong></a> lists the corresponding SHA-1 hash values for the Let’s Encrypt certificates used by that infrastructure [<a href="https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis" target="_blank">D3-IAA</a>].</p>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 7: Flowerbed server infrastructure</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>Domain </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>IP Address </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>First Seen </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p><strong>Last Seen </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]104 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>8 July 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>15 October 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbra-metadata[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]18 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>20 August 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>14 October 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>analyticemailmeter[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>37.120.247[.]228 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>24 September 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>emailanalytics.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>185.86.79[.]95 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>24 September 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>mailnalysis[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>104.248.134[.]194 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>11 November 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>17 February 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbrastat[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>64.226.124[.]190 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 December 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>zimbrasoft.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>193.238.152[.]66 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>20 January 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>18 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>synacorzimbra[.]nl </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>216.252.238[.]64 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>3 February 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>30 March 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>istc-cloud[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>194.156.103[.]193 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>5 February 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW193774983 BCX8">
<div class="OutlineElement Ltr SCXW193774983 BCX8">
<p>30 March 2026 </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 8: Flowerbed X.509 certificate SHA-1 hashes  </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>Associated Domain </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>X.509 SHA-1 Hash </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>First Seen </strong></p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p><strong>Last Seen </strong></p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>2e4f314bc9943cab5005d6fde0b271c74d47bc9d </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8 Jul 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>6 Aug 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zmailanalytics[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>50a87d926621dd06389ba50d86e0ff574ed713a8 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>6 Aug 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>13 Oct 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbra-metadata[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>c5a72420e7bb308d078e62128430897f82194c95 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>20 Aug 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>14 Oct 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.analyticemailmeter[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8959c4d29e29f02ea94ea8bb21c8df2594c5549d </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>24 Sep 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>8 Nov 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.emailanalytics.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>62eb76432597694edb01c1fe57aab0cfe03a7178 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>25 Sep 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>27 Sep 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.mailnalysis[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>cddf5c3be1e07f28140aed165b929bf2d614922a </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>12 Nov 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>17 Dec 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbrastat[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>18b3ad442ce73cc8656d51d75bbd7c855f2cb7e8 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>18 Dec 2025 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>28 Dec 2025 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.zimbrasoft.com[.]ua </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>1b25041ececf2457eef0270fc1d785cec8ec9ded </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>21 Jan 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>10 Feb 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.synacorzimbra[.]nl </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>e4fe6466a4f9a4249fe330651e914e45bbdca44a </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>5 Feb 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>22 Mar 2026 </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>*.i.istc-cloud[.]com </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>b6b77c9a455225d525834a403ca9ef5481ed0447 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>12 Feb 2026 </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW66173475 BCX8">
<div class="OutlineElement Ltr SCXW66173475 BCX8">
<p>30 Mar 2026 </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p>LAUNDRY BEAR has used the following email addresses to procure resources used for this campaign:</p>
<ul>
<li>ivanka.zurabishvili@proton[.]me,</li>
<li>zmul1@buildandconsulting[.]com,</li>
<li>garrysmithme@pinmx[.]net, and</li>
<li>hostingclient@pinmx[.]net.</li>
</ul>
<h4><strong>Phishing distribution</strong></h4>
<p>LAUNDRY BEAR primarily relied on ProtonMail for distribution of malicious email. However, as stated above, LAUNDRY BEAR’s more recent efforts likely have shifted to distributing the payload through previous victims.  </p>
<p>The following email addresses have distributed payloads attributed to this campaign:</p>
<ul>
<li>c.laurent.ejfa@proton[.]me,</li>
<li>j.moreau.epsc@proton[.]me,</li>
<li>liberty.insights@proton[.]me,</li>
<li>certain email addresses (presumably compromised) at the isofts.kiev[.]ua domain (i.e., ending with @isofts.kiev[.]ua), and</li>
<li>certain email addresses (presumably compromised) at the navs.edu[.]ua domain (i.e., ending with @navs.edu[.]ua).</li>
</ul>
<p>Additionally, the following are SHA-256 hashes of email samples containing the malicious payload attributed to this campaign:</p>
<ul>
<li>98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf,</li>
<li>60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874,</li>
<li>b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d, and</li>
<li>1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760.</li>
</ul>
<h4><strong>Post-compromise artifacts</strong></h4>
<p>Currently, the script does not remove artifacts. This leaves additional opportunities to identify victims of this activity. While emphasis should always be placed on consistent monitoring of network traffic and endpoint activity, there are a variety of persistent artifacts described below that can be used to identify victims of this campaign.</p>
<p>This <em>Ulej </em>capability relies on creating a significant number of SOAP requests to collect account information for exfiltration. ZCS logs from these requests are stored, by default, in the <em>/opt/zimbra/log/mailbox.log</em> file [<a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank">D3-PA</a>]. A significant amount of SOAP request activity that aligns with what was described in the <a href="https://www.cisa.gov/#persistence1">Persistence and credential access</a> and <a href="https://www.cisa.gov/#collection1">Collection</a> sections of this advisory could indicate a potential compromise. Specific examples of high-risk SOAP request activity might include:</p>
<ul>
<li>Many <em>SearchGalRequest </em>command requests from a single user over a short period of time;</li>
<li>Use of the <em>CreateAppSpecificPasswordRequest</em> command, especially in cases where it is creating an Application Passcode named “ZimbraWeb”; and</li>
<li>Use of the GetScratchCodesRequest command.</li>
</ul>
<p>While LAUNDRY BEAR uses the localStorage property to track what days had emails previously exfiltrated, defenders can use this property to identify victims of this campaign and determine the scope of exfiltrated information [<a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank">D3-PA</a>]. Review of the items stored in that property for an organization’s ZCS webmail client page on an endpoint device could indicate compromise if there are items named with a format of <em>zd_comp_YYYY-MM-DD,</em> as explained in the <a href="https://www.cisa.gov/#collection1">Collection</a> section of this advisory.</p>
<p>While Application Passcodes have non-malicious purposes, in this case instances of these passcodes with the name “ZimbraWeb” are almost certainly malicious. The ZCS webmail application can support 2FA natively and does not require the use of an Application Passcode, so there is no reason that there should be one named “ZimbraWeb.”</p>
<p>In instances where organizations identify victims of this campaign, they should also examine the inbox of the suspected victim for the original phishing email [<a href="https://d3fend.mitre.org/technique/d3f:MessageAnalysis" target="_blank">D3-MA</a>]. If an email that has a payload exploiting <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376">CVE-2025-66376</a> is discovered, <strong>steps should be taken immediately to identify and quarantine other instances of emails with similar body content, senders, and subject lines to prevent further exploitation and exfiltration.  </strong></p>
<h3><em><strong>Remediation</strong></em></h3>
<p>In the event an organization identifies activity associated with this campaign, that organization should take steps to minimize further exploitation. The organization should consider requesting that employees minimize use of the ZCS webmail client until the organization updates to a patched version that is not vulnerable to <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank">CVE-2025-66376</a>.</p>
<p>Organizations should use identifiers from the <a href="https://www.cisa.gov/#ioc1">IOCs</a> section of this report to identify any individuals compromised by this campaign and record the date(s) of compromise(s) to determine the scale and scope of emails exfiltrated.</p>
<p>All users from the organization should have all Application Passcodes and 2FA scratch keys revoked. Affected organizations should require all employees to change passwords in line with establishing minimum password strength requirements [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#EstablishMinimumPasswordStrength3B">CPG 3.B</a>] and creating unique credentials [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#CreateUniqueCredentials3C">CPG 3.C</a>], specifically noting that compromised employees might have had any password stored in a password manager exfiltrated.</p>
<h2><strong>Works cited</strong></h2>
<p>[1<a class="ck-anchor"></a>] Netherlands General Intelligence and Security Service (AIVD) and Netherlands Defence Intelligence and Security Service (MIVD). AIVD and MIVD identify a new Russian cyber threat actor. 2025. <a href="https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf" target="_blank">https://www.aivd.nl/site/binaries/site-content/collections/documents/2025/05/27/aivd-en-mivd-onderkennen-nieuwe-russische-cyberactor/Advisory+AIVD+en+MIVD+Public+report+on+new+cyber+actor.pdf</a></p>
<p>[2]<a class="ck-anchor"></a> Microsoft Corporation. New Russia-affiliated actor Void Blizzard targets critical sectors for espionage. 2025. <a href="https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/" target="_blank">https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/</a></p>
<p>[3]<a class="ck-anchor"></a> Palo Alto Networks Unit 42. Russian Global Webmail Espionage. 2026. <a href="https://unit42.paloaltonetworks.com/russian-webmail-espionage/">https://unit42.paloaltonetworks.com/russian-webmail-espionage/ </a></p>
<p>[4]<a class="ck-anchor"></a> Proofpoint. TA488 Targets Zimbra Mailservers with Half-Click Exploits. 2026. <a href="https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit">https://www.proofpoint.com/us/blog/threat-insight/ta488-zcs-exploit</a></p>
<p>[5]<a class="ck-anchor"></a> Seqrite. Operation GhostMail: Russian APT exploits Zimbra Webmail to Target Ukraine State Agency. 2026. <a href="https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/" target="_blank">https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/  </a></p>
<h2><strong>Footnotes</strong></h2>
<p><sup>1</sup><a class="ck-anchor"></a> Národní úřad pro kybernetickou a informační bezpečnost<br><sup>2</sup><a class="ck-anchor"></a><sup> </sup>Forsvarets Efterretningstjeneste<br><sup>3</sup><a class="ck-anchor"></a><sup> </sup>Välisluureamet<br><sup>4</sup><a class="ck-anchor"></a> Sotilastiedustelu<br><sup>5</sup><a class="ck-anchor"></a><sup> </sup> Suojelupoliisi<br><sup>6</sup><a class="ck-anchor"></a> Direction générale de la sécurité intérieure<br><sup>7</sup><a class="ck-anchor"></a> Agence nationale de la sécurité des systèmes d’information<br><sup>8</sup><a class="ck-anchor"></a> Agenzia Informazioni e Sicurezza Esterna<br><sup>9</sup><a class="ck-anchor"></a> Agenzia Informazioni e Sicurezza Interna<br><sup>10</sup><a class="ck-anchor"></a> Serviciul de Informații și Securitate al Republicii Moldova<br><sup>11 </sup><a class="ck-anchor"></a>Agencja Wywiadu<br><sup>12</sup><a class="ck-anchor"></a><sup> </sup>Służba Kontrwywiadu Wojskowego<br><sup>13</sup><a class="ck-anchor"></a><sup> </sup>Centro Nacional de Inteligencia<br><sup>14 </sup><a class="ck-anchor"></a>Nationellt Cybersäkerhetscenter<br><sup>15</sup><a class="ck-anchor"></a> MITRE and ATT&amp;CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of The MITRE Corporation.</p>
<h2><strong>Acknowledgements</strong></h2>
<p>The authoring agencies acknowledge the contributions to this advisory from Palo Alto Networks Unit 42 and Proofpoint.</p>
<h2><strong>Disclaimer of endorsement</strong></h2>
<p>The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.</p>
<p>Organizations have no obligation to respond or provide information back to the authoring organizations in response to this joint advisory. If, after reviewing the information provided, an organization decides to provide information to the authoring organizations, reporting must be consistent with all applicable laws and policies.</p>
<h2><strong>Purpose</strong></h2>
<p>This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.</p>
<h2><strong>Contact</strong></h2>
<div class="SCXW95230887 BCX8">
<div class="OutlineElement Ltr SCXW95230887 BCX8">
<p><strong>United States organizations </strong></p>
<ul>
<li><strong>National Security Agency</strong> <br>Cybersecurity Report Feedback: <a href="mailto:CybersecurityReports@nsa.gov" target="_blank"><u>CybersecurityReports@nsa.gov</u></a> <br>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DIB_Defense@cyber.nsa.gov" target="_blank"><u>DIB_Defense@cyber.nsa.gov</u></a> <br>Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, <a href="mailto:MediaRelations@nsa.gov" target="_blank"><u>MediaRelations@nsa.gov</u></a> </li>
<li><strong>Cybersecurity and Infrastructure Security Agency</strong> <br>CISA’s 24/7 Operations Center (<a href="mailto:contact@cisa.dhs.gov" target="_blank"><u>contact@cisa.dhs.gov</u></a>), or by calling 1-844-Say-CISA (1-844-729-2472). </li>
<li><strong>Federal Bureau of Investigation</strong> <br>If you or someone you know has fallen victim to this campaign, file a complaint with <a class="Hyperlink SCXW95230887 BCX8" href="https://www.ic3.gov/" target="_blank" rel="noreferrer noopener"><u>IC3</u></a>. </li>
<li><strong>Defense Counterintelligence and Security Agency </strong> <br>DCSA Counterintelligence, Cyber Mission Center, Cyber Threat Operations Branch: <a href="mailto:DCSA.CI.CyberOps@mail.mil" target="_blank"><u>DCSA.CI.CyberOps@mail.mil</u></a> <br>Cleared Contactors (CCs) should contact their DCSA Counterintelligence Special Agent to report information pertaining to suspicious contacts or physical/digital efforts to obtain illegal or unauthorized access to the CC’s cleared facility/information, as required by 32 CFR 117. <br>Media/Public Inquiries: <a href="mailto:dcsa.quantico.dcsa-hq.mbx.pa@mail.mil" target="_blank"><u>dcsa.quantico.dcsa-hq.mbx.pa@mail.mil</u></a>  </li>
<li><strong>Department of Defense Cyber Crime Center </strong> <br>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DC3.DCISE@us.af.mil" target="_blank"><u>DC3.DCISE@us.af.mil</u></a> <br>Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at <a href="https://dibnet.dod.mil/" target="_blank"><u>https://dibnet.dod.mil</u></a> <br>Media Inquiries / Press Desk: <a href="mailto:DC3.Information@us.af.mil" target="_blank"><u>DC3.Information@us.af.mil</u></a> </li>
<li><strong>Naval Criminal Investigative Service</strong> <br>To report criminal activity impacting the United States Navy, go to <a href="http://www.ncis.navy.mil/" target="_blank"><u>www.ncis.navy.mil</u></a> and click “Submit a Tip”</li>
</ul>
<p><strong>Dutch organizations</strong> </p>
<ul>
<li>Defence Intelligence and Security Service (MIVD): <a href="https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheid" target="_blank"><u>https://www.defensie.nl/onderwerpen/m/militaire-inlichtingen-en-veiligheid</u></a>  </li>
<li>General Intelligence and Security Service (AIVD): <a href="https://www.aivd.nl/" target="_blank"><u>https://www.aivd.nl</u></a> </li>
</ul>
<p><strong>Australian organizations </strong></p>
<ul>
<li>Australian Signals Directorate <br>Visit <a href="https://www.cyber.gov.au/about-us/about-asd-acsc/contact-us#no-back" target="_blank"><u>cyber.gov.au</u></a> or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories. </li>
</ul>
<p><strong>Canadian organizations </strong></p>
<ul>
<li>The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices.  <br>Report an incident or suspicious activity to the Cyber Centre by email at <a href="mailto:contact@cyber.gc.ca" target="_blank"><u>contact@cyber.gc.ca</u></a>, online via the reporting tool <a href="https://www.cyber.gc.ca/en/incident-management" target="_blank"><u>Report a cyber incident - Canadian Centre for Cyber Security</u></a> or by phone at 1-833-CYBER-88 (1-833-292-3788). </li>
</ul>
<p><strong>New Zealand organizations </strong></p>
<ul>
<li>New Zealand National Cyber Security Centre (NCSC-NZ): <a href="mailto:info@ncsc.govt.nz" target="_blank"><u>info@ncsc.govt.nz</u></a> </li>
</ul>
<p><strong>United Kingdom organizations </strong></p>
<ul>
<li>Report significant cyber security incidents to <a href="https://ncsc.gov.uk/report-an-incident" target="_blank"><u>ncsc.gov.uk/report-an-incident</u></a> (monitored 24/7) </li>
</ul>
<p><strong>Estonia organizations </strong></p>
<ul>
<li>Estonian Foreign Intelligence Service (EFIS): <a href="mailto:info@valisluureamet.ee" target="_blank"><u>info@valisluureamet.ee</u></a> </li>
</ul>
<p><strong>Finnish organizations </strong></p>
<ul>
<li>Finnish Security and Intelligence Service: <a href="https://supo.fi/en/contact" target="_blank"><u>supo.fi/en/contact</u></a> </li>
</ul>
<p><strong>French organizations </strong></p>
<ul>
<li>French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: <a href="mailto:cert-fr@ssi.gouv.fr" target="_blank"><u>cert-fr@ssi.gouv.fr</u></a> or by phone at: 3218 or +33 9 70 83 32 18. </li>
</ul>
<p><strong>Italian Organizations </strong></p>
<ul>
<li>Italian External Intelligence and Security Agency (AISE):  <br>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank"><u>https://www.sicurezzanazionale.gov.it/</u></a>  </li>
<li>Italian Internal Intelligence and Security Agency (AISI):  <br>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank"><u>https://www.sicurezzanazionale.gov.it/</u></a> </li>
</ul>
<div class="OutlineElement Ltr SCXW214395380 BCX8">
<p><strong>Moldovan organizations </strong></p>
</div>
<div class="ListContainerWrapper SCXW214395380 BCX8">
<ul type="disc">
<li>Security and Intelligence Service of the Republic of Moldova (SIS RM): <a href="mailto:cybersec@sis.md" target="_blank"><u>cybersec@sis.md</u></a> </li>
</ul>
</div>
<p><strong>Polish organizations </strong></p>
<ul>
<li>Polish Foreign Intelligence Agency (AW): <a href="mailto:ctiteam@aw.gov.pl" target="_blank"><u>ctiteam@aw.gov.pl</u></a></li>
</ul>
</div>
</div>
<h2><strong>Appendix A: MITRE ATT&amp;CK tactics and techniques</strong><a class="ck-anchor"></a></h2>
<p>See <a href="https://www.cisa.gov/#table9"><strong>Table 9</strong></a> through <a href="https://www.cisa.gov/#table19"><strong>Table 19</strong></a> for all the threat actor tactics and techniques referenced in this advisory.<a class="ck-anchor"></a></p>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 9: Reconnaissance </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Gather Victim Identity Information: Credentials </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1589/001/" target="_blank"><u>T1589.001</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload attempts to intercept a victim’s password from their password manager. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Gather Victim Identity Information: Email Addresses </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1589/002/" target="_blank"><u>T1589.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload attempts to grab the victim’s email address from various data stores. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Open Websites/Domains </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1593/" target="_blank"><u>T1593</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group likely leverages public information to support target development. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Active Scanning </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1595/" target="_blank"><u>T1595</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Port scanning can be used by this group to assist with determining exploitability of identified targets. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Open Technical Databases: Scan Databases </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1596/005/" target="_blank"><u>T1596.005</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Various public datasets can provide information to support discovery of exploitable targets. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Closed Sources </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1597/" target="_blank"><u>T1597</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previously exfiltrated data can be used to enhance target development efforts. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Search Closed Sources: Purchase Technical Data </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1597/002/" target="_blank"><u>T1597.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Commercial datasets can also be used to support target development efforts. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<div class="WACAltTextDescribedBy SCXW76044448 BCX8"><a class="ck-anchor"></a></div>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 10: Resource Development </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Acquire Infrastructure </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1583/" target="_blank"><u>T1583</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group used Mullvad VPN to anonymize traffic sent to operational infrastructure. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Acquire Infrastructure: Virtual Private Server </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank"><u>T1583.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group procured VPS servers from a variety of vendors. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/" target="_blank"><u>T1587</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The <em>Ulej</em> capability was developed likely for use by this group to conduct spear phishing campaigns. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities: Malware </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/001/" target="_blank"><u>T1587.001</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Development of a novel payload that steals a victim’s emails and other sensitive account information. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Develop Capabilities: Exploits </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1587/004/" target="_blank"><u>T1587.004</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Development of a novel, at the time, cross-site-scripting (XSS) exploit that enables execution of arbitrary JavaScript. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obtain Capabilities: Tool </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1588/002/" target="_blank"><u>T1588.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Open source tools, such as Evilginx2, have also been used by the group. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obtain Capabilities: Artificial Intelligence </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1588/007/" target="_blank"><u>T1588.007</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The group appears to have leveraged AI to support development efforts. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Stage Capabilities </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1608/" target="_blank"><u>T1608</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Flowerbed is deployed to a procured server in the cloud. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 11: Initial Access </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Valid Accounts </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank"><u>T1078</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This actor has used commercial datasets to acquire account credentials and gain unauthorized access to accounts. Additionally, this actor is believed to use previously compromised accounts to conduct spear phishing.  </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Trusted Relationship </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1199/" target="_blank"><u>T1199</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The group sends malicious payloads to targeted individuals using previously compromised accounts that might have an established relationship with the target.  </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Phishing </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1566/" target="_blank"><u>T1566</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The actors used spear phishing to lure users into opening malicious email. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 12: Execution </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exploitation for Client Execution </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1203/" target="_blank"><u>T1203</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>An XSS vulnerability was leveraged to execute the JavaScript payload. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 13: Persistence </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Account Manipulation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1098/" target="_blank"><u>T1098</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Enabling IMAP and Application Passcodes provides persistent access to the compromised account. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Modify Authentication Process: Multi-Factor Authentication </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank"><u>T1556.006</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 14: Privilege Escalation </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Valid Accounts </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1078/" target="_blank"><u>T1078</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This actor has used commercial datasets to acquire account credentials and gain unauthorized privileged access to accounts.  </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 15: Stealth </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: Command Obfuscation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/010/" target="_blank"><u>T1027.010</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated JavaScript payload sent to targets to exploit the XSS vulnerability. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: Encrypted/Encoded File </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/013/" target="_blank"><u>T1027.013</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The JavaScript payload included both a Base64-encoded and XOR-encrypted inner payload. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Obfuscated Files or Information: SVG Smuggling </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1027/017/" target="_blank"><u>T1027.017</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The payload was contained in an “onload” attribute within an SVG image included in the malicious email. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Use Alternate Authentication Material: Web Session Cookie </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1550/004/" target="_blank"><u>T1550.004</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previous campaigns using AiTM leveraged stealing and use of a victim’s session cookies to authenticate. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 16: Credential Access </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Modify Authentication Process: Multi-Factor Authentication </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1556/006/" target="_blank"><u>T1556.006</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Creating Application Passcodes to bypass 2FA and stealing a user’s “Scratch Keys,” which can be used in place of a 2FA token. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Adversary-in-the-Middle </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1557/" target="_blank"><u>T1557</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Previous campaigns used Evilginx2 as an AiTM toolkit to intercept credentials and session cookies. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 17: Collection </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Data Staged: Remote Data Staging </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1074/002/" target="_blank"><u>T1074.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltrated data was sent to an actor-controlled VPS prior to assumed long-term storage solutions. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Email Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1114/" target="_blank"><u>T1114</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>This group has emphasized collection of emails. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Email Collection: Remote Email Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1114/002/" target="_blank"><u>T1114.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Emails are collected via API calls to the ZCS mail server and are not collected from emails stored directly on the victim’s device. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Automated Collection </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1119/" target="_blank"><u>T1119</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Upon execution, the JavaScript payload automatically collects all relevant information in stages. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Browser Session Hijacking </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1185/" target="_blank"><u>T1185</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>The JavaScript payload leverages the user’s authenticated browser session to make API requests as the user. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Archive Collected Data </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1560/" target="_blank"><u>T1560</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Emails are exfiltrated with GZIP compression. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<p><a class="ck-anchor"></a></p>
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 18: Discovery </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Account Discovery </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1087/" target="_blank"><u>T1087</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Stolen Global Access Lists provide the group with new users to target. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p><a class="ck-anchor"></a></p>
</div>
</div>
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<div class="TableContainer Ltr SCXW76044448 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 19: Exfiltration </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Technique Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p class="text-align-center"><strong>Use</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/" target="_blank"><u>T1048</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Victim information was exfiltrated over both HTTPS and DNS. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/002/" target="_blank"><u>T1048.002</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Some payloads, especially ones with large amounts of data, were exfiltrated over HTTPS. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p><a href="https://attack.mitre.org/versions/v19/techniques/T1048/003/" target="_blank"><u>T1048.003</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW76044448 BCX8">
<div class="OutlineElement Ltr SCXW76044448 BCX8">
<p>Some smaller bandwidth payloads were exfiltrated over DNS using Base32 encoding. </p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<h2><strong>Appendix B: MITRE D3FEND countermeasures </strong><a class="ck-anchor"></a></h2>
<p>See <a href="https://www.cisa.gov/#table20"><strong>Table 20</strong></a> for a mapping of several of the cybersecurity countermeasures mentioned in this advisory. <a class="ck-anchor"></a></p>
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<div class="TableContainer Ltr SCXW46665017 BCX8">
<table dir="ltr" class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em><strong>Table 20: MITRE D3FEND Countermeasures </strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>Countermeasure Title</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>ID</strong> </p>
</div>
</div>
</th>
<th role="columnheader">
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p class="text-align-center"><strong>Description</strong> </p>
</div>
</div>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Application Hardening </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:ApplicationHardening" target="_blank"><u>D3-AH</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should immediately prioritize patching <a href="https://www.cve.org/CVERecord?id=CVE-2025-66376" target="_blank"><u>CVE-2025-66376</u></a>.  </li>
<li>Organizations should promptly apply software updates to all email systems. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Isolate </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/tactic/d3f:Isolate/" target="_blank"><u>d3f:Isolate</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations that cannot feasibly patch should use alternative mail clients. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Credential Hardening </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank"><u>D3-CH</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should consider using a third-party authentication service that supports passkeys to mediate access to ZCS and other services that do not natively support passkeys. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Network Traffic Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis" target="_blank"><u>D3-NTA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should monitor for significant amounts of outbound data being sent to IPs associated with VPS providers not used by the organization. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>DNS Traffic Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:DNSTrafficAnalysis" target="_blank"><u>D3-DNSTA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should monitor for frequent DNS queries to a suspicious domain for seemingly random subdomains. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Network Traffic Community Deviation </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficCommunityDeviation" target="_blank"><u>D3-NTCD</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should monitor for a sudden spike of connections to a server associated with a recently established domain. </li>
<li>Organizations should monitor for connections to internal services, such as webmail, from VPN providers. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Identifier Activity Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:IdentifierActivityAnalysis" target="_blank"><u>D3-IAA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Organizations should search for the listed known IOCs. </p>
</div>
</div>
</td>
</tr>
<tr>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p>Process Analysis </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="OutlineElement Ltr SCXW46665017 BCX8">
<p><a href="https://d3fend.mitre.org/technique/d3f:ProcessAnalysis" target="_blank"><u>D3-PA</u></a> </p>
</div>
</div>
</td>
<td>
<div class="TableCellContent SCXW46665017 BCX8">
<div class="ListContainerWrapper SCXW46665017 BCX8">
<ul type="disc">
<li>Organizations should search ZCS log files for specific commands used by the malicious script. </li>
<li>Organizations should search the localStorage property in web browsers for the ZCS webmail client for “ZimbraWeb” Application Passcodes. </li>
</ul>
</div>
</div>
</td>
</tr>
<tr>
<td>Message Analysis</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:MessageAnalysis">D3-MA</a></td>
<td>Organizations that suspect they have victims of this campaign should search for emails with a malicious payload to identify other victims.</td>
</tr>
</tbody>
</table>
</div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[18 Enterprise-Architecture-Tools]]></title>
<description><![CDATA[Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. 
					Foto: I Believe I Can Fly – shutterstock.com




Enterprise Architecture (EA) Tools unterstützen Unternehmen und Organisationen dabei, mit ihren IT-Strategien die Geschäftszie...]]></description>
<link>https://tsecurity.de/de/3694429/it-security-nachrichten/18-enterprise-architecture-tools/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694429/it-security-nachrichten/18-enterprise-architecture-tools/</guid>
<pubDate>Sat, 25 Jul 2026 18:59:25 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<div class="extendedBlock-wrapper block-coreImage"><figure class="wp-block-image size-large"><img loading="lazy" alt="Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. " title="Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. " src="https://images.computerwoche.de/bdb/3284195/840x473.jpg" width="840" height="473"><figcaption class="wp-element-caption"><p class="foundryImageCaption">Diese Enterprise Architecture Tools unterstützen Sie nicht nur bei der digitalen Transformation Ihres Unternehmens. </p></figcaption></figure><p class="imageCredit">
					Foto: I Believe I Can Fly – shutterstock.com</p></div>




<p class="wp-block-paragraph"><a href="https://www.computerwoche.de/article/2789207/eam-gibt-orientierung-in-der-digitalen-transformation.html" title="Enterprise Architecture" target="_blank">Enterprise Architecture</a> (EA) Tools unterstützen Unternehmen und Organisationen dabei, mit ihren IT-Strategien die Geschäftsziele optimal zu unterstützen. Sie sorgen ebenfalls dafür, dass Unternehmen ihre Roadmaps für die <a href="https://www.computerwoche.de/article/2794425/wie-digitale-transformation-richtig-geht.html" title="digitale Transformation" target="_blank">digitale Transformation</a> geordnet vorantreiben können. EA Tools bieten dafür unter anderem Collaboration-, Reporting-, Testing- und Simulationsfunktionen. Mit deren Hilfe lassen sich Modelle implementieren, die Geschäfts- und IT-Prozesse gezielt verbessern.</p>



<p class="wp-block-paragraph">Um die beste Lösung für Ihr Unternehmen zu finden, sollten Sie zuerst prüfen, ob sich das jeweilige Tool mit Ihrem Technologie-Stack integrieren lässt. Anschließend gilt es abzuwägen, ob die Informationen, Diagramme und Tabellen, die die Software zur Verfügung stellt, für das Unternehmen auch einen echten Nutzwert haben.</p>



<h2 class="wp-block-heading">Empfehlenswerte Enterprise-Architecture-Tools</h2>



<p class="wp-block-paragraph">Nachfolgend finden Sie einen Überblick über die wichtigsten Enterprise-Architecture-Tools – in alphabetischer Reihenfolge. Sie stellen einen Mix aus Visualisierungs-, Collaboration- und Project-Management-Funktionen bereit und unterstützen eine Vielzahl von Enterprise Architecture Frameworks.</p>



<p class="wp-block-paragraph"><strong><a href="https://www.ardoq.com/" title="Ardoq" target="_blank" rel="noopener">Ardoq</a></strong></p>



<p class="wp-block-paragraph">Nachdem zuerst über einfache Formulare Informationen von Usern, Entwicklern und sonstigen Stakeholdern im Unternehmen eingesammelt wurden, lässt sich mithilfe von Ardoq ein digitaler Zwilling der gesamten Organisation erstellen. Der Ansatz setzt also darauf, die Menschen, die in ihren Rollen mit den verschiedensten Systemen arbeiten, realistisch in ihrer Arbeitswelt abzubilden.</p>



<p class="wp-block-paragraph">Jede Mitarbeiterin und jeder Mitarbeiter im Unternehmen kann später von den Netzwerkvisualisierungen und Datenfluss-Diagrammen profitieren, um seine eigene Rolle optimal zu unterstützen und den Arbeitsplatz immer wieder anzupassen und zu modernisieren. Das Tool lässt sich mit den wichtigsten Cloud-Plattformen integrieren. Es bietet eine API, die individuelle Anpassungen in allen wichtigen Programmiersprachen (Python, C#, Java, etc.) ermöglicht.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>“Architektonischen Stress” bei Lastspitzen simulieren, falls größere Veränderungen bevorstehen;</p></li>



<li><p>Verstehen, wie verändertes Nutzerverhalten neue Anforderungen generiert;</p></li>



<li><p>Application Portfolio Management, um besser strategisch zu planen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://atollgroup.eu/samu-enterprise-architecture-tool/" title="Atoll Group SAMU" target="_blank" rel="noopener">Atoll Group SAMU</a></strong></p>



<p class="wp-block-paragraph">Das EA-Tool SAMU macht die Enterprise Architecture sichtbar, indem es tiefe Verknüpfungen zwischen On-Premises-Systemen, dem Cloud-Layer und Tools für das Business Process Management aufzeigt. Das Tool der Atoll Group bietet vielfältige Integrationsmöglichkeiten, zum Beispiel mit Monitoring-Tools (etwa Tivoli, ServiceNow), Configuration-Management-Datenbanken (zum Beispiel CA, BMC) oder Service-Organisations-Tools (BMC, HPE). Alle Informationen fließen in ein zentrales Datenmodell ein, das um den zusätzlichen Input der Stakeholder weiter angereichert wird.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Enterprise-Architektur visualisieren;</p></li>



<li><p>strategische Planungsprozesse und Architektur-Reviews mit Informationen unterfüttern;</p></li>



<li><p>mithilfe einer visuellen Verständnisgrundlage die Kommunikation verbessern.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.avolutionsoftware.com/enterprise-architecture/" title="Avolution Abacus" target="_blank" rel="noopener">Avolution Abacus</a></strong></p>



<p class="wp-block-paragraph">Dieses Tool erfasst die Breite und den Umfang der Unternehmensarchitektur mit Hilfe eines auf Diagrammen basierenden Dashboards. Die Integration mit gängigen Tools wie SharePoint, <a href="https://www.computerwoche.de/k/excel,3461" target="_blank" class="idgGlossaryLink">Excel</a>, Visio, Google Sheets, Technopedia oder ServiceNow vereinfacht die Nutzung. Abacus wurde inzwischen auch um einen Machine-Learning-Layer ergänzt, der es Anwendern ermöglicht, ein Modell zu trainieren, das ihnen beispielsweise hilft zu erkennen, wer im Unternehmen für welches System verantwortlich ist.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>die IT für das gesamte Unternehmen “öffnen”, um ein allgemeines Verständnis der Datenflüsse zu erzeugen;</p></li>



<li><p>umfassendes Enterprise Modeling, um eine Roadmap für künftige Entwicklungen zu erstellen;</p></li>



<li><p>Business-Metriken tracken, die mit der Unternehmens-Performance zusammenhängen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.boc-group.com/de/adoit/" title="BOC Group ADOIT" target="_blank" rel="noopener">BOC Group ADOIT</a></strong></p>



<p class="wp-block-paragraph">ADOIT soll Teams dabei unterstützen, Ressourcen zu verwalten, Bedarfe vorherzusagen und Assets zu tracken. Dazu mappt das Tool jedes System oder Softwarepaket mit einem Objekt. Die Datenflüsse zwischen den Systemen werden in Beziehungen umgewandelt, die von diesen Objekten mithilfe eines anpassbaren Metamodells erfasst werden. Geschäftsprozesse können auf ähnliche Weise über ein gut integriertes Begleitprodukt namens ADONIS modelliert werden. ADOIT ist Web-basiert und lässt sich auch mit Tools wie Atlassian Confluence integrieren, um die Datenerfassung und -entwicklung zu beschleunigen.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>ein unternehmensweites Modell erstellen, das bei sämtlichen Teammitgliedern ein Verständnis über den Stack schafft – und wie man diesen verbessern kann;</p></li>



<li><p>vollständiger Zugriff auf EA-Daten über eine Mobile-Anwendung;</p></li>



<li><p>bei Fusionen und Übernahmen den Tech-Bereich durch genaues Asset-Mapping orchestrieren.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a title="Mega Hopex" href="https://www.mega.com/hopex-platform" target="_blank" rel="noopener">Bizzdesign Hopex</a></strong></p>



<p class="wp-block-paragraph">Nach der Übernahme von Mega International zählt die Hopex-Plattform zum Portfolio von Bizzdesign. Sie soll dabei unterstützen, Unternehmensanwendungen zu modellieren und dabei ein Verständnis der von ihnen unterstützten Geschäfts-Workflows schaffen. Dabei liegt ein Schwerpunkt auf den Bereichen Data Governance und Risikomanagement. Hopex basiert auf Microsoft <a class="idgGlossaryLink" href="https://www.computerwoche.de/article/2732704/microsoft-azure-mit-der-deutschen-cloud-zu-neuen-geldquellen.html" target="_blank">Azure</a> und stützt sich auf eine Reihe offener Standards wie GraphQL und REST Queries, um Informationen aus Komponentensystemen zu sammeln. Das Reporting ist mit den Office-Tools von Microsoft sowie mit grafischen Lösungen wie Tableau und Qlik integriert.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>datengestützte Erkenntnisse herbeiführen, um Cloud- und Anwendungsbereitstellung zu steuern;</p></li>



<li><p>akkurate Nutzungsmodelle erstellen, um Architekturanforderungen zu verstehen;</p></li>



<li><p>eine Bedarfsschätzung mit Umfragen und anderen Tools vornehmen, um für die Zukunft zu planen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://bizzdesign.com/transformation-suite/horizzon" target="_blank" rel="noreferrer noopener">Bizzdesign Horizzon</a></strong></p>



<p class="wp-block-paragraph">Das Tool dient dazu, Business Workflows und den zugrundeliegenden Tech-Stack zu modellieren. Dazu bietet Horizzon ein Graph-basiertes Modell, das Daten von sämtlichen Stakeholdern einsammelt und diese an eine Analytics-Engine weitergibt. Im Ergebnis entstehen Diagramme, die den aktuellen Systemzustand widerspiegeln. Wichtige Schwerpunkte dieses Tools sind <a class="idgGlossaryLink" href="https://www.computerwoche.de/article/2777492/was-sie-ueber-change-management-wissen-muessen.html" target="_blank">Change Management</a> und Zukunftsplanung: Horizzon ist nicht zuletzt dafür konzipiert worden, die Risiken eines Redesigns zu minimieren. Das Toolset unterstützt die wichtigsten Frameworks ArchiMate, TOGAF und BPMN. Neben Mega hat Bizzdesign <a href="https://bizzdesign.com/press-releases/bizzdesign-adds-alfabet-business-following-successful-closing-mega-international" target="_blank" rel="noreferrer noopener">im Januar 2025</a> auch den EA-Geschäftsbereich der Software AG – Alfabet – übernommen.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Vorhersage zukünftiger Anforderungen durch Predictive Modeling;</p></li>



<li><p>Orchestrieren von Workflows auf der Basis der technischen und der Business-Architektur;</p></li>



<li><p>Antizipieren von Risiken sowie Security- und Governance-Problemen durch die Modellierung von Datensicherheitsanforderungen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.capstera.com/" target="_blank" rel="noreferrer noopener">Capstera</a></strong></p>



<p class="wp-block-paragraph">Das Tool von Capstera fokussiert darauf, die Business Architecture selbst abzubilden. Value und Process Maps helfen dabei, die Rollen der verschiedenen Unternehmensbereiche zu definieren und nachzuverfolgen. Dabei können im laufenden Prozess Verknüpfungen mit den zugrundeliegenden Softwarprodukten und Tools hinzugefügt werden.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Reports erstellen, die sich erst einmal mit der Business-Architektur selbst beschäftigen;</p></li>



<li><p>Beziehungen zwischen Menschen, Abteilungen und Rollen analysieren;</p></li>



<li><p>die langfristige strategische Planung vorantreiben.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.bee360.com/de/" title="Clausmark Bee360" target="_blank" rel="noopener">Clausmark Bee360</a></strong></p>



<p class="wp-block-paragraph">Teammitglieder, die Clausmarks Flaggschiffprodukt Bee360 (früher Bee4IT) verwenden, wollen eine einfache “Single Source of Truth” über die Workflows im Unternehmen. Ziel ist es, verschiedenen betrieblichen Rollen intelligentere Entscheidungen zu ermöglichen. Das Modul Bee360 FM (Finanzmanagement) bietet etwa die Möglichkeit, Kosten nachzuvollziehen und zuzuordnen. Die Anwender können verschiedene solcher Module miteinander verknüpfen, um EAM, Finanzmanagement, Portfolio Management und Agile Planning nahtlos zu integrieren – bei maximaler Transparenz. </p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>C-Suite-Ebene befähigen, Projekte zu managen und Assets zuzuweisen;</p></li>



<li><p>präzise digitale Zwillinge entwickeln, um ein Verständnis über Datenflüsse zu schaffen und künftige Erweiterungen zu planen;</p></li>



<li><p>integrierte Wissensdatenbank aufbauen, um alle digitalen Workflows zu tracken.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.enterprise-architecture.com/" title="EAS" target="_blank" rel="noopener">EAS</a></strong></p>



<p class="wp-block-paragraph">Das Essential-Paket von EAS (Enterprise Architecture Solutions) nahm als <a href="https://www.computerwoche.de/k/linux-open-source,3472" target="_blank" class="idgGlossaryLink">Open-Source</a>-Projekt seinen Anfang und hat sich inzwischen zu einer kommerziell verfügbaren Cloud-Lösung weiterentwickelt. Das Tool erstellt ein Metamodell, das die Interaktionen zwischen Systemen und Geschäftsprozessen beschreibt. Ebenfalls enthalten sind Pakete, um gängige Business Workflows wie Datenmanagement oder DSGVO-Compliance zu tracken.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>den technischen Reifegrad der eigenen Architektur evaluieren;</p></li>



<li><p>Sicherheit und Governance durch besseres Asset Tracking optimieren;</p></li>



<li><p>wachsende Systemkomplexität kontrollieren und managen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a title="Orbus Software iServer" href="https://www.orbussoftware.com/" target="_blank" rel="noopener">OrbusInfinity</a></strong></p>



<p class="wp-block-paragraph">Orbus Software hat Anfang 2025 die Akquisition seines Konkurrenten Capsifi <a href="https://www.orbussoftware.com/landing-pages/events/webinars/unlocking-the-future-orbus-acquires-capsifi-a-new-era-of-innovation-partnership-apac" target="_blank" rel="noreferrer noopener">abgeschlossen</a>. Der Anbieter stellt mit OrbusInfinity eine Enterprise-Transformation-Plattform auf KI-Basis zur Verfügung,  die schnellere, bessere Entscheidungen, Kosteinesparungen und Risikominimierung verspricht. Architecture-Teams sollen mit Hifle von OrbusInfinity mit einer Vielzahl von Stakeholdern interagieren können, um eine “digitale Blaupause” ihres Unternehmens zu generieren, die eine einheitliche Sicht auf das aktuelle und künftige Geschäft realisieren soll. Diverse Drittanbieter-Tools lassen sich außerdem mit der Plattform <a href="https://www.orbussoftware.com/product/integrations" target="_blank" rel="noreferrer noopener">integrieren</a>, darunter etwa von Microsoft, Flexera, ManageEngine oder ServiceNow. </p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Stakeholder-Management;</p></li>



<li><p>Enterprise-Landschaften visualisieren;</p></li>



<li><p>Entscheidungsfindung und Datenanalyse automatisieren.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.planview.com/de/" title="Planview Enterprise One" target="_blank" rel="noopener">Planview Enterprise One</a></strong></p>



<p class="wp-block-paragraph">Planview bietet eine ganze Reihe von Produkten, mit denen Unternehmen Teamwork, Prozesse und die Enterprise Architecture nachvollziehen können. Die Enterprise Tools sind in drei Kategorien unterteilt: strategisches Portfolio-Management, Produktportfolio-Management und Projektportfolio-Management. Im Zusammenspiel entstehen hardware- und Software-übergreifende Layer, die rollenbasierte Perspektiven für Führungskräfte und Teammitglieder eröffnen. Das Toolset integriert mit gängigen Ticket-Tracking-Systemen wie Jira, um Workflow-Analysen und Reports zu erstellen. Inzwischen hat Planview nach einer Übernahme neue Tools in sein Portfolio integriert, die früher unter den Namen Daptiv, Barometer und Projectplace bekannt waren.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>eine langfristige, strategische Vision für die Architekturentwicklung aufbauen;</p></li>



<li><p>Entwicklungsarbeit auf Projektebene tracken und in eine beliebige Strategie integrieren;</p></li>



<li><p>mit Fokus auf die Customer Experience und die Produktstruktur den Change vorantreiben.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.qualiware.com/" title="QualiWare Enterprise Architecture" target="_blank" rel="noopener">QualiWare Enterprise Architecture</a></strong></p>



<p class="wp-block-paragraph">Das Enterprise Architecture Tool von QualiWare ist Teil einer größeren Sammlung von Modellierungswerkzeugen, die darauf abzielt, sämtliche Geschäftsprozesse zu erfassen. Beispielsweise ist es möglich, einen digitalen Zwillinge zu bauen, mit dem sich Customer Journeys nachvollziehen lassen. Qualiware hat diverse KI-Algorithmen integriert, um Dokumentation und Process Discovery zu optimieren.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>ein kollaboratives Ökosystem für Business Manager aufbauen, das ein Verständnis von der Enterprise Architecture vermittelt;</p></li>



<li><p>architektonische Designelemente erfassen, um ein Wissens-Ökosystem rund um den Stack aufzubauen;</p></li>



<li><p>eine breite Beteiligung in Sachen Dokumentationserstellung und -überprüfung fördern.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.erwin.com/de-de/products/erwin-evolve/" title="Quest Erwin Evolve" target="_blank" rel="noopener">Quest Erwin Evolve</a></strong></p>



<p class="wp-block-paragraph">Das Erwin Evolve Tool von Quest hat sich von einem Datenmodellierungs-Tool zu einem System für Enterprise-Architecture- und Geschäftsprozess-Modellierung weiterentwickelt. Um die Komplexität moderner, ineinandergreifender Softwaresysteme und der von ihnen gemanagten Geschäftsprozesse zu durchdringen, können Anwender auf benutzerdefinierte Datenstrukturen zurückgreifen. Das Web-Tool erstellt Modelle, rollenbasierte Diagramme und andere Visualisierungen, die in allgemein zugängliche Dashboards einfließen. Zum Paket gehört ein KI-basiertes Modellierungs-Tool, das Whiteboard-Skizzen integrieren kann.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>einen digitalen Zwilling für die strategische Modellierung der Enterprise Data Architecture erstellen;</p></li>



<li><p>Customer Journeys verstehen;</p></li>



<li><p>Services und Systeme mit Application Portfolio Management tracken.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a title="LeanIX Enterprise Architecture Suite" href="https://www.leanix.net/de/produkte/enterprise-architecture-management" target="_blank" rel="noopener">SAP LeanIX Enterprise Architecture Suite</a></strong></p>



<p class="wp-block-paragraph">Die Tool-Sammlung von LeanIX umfasst unter anderem Enterprise Architecture Management und andere Bereiche, die für Aufgaben wie <a class="idgGlossaryLink" href="https://www.computerwoche.de/k/cloud-computing,3454" target="_blank">SaaS</a>– und Value-Stream-Management wichtig sind – etwa um Cloud-Deployments und darauf laufende Services zu tracken. Die Daten die dabei über die IT-Infrastruktur gesammelt werden, fließen in ein grafisches Dashboard ein. Das Tool ist eng mit wichtigen Cloud-Workflow-Tools wie Confluence, Jira, Signavio und Lucidchart integriert. Das ist für Teams von Vorteil, die diese Tools bereits nutzen, um ihre Entwicklungsstrategien zu planen und umzusetzen. Seit November 2023 <a href="https://www.leanix.net/de/unternehmen/pressemeldungen/leanix-gehoert-jetzt-zu-sap">ist LeanIX Teil von SAP</a>.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Anwendungsmodernisierung und Cloud-Migration managen;</p></li>



<li><p>Obsoleszenz von Software-Services evaluieren;</p></li>



<li><p>Kosten kontrollieren und managen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.servicenow.com/de/" title="ServiceNow" target="_blank" rel="noopener">ServiceNow</a></strong></p>



<p class="wp-block-paragraph">Die Tool-Sammlung von ServiceNow lässt sich auf verschiedene Architekturtypen herunterbrechen, darunter Assets, <a href="https://www.computerwoche.de/article/2785626/wie-devops-die-it-beschleunigen.html" target="_blank" class="idgGlossaryLink">DevOps</a>, Security und Service. Die Tools katalogisieren die unterschiedlichen Hardware- und Softwareplattformen, um Workflows und Datenflüsse im Unternehmen abzubilden und zu verstehen. Ausführliche Reportings und detaillierte Dashboards ermöglichen Analysen, auf deren Grundlage Risiken minimiert und die Ausfallsicherheit der Systeme erhöht werden können.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Tracken von Assets, Services und Systemen, die das Unternehmen ausmachen;</p></li>



<li><p>Governance-Themen, Risikobegrenzung, IT-Management und Security Operations werden in einer Plattform zusammengeführt;</p></li>



<li><p>durch die Integration von CRM-Tools lassen sich auch kundenorientierte Services managen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://sparxsystems.com/products/ea/" title="Sparx Systems" target="_blank" rel="noopener">Sparx Systems</a></strong></p>



<p class="wp-block-paragraph">Um Teams und Projekte verschiedener Größe und Komplexität zu unterstützen, hat Sparx vier Versionen seines EA-Tools entwickelt. Allen gemeinsam ist eine UML-basierte Modellierung, mit der sich die Komponenten komplexer Systeme tracken lassen. Eine Simulations-Engine ermöglicht “War Gaming” und vermittelt ein Verständnis darüber, wie sich Fehler ausbreiten und kaskadieren können. Sparx stellt zudem eine Vielzahl von vorgefertigten Design Patterns bereit, um Teams bei der Modellierung zu unterstützen.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Nachfrage- und Lastveränderungen zur Prognose künftiger Anforderungen simulieren;</p></li>



<li><p>(potenzielle) Probleme durch eine Verbindungs-Matrix im Auge behalten;</p></li>



<li><p>Dokumentation erstellen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.teamblue.unicomsi.com/products/system-architect/" title="Unicom System Architect" target="_blank" rel="noopener">Unicom System Architect</a></strong></p>



<p class="wp-block-paragraph">System Architect ist eines der Angebote aus Unicoms Team Blue. Es handelt sich um ein Tool, das ein Metamodell verwendet, um automatisiert so viele Daten wie möglich über die laufenden Systeme zu sammeln – manchmal auch durch ein Reverse Engineering von Datenflüssen. Dieses systemweite Datenmodell kann über benutzerdefinierte Dashboards Teammitgliedern aller Rollen zugänglich gemacht werden. Ein weiteres erwähnenswertes Feature: Die Ressourcenzuweisung lässt sich mit Hilfe von Simulationen optimieren.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>Was-wäre-wenn-Fragen zum Architekturmodell stellen;</p></li>



<li><p>ein Metamodell von Daten und Systemen aufbauen;</p></li>



<li><p>Migrations- und Transformationspläne erstellen.</p></li>
</ul>



<p class="wp-block-paragraph"><strong><a href="https://www.valueblue.com/bluedolphin" title="ValueBlue BlueDolphin" target="_blank" rel="noopener">ValueBlue BlueDolphin</a></strong></p>



<p class="wp-block-paragraph">Dieses EA-Tool sammelt Daten auf dreierlei Art:</p>



<ol class="wp-block-list">
<li><p>Es importiert Basisdaten auf der Grundlage standardgesteuerter Automatisierung (ITSM, SAM).</p></li>



<li><p>Es arbeitet mit den Dateiformaten von Architekten und Systemdesignern – etwa ArchiMate oder BPMN.</p></li>



<li><p>Es gibt Fragebögen an andere Stakeholder heraus, die auf anpassbaren Vorlagen basieren.</p></li>
</ol>



<p class="wp-block-paragraph">Die aufbereiteten Informationen werden in einer visuellen Umgebung bereitgestellt, die Auskunft über die historische Entwicklung von Systemen gibt.</p>



<p class="wp-block-paragraph"><em>Wichtigste Use Cases:</em></p>



<ul class="wp-block-list">
<li><p>systemweite Daten von internen und externen Stakeholdern automatisiert und formularbasiert erfassen;</p></li>



<li><p>zukunftsorientierte Reportings erzeugen, um den Change zu überwachen und voranzutreiben;</p></li>



<li><p>Kooperation und Zusammenarbeit durch offenes Data Reporting fördern.</p></li>
</ul>



<p class="wp-block-paragraph">(fm)</p>



<p class="wp-block-paragraph"><strong>Dieser Artikel ist <a href="https://www.cio.com/article/196069/top-enterprise-architecture-tools.html" target="_blank">im Original</a> bei unserer Schwesterpublikation CIO.com erschienen. </strong></p>
</div></div></div>
</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Sovereign AI has become the public-sector CIO’s control problem]]></title>
<description><![CDATA[In public-sector and regulated-cloud work, I learned that sovereignty rarely starts as a national strategy. It starts as an auditor’s question: Who can prove where the data went, which system made the decision and what changes when the vendor or infrastructure does? That question is now moving in...]]></description>
<link>https://tsecurity.de/de/3694400/it-security-nachrichten/sovereign-ai-has-become-the-public-sector-cios-control-problem/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694400/it-security-nachrichten/sovereign-ai-has-become-the-public-sector-cios-control-problem/</guid>
<pubDate>Sat, 25 Jul 2026 18:57:42 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">In public-sector and regulated-cloud work, I learned that sovereignty rarely starts as a national strategy. It starts as an auditor’s question: Who can prove where the data went, which system made the decision and what changes when the vendor or infrastructure does? That question is now moving into AI, and most sovereign-AI debates answer the wrong version of it.</p>



<p class="wp-block-paragraph">They ask whether a country can build its own model on domestic data and hardware. For the United States and China, which together hold more than 90% of global AI data-center capacity, per a <a href="https://institute.global/insights/tech-and-digitalisation/sovereignty-in-the-age-of-ai-strategic-choices-structural-dependencies">January 2026 Tony Blair Institute analysis</a>, that question is worth asking. However, for almost every other government, it is the wrong place to start. The operative question is narrower: Once AI is embedded in public services, who controls the stack?</p>



<h2 class="wp-block-heading">The 5 layers of public-sector control</h2>



<p class="wp-block-paragraph">For a CIO, sovereign AI means enforceable control across the AI lifecycle; model ownership is a separate question. Control has five layers:</p>



<ul class="wp-block-list">
<li><strong>Data control:</strong> Where sensitive public data sits, and whether it can train a vendor’s model.</li>



<li><strong>Model control:</strong> Which models clear which workloads, and under what validation.</li>



<li><strong>Infrastructure control:</strong> Whether critical workloads run in approved environments.</li>



<li><strong>Operational control:</strong> Whether AI-assisted actions are logged, monitored and reversible.</li>



<li><strong>Vendor control:</strong> Whether the agency keeps portability, audit rights and a real exit.</li>
</ul>



<p class="wp-block-paragraph">Those five layers are the control plane for public-service AI. Floyd Dcosta recently made the enterprise case in “<a href="https://www.cio.com/article/4147102/ai-without-sovereignty-is-just-outsourced-intelligence.html">AI without sovereignty is just outsourced intelligence</a>”: capability is what a tool can do; authority over how and when it does it is something a buyer can quietly lose. For public services, losing that authority plays out in the public eye.</p>



<p class="wp-block-paragraph">Public-sector AI risk differs from enterprise risk. A retailer’s bad recommendation costs a sale; a government’s AI touches benefits, tax enforcement, policing and emergency response, raising the bar to due process, records retention and continuity of operations. A government that cannot reconstruct an AI-assisted decision lacks operational sovereignty, even in a domestic data center.</p>



<h2 class="wp-block-heading">Evaluating risk: Concentration, jurisdiction and shadow AI</h2>



<p class="wp-block-paragraph">Foreign dependency is a real risk, but the exposure that matters is a sudden cutoff: A model you cannot audit, switch or exit, shut off by someone else’s order. A vendor’s nationality is a poor guide to that risk; control is.  Two markers matter. The first is concentration. In July 2024, a single faulty CrowdStrike update <a href="https://www.cisa.gov/news-events/alerts/2024/07/19/widespread-it-outage-due-crowdstrike-update">crashed about 8.5 million Windows machines</a>, disrupting airlines, hospitals, banks and governments worldwide. No attacker was involved; one homogeneous dependency failed everywhere at once. The lesson points away from vendor nationality and toward uniformity as the fault line, making portability and provider diversity resilience controls.</p>



<p class="wp-block-paragraph">The second is jurisdiction. In June 2025, Microsoft’s legal director for France <a href="https://www.sdxcentral.com/news/microsoft-tells-french-lawmakers-it-cant-protect-user-data-from-us-demands/">told a Senate inquiry, under oath</a>, that it could not guarantee that French public-sector data, even in French data centers, would be protected against US demands under the 2018 CLOUD Act. No such request had been made, and EU data has stayed in the EU since January 2025; senators called the assurance purely declarative. For the most sensitive data, residency does not equal control; the parent’s jurisdiction can matter as much as the server’s. Three US hyperscalers hold <a href="https://www.srgresearch.com/articles/european-cloud-providers-local-market-share-now-holds-steady-at-15">about 70% of the European cloud market</a>, while European providers’ share fell from 29% in 2017 to roughly 15%. Concentration plus jurisdiction is the exposure a CIO must price. I have watched teams treat vendor selection as the moment risk was solved; it rarely was.</p>



<p class="wp-block-paragraph">The wrong response is self-isolation. Most countries will never build frontier models, advanced chips, hyperscale clouds and talent pipelines at once; the Tony Blair Institute calls full self-sufficiency “too expensive, too slow and, for most countries, simply impossible.” The better test is workload sensitivity. Low-risk uses, such as drafting, translation and summarization, can run on commercial platforms with controls; high-risk uses, such as benefits eligibility, fraud investigation and healthcare triage, demand stricter control over data, model behavior and auditability.</p>



<p class="wp-block-paragraph">Mandating domestic-only provision before a competitive option exists inverts sovereignty. <a href="https://europe2031.ai/summary">Europe 2031</a>, a five-year scenario from June 2026 by European technologists and policy researchers, illustrates the failure mode: A 2027 “buy European” mandate lands as offensive cyber capability spreads, and agencies that switched to weaker providers are locked out and paying ransoms. The scenario is fiction; the mechanism is not. Leverage comes from being indispensable, not half-hearted self-sufficiency. The closer-to-home effect is shadow AI: Mandate an inferior sanctioned tool and staff bypass it, the way shadow IT grows up around tools people find too slow. A rule that pushes sensitive work into ungoverned shadow AI reduces control instead of adding it.</p>



<p class="wp-block-paragraph">Regulation and data-residency rules belong in any serious strategy, but carry failure modes. Blanket localization raises hosting costs and slows adoption without guaranteeing control, and a “sovereign cloud” on a foreign parent’s stack can amount to sovereignty theater. The more useful pattern tiers requirements by sensitivity. India’s BHASHINI shows the application layer done well: A public platform <a href="https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2093333&amp;reg=3&amp;lang=2">serving 100 million-plus inferences a month across 22-plus languages</a> on a vendor- and cloud-agnostic design that keeps data and switching rights public. Sovereignty resides in the portability, not in a national model.</p>



<h2 class="wp-block-heading">Building an operational sovereignty strategy</h2>



<p class="wp-block-paragraph">Public trust is the constraint sovereignty rhetoric tends to skip. The OECD’s <a href="https://www.oecd.org/en/publications/governing-with-artificial-intelligence_795de142-en.html">2025 review of government AI</a> warns that opaque systems make AI-assisted decisions hard to explain and can give public servants false confidence in tools that fail quietly. State-controlled AI is the same problem from the other side: A government that deploys models against its own citizens without audit or record has gained control and lost accountability. An agency that can log, explain and reverse an AI-assisted action can defend it to citizens, courts, auditors and elected officials. If it cannot, it has bought access and called it sovereignty.</p>



<p class="wp-block-paragraph">None of this is new. AI sovereignty repeats earlier fights over cloud, telecom, semiconductors and cybersecurity. Europe’s flagship cloud project, GAIA-X, became a cautionary tale; the Dutch technologist Bert Hubert called it an <a href="https://berthub.eu/articles/posts/gaia-x-is-an-expensive-distraction/">“expensive distraction”</a> that produced no European cloud, the familiar result of ambition without absorptive capacity. Cloud taught governments that outsourcing infrastructure does not outsource accountability; telecom, that vendor dependency becomes strategic exposure; chips, that supply chains matter before a crisis; cybersecurity, that trust must be verified continuously. AI inherits all four at once.</p>



<p class="wp-block-paragraph">Over the next five to ten years, some countries will build national platforms, more will build trusted cloud and trusted model regimes, and most will run hybrids that pair domestic data control with global model access. Trade policy will harden those choices: Export controls on compute and data-localization rules will pull the vendor market into blocs that track alliances more than open markets. For a CIO, that turns a vendor and hosting decision into a five-year bet on whose rules and supply chains will still hold. The ones that succeed will treat sovereignty as an operating requirement, backed by leverage, not a slogan. Start with the control plane before the model: Most agencies will never own the model, and the controls are what decide whether the AI they do run stays accountable. Even when procurement policy is dictated from above, these questions remain within the CIO’s authority:</p>



<ol start="1" class="wp-block-list">
<li>Can we classify AI workloads by public-service risk?</li>



<li>Can we prove where sensitive data goes across training, retrieval, inference, logging and retention?</li>



<li>Can we restrict which models are approved for which data classes and functions?</li>



<li>Can we reconstruct an AI-assisted action in enough detail to explain it?</li>



<li>Can we change providers without losing continuity or institutional knowledge?</li>



<li>Can we explain the system to citizens, regulators, auditors and elected officials?</li>
</ol>



<p class="wp-block-paragraph">A “no” to any of these does not mean the agency lacks AI. It means the agency has access it does not yet control. Public institutions can use global innovation without surrendering public authority, but only once they know what to hold, what to rent and where dependency turns into risk.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[The new value architecture of the AI-native SaaS era]]></title>
<description><![CDATA[The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.



In brief:




AI is transforming software as a service (SaaS), and the old ways of keeping score no longer apply.



Smart companies are evolving new metrics that provide deep...]]></description>
<link>https://tsecurity.de/de/3694395/it-security-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694395/it-security-nachrichten/the-new-value-architecture-of-the-ai-native-saas-era/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:51 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">The traditional methods of measuring success no longer tell the full story. Here’s what should replace them — and why.</p>



<p class="wp-block-paragraph">In brief:</p>



<ul class="wp-block-list">
<li><a href="https://www.cio.com/article/4146669/is-ai-the-end-of-saas-as-we-know-it.html">AI is transforming software as a service (SaaS)</a>, and the old ways of keeping score no longer apply.</li>



<li>Smart companies are evolving new metrics that provide deeper insight into how AI-native software is performing in a new marketplace.</li>



<li>These changes impact everything from pricing to valuations.</li>
</ul>



<p class="wp-block-paragraph">The transformation of the software-as-a-service (SaaS) industry toward AI-native operating companies is rapidly changing the unit of value across the industry.</p>



<p class="wp-block-paragraph">The traditional metric of seats — which measured access — is rapidly giving way to credits designed to measure work performed. This evolution is upending the industry in multiple ways, impacting everything from pricing to enterprise valuations.</p>



<p class="wp-block-paragraph">While many companies still cling to seat-based metrics to measure growth, efficiency and durability, the future is likely to be one in which companies utilize a <a href="https://www.cio.com/article/4184688/it-hurtles-toward-the-great-enterprise-pricing-reset.html">credit-centric metrics framework</a>, with seats and outcomes as the bookends of a spectrum.</p>



<h2 class="wp-block-heading">Why do software companies need new metrics?</h2>



<p class="wp-block-paragraph">Why the rethink, and why now? There are five major forces that are driving this shift:</p>



<ol start="1" class="wp-block-list">
<li><a href="https://www.idc.com/resource-center/blog/is-saas-dead-rethinking-the-future-of-software-in-the-age-of-ai/"><strong>The unit of value is changing</strong></a><strong>.</strong> Seats measured who could access software, and credits measure what the software actually does. But in an AI-native world, agents don’t have seats; they have workloads. Over the past 18 months, every major SaaS platform has moved to some forms of credit or consumption unit.</li>



<li><strong>The cost of goods sold (COGS) is exploding.</strong> AI inference adds real per-unit costs that scale with usage. In an AI-native world, software companies can’t scale to infinite users at near‑zero marginal cost as before.</li>



<li><strong>Buying is moving up the org chart.</strong> AI-native applications shift purchasing to higher-level operators — such as line-of-business leaders or chief operating officers — which expands the market from software budgets to labor budgets. And because AI agents replace services as well as software, the total market opportunity is 3x to 10x larger than traditional SaaS.</li>



<li><strong>Time to value (TTV) is collapsing.</strong> With AI-native tools, customers start seeing meaningful results in weeks rather than quarters. Onboarding and setup are fast, workflows are pre-built, and there’s no need for extensive customer success or professional services — dramatically reducing implementation time and costs.</li>



<li><strong>Retention is bifurcating.</strong> AI forces clarity in a way that traditional SaaS couldn’t. Products that can provide value become even “stickier” and retain customers. Those that don’t churn faster. In an AI-native marketplace, the middle disappears.</li>
</ol>



<h2 class="wp-block-heading">How this shift is impacting pricing</h2>



<p class="wp-block-paragraph"><a href="https://www.ey.com/en_us/insights/strategy/grow-with-trusted-software-portfolio-management">Given how AI-native software is transforming the market</a>, the shift to more variable pricing options is inevitable.</p>



<p class="wp-block-paragraph">Seats won’t go away completely. Subscription pricing based on the number of users is stable and predictable and will continue to work for some customers. Tokens — the use of pass-through pricing for underlying compute — will fit those customers where the AI feature is commoditized or the buyer wants transparency into costs.</p>



<p class="wp-block-paragraph">Credits will likely become the dominant architecture because they provide a simple metric for both customers and providers. The vendor sets the conversation ratio between credits and underlying compute, shielding the customer from inference cost details. Credits are easy to understand and can be packaged into annual contracts for multiple features and products.</p>



<p class="wp-block-paragraph">Finally, the industry will likely see <a href="https://www.gartner.com/en/newsroom/press-releases/2026-07-01-gartner-says-us-dollars-234-billion-in-enterprise-application-software-spend-is-at-risk-from-agentic-artificial-intelligence">some move toward outcome-based pricing</a> for results such as resolved tickets, recovered revenue or qualified leads. This strategy will mostly be limited to verticals where it is easy to prove AI impacted the result.</p>



<p class="wp-block-paragraph">Where a software vendor sits on this spectrum is a signal of differentiation and pricing power. Credits are where most defensible AI-native businesses are landing because they balance customer predictability with vendor margin control.</p>



<h2 class="wp-block-heading">How AI upends classic SaaS metrics</h2>



<p class="wp-block-paragraph">When SaaS was in its infancy, companies settled on key metrics designed to answer a small set of core questions. Are we growing? Are customers using the product? Are we retaining and expanding accounts?</p>



<p class="wp-block-paragraph">But as AI upends software itself, it is also requiring companies to adopt new metrics to track success. These new metrics fall into three primary buckets, rebuilt around the pricing spectrum described earlier and the trend toward credits as the primary frame:</p>



<h3 class="wp-block-heading">Revenue composition</h3>



<ul class="wp-block-list">
<li>Committed credit annual recurring revenue (ARR) vs. burndown ARR: Measuring the credits sold on annual commitment vs. those consumed and replenished. This is the single most important split for valuation. Committed credits behave like subscription and burndown behaves like usage.</li>



<li>Credit utilization rate: The percentage of purchased credits consumed per period. This is a leading indicator of renewal sizing.</li>



<li>Credit burn velocity: How fast is a customer consuming their credits, and is that consumption increasing or decreasing quarter over quarter? This metric predicts expansion or contraction before it shows up in ARR.</li>



<li>Effective price per credit: The real revenue per credit after discounts, overage and rollover, which can detect revenue leakage and help companies set smarter guide rails.</li>
</ul>



<h3 class="wp-block-heading">Margin reality</h3>



<ul class="wp-block-list">
<li>Credit margin: The gross profit the company earns per credit after subtracting inference costs. This is the core economic unit for AI-native, usage-based businesses — the replacement for gross margin per seat used in SaaS.</li>



<li>Inference-adjusted gross margin: By carving out AI inference costs separately in the P&amp;L statement, you can see true AI margins, avoid hiding deterioration inside blended SaaS margins, and clearly distinguish AI economics from legacy SaaS economics.</li>



<li>Compute leverage ratio: This metric measures how efficiently the business converts compute spend into revenue. It shows whether your AI margins are improving as you scale.</li>



<li>AI-adjusted “Rule of 40”: This updated metric recalibrates the traditional growth and profitability benchmark to account for AI’s lower gross margins and variable inference costs, giving a more accurate picture of business health for AI-native companies.</li>
</ul>



<h3 class="wp-block-heading">Behavioral and value signals</h3>



<ul class="wp-block-list">
<li>Time-to-first outcome: Replaces traditional onboarding metrics. Tracks how fast a customer reaches their first measurable result.</li>



<li>Adoption: AI-native adoption is measured by workflow penetration and active agent density, not seat count. As AI replaces human-driven usage, the unit of adoption shifts from people to automated workflows and agents.</li>



<li>Net credit retention (NCR): Credit-volume retention across the customer base, tracked separately from net recurring revenue to avoid price-change impact.</li>
</ul>



<p class="wp-block-paragraph">Along with these new metrics, the industry’s transformation is prompting companies to retire or recalibrate old SaaS measures, including per-seat ARR as a primary key performance indicator (KPI), traditional magic number calibrated to subscription dynamics, unadjusted Rule of 40, customer success metrics tied to human touchpoints, and blended gross margin without AI COGS carve-outs.</p>



<h2 class="wp-block-heading">What does this mean for enterprise value calculations?</h2>



<p class="wp-block-paragraph">As the internal metrics of success change, so do the ways the investment community measures growth and long-term viability.</p>



<p class="wp-block-paragraph">Increasingly, a company’s valuation multiple depends on whether its revenue behaves like committed subscription ARR or volatile usage ARR, and the commit‑to‑burndown ratio is the metric investors use to decide where the company fits.</p>



<p class="wp-block-paragraph">For example, a business with 80% committed credit ARR could trade closer to subscription comps and one with 80% burndown could trade closer to usage comps even though both have the same types of customers. Being able to proactively explain the commit‑to‑burndown mix can help companies avoid undervaluation.</p>



<p class="wp-block-paragraph">In addition, utilization is expected to replace net promoter scores and seat usage as the primary predictor of churn or expansion. Low utilization guarantees downsizing at renewal, so companies must track utilization cohorts the same way SaaS tracks logo retention cohorts today.</p>



<p class="wp-block-paragraph">We’re also seeing an inversion of the operating model, with R&amp;D and COGS moving up the P&amp;L and sales and marketing (S&amp;M) and customer success (CS) moving down or sideways. The net operating leverage profile is structurally different from classical SaaS, and the cost-to-scale curve looks different too.</p>



<p class="wp-block-paragraph">Finally, credit margin engineering is a hidden value-creation lever. The gap between price per credit and cost per credit is set by the software vendor and can be optimized. Most operators have barely started managing this rigorously, and the ones who do will pull away on margin.</p>



<h2 class="wp-block-heading">What this means for leaders, boards and investors</h2>



<p class="wp-block-paragraph">The shift from classic SaaS metrics to new AI‑native measures isn’t cosmetic. It represents the seismic change the industry is experiencing as AI matures and transforms products and organizations.</p>



<p class="wp-block-paragraph">While these metrics — and perhaps others yet to be determined — may evolve over time, there is no doubt they are already changing how AI companies allocate capital, price products, incent sales teams, evaluate performance and communicate with investors.</p>



<p class="wp-block-paragraph">It’s important to remember that SaaS metrics were practical tools for a specific era of software. As that era draws to a close, winning companies will choose new metrics that shape behavior and drive smart decision-making.</p>



<p class="wp-block-paragraph"><em>The views reflected in this article are the views of the author and do not necessarily reflect the views of Ernst &amp; Young LLP or other members of the global EY organization.</em></p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Stop asking AI nicely: Here’s how to get work-ready results every time]]></title>
<description><![CDATA[Over the past few years, I have learned that basic prompts produce inconsistent, hallucination-prone results that no executive would trust in production. What turned the tide was my move to advanced prompting techniques. These weren’t theoretical experiments; they became a practical foundation fo...]]></description>
<link>https://tsecurity.de/de/3694396/it-security-nachrichten/stop-asking-ai-nicely-heres-how-to-get-work-ready-results-every-time/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694396/it-security-nachrichten/stop-asking-ai-nicely-heres-how-to-get-work-ready-results-every-time/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:51 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Over the past few years, I have learned that basic prompts produce inconsistent, hallucination-prone results that no executive would trust in production. What turned the tide was my move to advanced prompting techniques. These weren’t theoretical experiments; they became a practical foundation for reliable, measurable outcomes. I want to share the techniques that consistently delivered the biggest gains in my projects, complete with real before-and-after examples, copy-paste templates, lessons from failures and guidance on when to evolve beyond prompting to agentic systems.</p>



<h2 class="wp-block-heading">Why advanced prompting still matters in enterprise settings</h2>



<p class="wp-block-paragraph">Sophisticated prompting remains essential for control, reliability and compliance. If you “ask nicely” and hope for the best, you need deterministic behavior, auditable reasoning and minimal risk of hallucination. Here’s what worked for me.</p>



<h3 class="wp-block-heading">1. Chain-of-Thought (CoT) and its variants: Unlocking step-by-step reasoning</h3>



<p class="wp-block-paragraph"><strong>The problem:</strong> Models would jump to conclusions on complex analysis tasks, especially involving data interpretation or multi-step logic.</p>



<p class="wp-block-paragraph"><strong>What I did:</strong> I started explicitly instructing the model to “think step by step” and show its reasoning.</p>



<p class="wp-block-paragraph"><strong>Before (basic prompt): </strong>“Analyze last quarter’s sales data and recommend three actions.”</p>



<p class="wp-block-paragraph"><strong>After (CoT prompt):</strong></p>



<p class="wp-block-paragraph">“You’re a senior business analyst. Analyze the following sales data step by step: [data]. First, identify the key trends. Second, calculate the rates and anomalies. Third, link findings to business context. Finally, recommend the three prioritized actions with expected impact. Explain your reasoning at each step.”  </p>



<p class="wp-block-paragraph"><strong>Results:</strong> Accuracy and depth improved dramatically.</p>



<p class="wp-block-paragraph"><strong>Variants that worked well:</strong> Self-consistency. I ran the same CoT prompt multiple times and took the majority consensus. This reduced variability significantly.</p>



<p class="wp-block-paragraph"><strong>Template you can use:</strong></p>



<pre class="wp-block-code"><code>You are [expert role]. Solve this problem by thinking step by step.

[Task or question]

For each step:

1. State your observation or calculation.

2. Explain the implication.

3. Proceed only when confident.

Final answer in this format: [structured output]</code></pre>



<h3 class="wp-block-heading">2. Tree-of-Thoughts (ToT): Exploring multiple reasoning paths</h3>



<p class="wp-block-paragraph">For truly complex decisions such as resource allocation or risk assessment, linear CoT isn’t enough. Tree-of-Thoughts lets the model generate and evaluate multiple branches.</p>



<p class="wp-block-paragraph"><strong>Example:</strong> I was helping a client evaluate three potential vendor platforms for an AI deployment. A standard prompt gave a superficial comparison. With ToT</p>



<p class="wp-block-paragraph"><strong>Prompt Snippet:</strong></p>



<pre class="wp-block-code"><code>Explore three different reasoning paths for selecting the best vendor platform:

Path 1: Focus on cost and scalability.

Path 2: Focus on security, compliance and integration.

Path 3: Focus on innovation and long-term roadmap.

For each path, evaluate pros/cons against our requirements [list].

Then, compare the paths and recommend the strongest overall option with justification.</code></pre>



<p class="wp-block-paragraph"><strong>Outcome:</strong> The model surfaced nuanced trade-offs (e.g., one vendor had superior security, but higher integration cost).</p>



<p class="wp-block-paragraph"><strong>When to use:</strong> Strategic planning, troubleshooting or scenarios with high uncertainty and multiple viable approaches.</p>



<h3 class="wp-block-heading">3. ReAct (Reason+ Act) and prompt chaining: Moving toward agentic behavior</h3>



<p class="wp-block-paragraph">One of the biggest leaps I have noticed comes from combining reasoning with tool use and chaining prompts.</p>



<p class="wp-block-paragraph"><strong>ReAct example</strong>: (used in data analytics workflow)</p>



<pre class="wp-block-code"><code>You are an AI analyst with access to tools. For the query below:

1. Reason about what information you need.

2. Choose the appropriate tool or action.

3. Observe the result.

4. Repeat until you can answer confidently.

Query: [user request]</code></pre>



<p class="wp-block-paragraph">In practice, I chained this with retrieval tools. One automated quarterly compliance reporting; the system reasoned about required data, pulled relevant records, validated them, and generated the reports.</p>



<h3 class="wp-block-heading">4. Meta-prompting and self-reflection: Letting the model improve itself</h3>



<p class="wp-block-paragraph">Use the model to refine its own prompt. This is a huge time-saver.</p>



<pre class="wp-block-code"><code>You are an expert prompt engineer. Improve the following prompt for clarity, structure and effectiveness with [target model]. Make it more precise while preserving intent.

Original prompt: [paste]

Provide the improved version and explain your changes.</code></pre>



<p class="wp-block-paragraph">Self-reflection loops (asking the model to critique its own output and revise) are a game-changer for content generation and code-review tasks.</p>



<h3 class="wp-block-heading">5. Multimodal and structured output techniques</h3>



<p class="wp-block-paragraph">With vision-enabled models, I started combining text with images (e.g., uploading architecture diagrams or dashboards).</p>



<p class="wp-block-paragraph"><strong>Tip from experience:</strong> Be extremely specific in describing what the models should focus on.</p>



<h4 class="wp-block-heading">Best practices I learned the hard way</h4>



<ul class="wp-block-list">
<li><strong>Start simple, then layer complexity</strong>: Over-engineered prompts from Day One usually backfire.</li>



<li><strong>Model specific tuning:</strong> Some models respond better to XML delimiters; others to explicit reasoning.</li>



<li><strong>Evaluation and versioning:</strong> Treat prompts like code if you track versions and run automated evals.</li>



<li><strong>Security guardrails:</strong> Always include instructions against prompt injections and respect data boundaries.</li>



<li><strong>When to stop prompting</strong>: For repetitive, high-stakes workflows, move to full agents or an orchestration framework.</li>
</ul>



<h2 class="wp-block-heading">Final takeaways for technical leaders</h2>



<p class="wp-block-paragraph">Advanced prompt engineering has now become a core competency for anyone responsible for enterprise AI outcomes. Start by picking one technique and apply it rigorously to a real business problem. Document before/ after and you will notice why it’s worth mastering.</p>



<p class="wp-block-paragraph">The field continues evolving towards more automated and agentic systems, but the ability to precisely direct AI reasoning remains foundational.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[OpenAI Presence raises new questions about enterprise automation and jobs]]></title>
<description><![CDATA[OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.



The agents can answer questions and operate IT systems, and enterprises can decide w...]]></description>
<link>https://tsecurity.de/de/3694393/it-security-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694393/it-security-nachrichten/openai-presence-raises-new-questions-about-enterprise-automation-and-jobs/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:50 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">OpenAI has launched Presence, an enterprise service for deploying voice and chat agents that can resolve customer and employee requests, potentially automating some work now handled by frontline support teams.</p>



<p class="wp-block-paragraph">The agents can answer questions and operate IT systems, and enterprises can decide what actions the agents may take and when they should seek human approval for actions or transfer a case to a human.</p>



<p class="wp-block-paragraph">OpenAI is already using Presence internally for its English-language phone support channel, where it verifies callers and uses account information to complete approved actions. The company said the system resolves 75% of inbound issues without human assistance.</p>



<p class="wp-block-paragraph">Another OpenAI service, Codex, can be used to monitor agents and suggest updates or improvements to processes. In OpenAI’s own tests, suggestions from Codex helped reduce handoffs to humans by 15 percentage points over 10 days, it said. Presence also includes simulation and evaluation tools that allow companies to test an agent before deployment. The tests assess whether it reaches the correct outcome, follows company policy, and hands a case to an employee when required.</p>



<p class="wp-block-paragraph">OpenAI intends each Presence deployment to deal with one kind of task, for example billing issues, insurance claims, or employee IT service requests, with agents getting only the knowledge and system access required for that task.</p>



<p class="wp-block-paragraph">Presence is not a self-service product: Enterprises will have to sign up for the limited availability program, with integration performed by OpenAI or selected <a href="https://www.computerworld.com/article/4136024/openai-partners-with-consulting-giants-to-deploy-enterprise-ai-agents.html">global systems integrators</a>.</p>



<p class="wp-block-paragraph">Companies exploring or testing Presence include Spanish bank BBVA, which is evaluating the service for everyday banking support in Mexico, and Japanese technology group SoftBank, which is using it in trials involving Japanese-language customer interactions. Australian insurer IAG is assessing whether the technology can help it respond to surges in customer demand during severe weather events.</p>



<h2 class="wp-block-heading">Workforce impact</h2>



<p class="wp-block-paragraph">OpenAI’s announcement did not address the potential effect of Presence on employment. But its claimed automation rate raises questions about how the technology could affect staffing in customer service and other support functions.</p>



<p class="wp-block-paragraph"><a href="https://pareekh.com/" target="_blank" rel="noreferrer noopener">Pareekh Jain</a>, CEO of Pareekh Consulting, said CIOs should regard the 75% figure as evidence that the technology can work, rather than as a benchmark that every enterprise can expect to reach.</p>



<p class="wp-block-paragraph">Jain said OpenAI’s deployment benefits from being built around the company’s own products and data. Large enterprises may achieve lower automation rates because they must contend with fragmented legacy systems, uneven knowledge bases and more complex compliance demands.</p>



<p class="wp-block-paragraph">“Most organizations should expect lower initial automation levels that improve over time as the AI agent is refined,” Jain said.</p>



<p class="wp-block-paragraph">The first workforce effect is more likely to be <a href="https://www.cio.com/article/4015750/cios-see-ai-prompting-new-it-hiring-even-as-boards-push-for-job-cuts.html">slower hiring than immediate layoffs</a>, according to <a href="https://www.linkedin.com/in/tulikasheel/" target="_blank" rel="noreferrer noopener">Tulika Sheel</a>, senior vice president at Kadence International.</p>



<p class="wp-block-paragraph">“The roles most exposed are likely to be repetitive, high-volume functions such as frontline customer support and routine back-office processing,” Sheel said. “However, I would expect the first impact to be on hiring and team growth rather than immediate large-scale job cuts. Over time, enterprises may redesign roles around AI-assisted workflows, with humans focusing more on complex cases, escalation, and relationship management.”</p>



<p class="wp-block-paragraph">Jain said Tier-1 support agents handling predictable queries would face the most exposure. Broader reductions would become more likely only after companies reorganize their operations around the technology.</p>



<p class="wp-block-paragraph">However, <a href="https://omdia.tech.informa.com/authors/lian-jye-su" target="_blank" rel="noreferrer noopener">Lian Jye Su</a>, chief analyst at Omdia, said Presence is unlikely to increase the threat of job displacement because companies have used similar customer-support automation from vendors such as Genesys, NiCE, Five9 and AWS for years.</p>



<p class="wp-block-paragraph">Enterprises are more likely to use Presence alongside employees, with AI handling routine requests while people remain responsible for work requiring judgment and empathy, Su said.</p>



<h2 class="wp-block-heading">Cost and operational risks</h2>



<p class="wp-block-paragraph">Analysts said CIOs should examine whether Presence can maintain resolution quality as usage grows, since fewer human handoffs could leave employees dealing with a more difficult mix of cases.</p>



<p class="wp-block-paragraph">“The key question is not simply how many tasks AI can handle, but whether it can handle them reliably at scale,” Sheel said.</p>



<p class="wp-block-paragraph">The financial case will depend partly on the cost of connecting Presence to existing systems and maintaining the controls needed to govern its use, according to Jain. “Often the biggest cost of enterprise AI is not tokens but <a href="https://www.computerworld.com/article/4128310/openai-responds-to-claude-cowork-with-its-own-platform-to-help-build-deploy-and-manage-ai-agents.html">integration and governance</a>,” Jain added.</p>



<p class="wp-block-paragraph">Companies will need to determine what systems and data the agents can access, monitor their performance, and audit the actions they take. Those investments could offset early savings.</p>



<p class="wp-block-paragraph">Su said the complexity of enterprise IT will make it difficult for OpenAI to automate entire workflows on its own. Enterprises will still need to work with other technology providers and human employees, while CIOs will favor systems that can be audited and integrated with existing infrastructure.</p>



<p class="wp-block-paragraph">Jain said the economics could improve if companies use the same integrations and governance controls across additional workflows.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Model Context Protocol is going stateless to make scaling simpler]]></title>
<description><![CDATA[Model Context Protocol (MCP), the emerging standard for connecting AI models to external tools and enterprise data, is undergoing its biggest architectural overhaul yet.



The latest release candidate, scheduled for release on July 28, removes protocol-level sessions in favor of a stateless arch...]]></description>
<link>https://tsecurity.de/de/3694388/it-security-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694388/it-security-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:48 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Model Context Protocol (<a href="https://www.infoworld.com/article/4029634/what-is-model-context-protocol-how-mcp-bridges-ai-and-external-services.html">MCP</a>), the emerging standard for connecting AI models to external tools and enterprise data, is undergoing its biggest architectural overhaul yet.</p>



<p class="wp-block-paragraph">The latest <a href="https://modelcontextprotocol.io/specification/draft/changelog" target="_blank" rel="noreferrer noopener">release candidate</a>, scheduled for release on July 28, removes protocol-level sessions in favor of a stateless architecture, a change which industry experts say is intended to make MCP easier to deploy across standard cloud infrastructure as enterprises move AI pilots into production.</p>



<p class="wp-block-paragraph">“The session-based model made sense when MCP servers were local processes on a developer’s laptop. In production, it became an operational tax,” said <a href="https://www.linkedin.com/in/muskan-bandta2004" target="_blank" rel="noreferrer noopener">Muskan Bandta</a>, cloud associate at ZopDev.</p>



<p class="wp-block-paragraph">“When your infrastructure team asks whether MCP services can scale like other cloud applications, the answer used to be ‘not quite.’ With the move to a stateless architecture, the answer is now yes,” Bandta added.</p>



<p class="wp-block-paragraph">Earlier versions of the protocol maintained information about every client connection, meaning servers had to keep track of each session throughout an interaction. While that approach worked well for local development, it complicated deployments across multiple servers because requests often had to be routed back to the same machine, limiting scalability and making MCP a less natural fit for modern cloud architectures.</p>



<p class="wp-block-paragraph">“Under the new stateless design, every request contains the information needed for any available server to process it independently. Applications that need to maintain context across multiple requests can still do so, but developers must now manage that state explicitly rather than relying on the protocol itself,” she said.</p>



<p class="wp-block-paragraph">This transition to a stateless design goes beyond simplifying infrastructure by fundamentally changing how AI applications manage and share context across tools, according to <a href="https://www.linkedin.com/in/znamit/" target="_blank" rel="noreferrer noopener">Amit Jena</a>, AI development manager at IT consulting firm Kanerika.</p>



<p class="wp-block-paragraph">Instead of keeping application state hidden inside protocol sessions, the new design makes it explicit, allowing AI models to access, reason over, and pass that information between tools, giving developers greater control over how context is preserved and shared across tools, Jena said.</p>



<p class="wp-block-paragraph">It should also make AI workflows more portable, resilient, and easier to orchestrate across distributed environments, he said.</p>



<h2 class="wp-block-heading">MCP’s new features</h2>



<p class="wp-block-paragraph">Other changes to MCP include the addition of a Multi Round-Trip Requests (MRTR) mechanism that changes how AI agents request additional information they need to complete a task.</p>



<p class="wp-block-paragraph">Instead of relying on a persistent connection between the client and server throughout the interaction, the new mechanism lets the server request additional input through a standard request-response exchange before continuing the task, Jena said.</p>



<p class="wp-block-paragraph">Routable transport headers, another addition, enable API gateways and other networking infrastructure to identify and route MCP requests without inspecting their contents.</p>



<p class="wp-block-paragraph">They reduce processing overhead, lower latency, and let enterprise teams enforce routing, rate-limiting and security policies more efficiently using existing API management infrastructure, Jena said.</p>



<p class="wp-block-paragraph">MCP is also getting an updated authorization framework built around OAuth 2.1 and OpenID Connect; interactive MCP Apps; and deterministic caching of tool and resource listings to improve LLM prompt-cache hit rates, potentially saving on token costs.</p>



<h2 class="wp-block-heading">Rebuilding the trust boundary</h2>



<p class="wp-block-paragraph">The MCP release steering committee also decided to deprecate some legacy features, including Roots, Sampling, Logging, the older HTTP+SSE transport and Dynamic Client Registration, although these will continue to work in this version and any other released over the next year.</p>



<p class="wp-block-paragraph">The deprecation of Sampling is likely to have the biggest impact because it changes who is responsible for interacting with foundation models, said Jena.</p>



<p class="wp-block-paragraph">“Sampling let MCP servers invoke the <a href="https://www.infoworld.com/article/2335213/large-language-models-the-foundations-of-generative-ai.html" target="_blank">LLM</a> through the client, which meant the server had a callback path into the model without owning that connection. Deprecating it means rebuilding that trust boundary,” Jena said. “Your server now calls the model provider directly. That changes your network architecture, your auth model, and depending on how you’ve built cost attribution, your billing flow.”</p>



<p class="wp-block-paragraph">The year-long transition period will be enough for teams to audit their sampling dependencies now, said Jena: “The risk is that teams who haven’t implemented sampling themselves won’t know if a third-party MCP server they’re depending on uses it.”</p>



<h2 class="wp-block-heading">Updated MCP SDKs</h2>



<p class="wp-block-paragraph">To accompany the protocol update, there are updated <a href="https://github.com/modelcontextprotocol" target="_blank" rel="noreferrer noopener">MCP SDKs</a> for <a href="https://www.infoworld.com/article/2253770/what-is-python-powerful-intuitive-programming.html" target="_blank">Python</a>, <a href="https://www.infoworld.com/article/2257305/what-is-typescript-strongly-typed-javascript.html" target="_blank">Typescript</a>, <a href="https://www.infoworld.com/article/2253031/whats-the-go-language-really-good-for-3.html">Go</a>, and <a href="https://www.infoworld.com/article/4131649/the-best-new-features-of-c-14.html">C#</a>. These support both the old and new protocol versions, so new clients can continue communicating with older servers, while updated servers will also support older clients, reducing the risk of immediate disruptions.</p>



<p class="wp-block-paragraph">That backward compatibility should make the transition largely incremental, except for enterprises that built custom infrastructure around MCP’s earlier session-based architecture, Bandta said.</p>



<p class="wp-block-paragraph">Identifying and auditing those session dependencies may not be easy, Jena warned.</p>



<p class="wp-block-paragraph">“Session management complexity tends to be hidden across multiple layers — the gateway config, the deployment scripts, the monitoring dashboards. The code change is small; finding everywhere the assumption lives is what takes time,” he said.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.infoworld.com/article/4201254/model-context-protocol-is-going-stateless-to-make-scaling-simpler.html">InfoWorld</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Getting a grip on shadow tokens and AI blowouts]]></title>
<description><![CDATA[Four months of Claude Code — that’s all it took for Uber to burn through its entire annual budget for AI. Token after token, engineers embraced the platform with few control mechanisms tying costs to outcomes. The result was a budget runaway and a clear case study in how limited oversight snowbal...]]></description>
<link>https://tsecurity.de/de/3694389/it-security-nachrichten/getting-a-grip-on-shadow-tokens-and-ai-blowouts/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694389/it-security-nachrichten/getting-a-grip-on-shadow-tokens-and-ai-blowouts/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:48 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Four months of Claude Code — that’s all it took for Uber to burn through its entire annual budget for AI. Token after token, engineers embraced the platform with few control mechanisms tying costs to outcomes. The result was a budget runaway and <a href="https://www.forbes.com/sites/janakirammsv/2026/05/17/uber-burns-its-2026-ai-budget-in-four-months-on-claude-code/">a clear case study</a> in how limited oversight snowballs into an AI blowout.</p>



<p class="wp-block-paragraph">This is a phenomenon I like to call “shadow tokens” — AI credits paid for by the company but largely invisible to decision-makers. Too many engineers have the final say over how much they consume and, therefore, what it costs. This all-you-can-eat attitude is part of the reason why <a href="https://www.theverge.com/tech/930447/microsoft-claude-code-discontinued-notepad">Microsoft is reportedly</a> winding down many internal licenses across key engineering teams and why <a href="https://www.thestreet.com/investing/the-next-phase-of-ai-spending-is-already-underway">one in five organizations</a> is missing its AI spend forecast by more than 50%.</p>



<p class="wp-block-paragraph">And the trend is only accelerating. By 2028, <a href="https://www.cio.com/article/4189149/ai-coding-token-costs-are-on-track-to-rival-human-payroll.html">Gartner predicts</a> that AI coding costs (driven by this kind of ungoverned consumption) will be as much per developer as the salary companies pay that person.</p>



<p class="wp-block-paragraph">LLMs and agents introduce a new class of variable cost that scales with behavior rather than headcount, putting enterprises on the hook for tools that balloon with workload. I don’t see this as enterprises overspending because they’re reckless — it’s down to a lack of managerial oversight, budget alignment that demands a proven return on investment, and engineer education on how much is too much.</p>



<p class="wp-block-paragraph">Going forward, CIOs need to thread the AI needle between governance that encourages transparency and reasonable spend without stifling innovation.</p>



<h2 class="wp-block-heading">When shadow tokens result in real costs</h2>



<p class="wp-block-paragraph">The issue is that AI isn’t a traditional line item. Previously, enterprise leaders onboarded software-as-a-service (SaaS) with a good idea of the total cost. An allocated software seat or annual contract was a known quantity. The cloud added some variation (with fluctuations depending on hosting size), but instances were still modelable. AI flips this status quo on its head — the unit of consumption is behavior and the cost is exponential.</p>



<p class="wp-block-paragraph">And these specifics aren’t immediately apparent at pilot. Tools can appear inexpensive in controlled experiments yet unpredictably scale depending on session length, context window size, model selection and whether agents run in parallel. This is the fallacy of the $20-per-seat enterprise plan — tokens are charged separately at API rates with no ceiling. The final dollar value of any session is set by factors that finance can’t always model in advance, particularly when these decisions usually rest with the engineers themselves.</p>



<p class="wp-block-paragraph">According to <a href="https://www.deloitte.com/cz-sk/en/services/consulting/research/the-state-of-ai-in-the-enterprise.html">Deloitte</a>, only 21% of organizations deploying agents have a mature governance model, a real concern because they’re token-eating machines. This is what was happening at Uber — Claude Code in agentic mode was autonomously reading codebases, planning changes across dozens of files and opening pull requests. Each step quickly adds up, with Anthropic’s own documentation noting that agents consume approximately seven times as many tokens as standard sessions.</p>



<p class="wp-block-paragraph">This is shadow IT and shadow AI, evolved. This time, however, many leaders approved the tool in question without guardrails governing consumption. AI hype adds fuel to the fire and normalizes long sessions. Uber’s CTO, for example, <a href="https://x.com/praveenTweets/status/2033627282418655711">described</a> a company-wide shift toward “agentic software engineering” with employees “who are quietly experimenting, quietly shipping and quietly pushing things forward”. This is an exciting way to test the limits of what’s possible, certainly, but it’s also a position that goes a long way to explaining how the company spent its annual AI budget by April.</p>



<h2 class="wp-block-heading">Shifting the culture from usage to yield</h2>



<p class="wp-block-paragraph">Engineers haven’t done anything wrong here. In fact, they’re adopting and experimenting as instructed, with Uber creating leaderboards and ranking users by token consumption. More use led to a better ranking, reflecting a culture that lauds new ways of doing things. This behavior is known as “<a href="https://www.cio.com/article/4178320/tokenmaxxing-when-ai-adoption-metrics-go-bad.html">tokenmaxxing</a>,” and its principal knock-on effect is shadow tokens — quantity-over-quality processes that leaders struggle to control until they’re fully realized in the budget. Of course, if management treats adoption metrics as performance metrics, then engineers can’t be blamed for using more tokens. The tension is that the teams driving adoption aren’t the ones managing spend.</p>



<p class="wp-block-paragraph">None of this is meant to dismiss AI’s productivity possibilities and potential return on investment. Developers save <a href="https://getdx.com/blog/ai-assisted-engineering-q4-impact-report-2025/">3.6 hours</a> per week, achieve 60% higher pull request throughput and cut onboarding time in half with automation. Meanwhile, Uber shared that roughly 11% of live backend updates were written by agents with no human in the loop. However, these wins aren’t the problem — it’s that too many teams aren’t connecting input to output. I’ve spoken to admins who discovered their token spend had tripled in a single quarter after using heavier models or accidentally doubling up on agentic applications. Nobody knew until the financial damage was done.</p>



<p class="wp-block-paragraph">Automation needs to happen sustainably with an eye on the bottom line. In my view, a much better metric for achieving this is AI yield — the measurable business or engineering output generated per dollar spent on tokens. Otherwise, without a feedback loop, even genuinely productive teams are flying blind.</p>



<h2 class="wp-block-heading">Stopping token waste before an AI blowout</h2>



<p class="wp-block-paragraph">Creating that throughline between AI investment and token consumption starts with established financial metrics. This is possible via maximum spend limits (dictated by spend tagging, workload tiering and cost-per-output benchmarks) per team or project. Then, any additional allocation requires approval, closing the loop between the engineers spending the tokens and the leaders paying for them. AI isn’t cheap and teams should demonstrate a bang for their buck.</p>



<p class="wp-block-paragraph">This is something we do with our engineering team at Hexnode. Resource allocation for Claude Code and Cursor is tied directly to ROI rather than letting consumption run open-ended. Given the pay-as-you-go nature of these tools, a firm usage limit per team offers simple but essential control.</p>



<p class="wp-block-paragraph">Similarly, there’s room to apply some of the governance principles IT uses for device management. Things like policy enforcement, role-based access, real-time monitoring and automated alerts can flag usage behavior in advance. Uncovering such insights at the token layer works to identify power users and prevent excessive spending.</p>



<p class="wp-block-paragraph">We also need to encourage cultures that praise outputs that actually achieve efficiency. AI applications that result in shipping faster, reducing rework and cutting review cycles are gains that should be celebrated. If your company hosts leaderboards, frame unnecessary token burn as wasteful rather than valuable. The organizations creating healthier consumption habits work with their engineers to understand not just how to use AI, but what responsible use looks like and what it costs.</p>



<p class="wp-block-paragraph">This is a conversation teams need to have now. Anthropic <a href="https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan">just ended flat-rate pricing</a> for programmatic workloads from June 15. Now, agents, continuous integration pipelines and automated workflows draw from a dedicated monthly credit pool billed separately from the subscription. Once that pool is exhausted, agent tasks either stop entirely or overflow to extra billing. Work can either get very expensive or grind to a halt for teams that aren’t prepared.</p>



<p class="wp-block-paragraph">Getting a grip on shadow tokens means better rules and tools connecting spend to outcomes. Only by building the financial and cultural infrastructure that encourages sustainable adoption can leaders see what they’re spending, connect it to what they’re getting and course-correct before the costs become a crisis. Ultimately, shadow tokens are only invisible if we choose not to look.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Palantir’s access to identifiable NHS England patient data is ‘dangerous’, MPs say]]></title>
<description><![CDATA[Health service has given US tech firm ‘unlimited access’ to certain data to build integrated platform, according to reportsUK politics live – latest updatesMPs have warned that an NHS decision to grant Palantir access to identifiable patient information in its plan to use AI to improve the health...]]></description>
<link>https://tsecurity.de/de/3694385/it-security-nachrichten/palantirs-access-to-identifiable-nhs-england-patient-data-is-dangerous-mps-say/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694385/it-security-nachrichten/palantirs-access-to-identifiable-nhs-england-patient-data-is-dangerous-mps-say/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:42 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Health service has given US tech firm ‘unlimited access’ to certain data to build integrated platform, according to reports</p><ul><li><p><a href="https://www.theguardian.com/politics/live/2026/may/11/keir-starmer-labour-leadership-speech-angela-rayner-wes-streeting-andy-burnham-catherine-west-may-elections-uk-politics-latest-news-updates">UK politics live – latest updates</a></p></li></ul><p>MPs have warned that an NHS decision to grant Palantir access to identifiable patient information in its plan to use AI to improve the health service is “dangerous” and will fuel public fears that data privacy is not being prioritised.</p><p>NHS England has allowed staff from the US tech firm and other contractors to access patient data before it has been pseudonymised, despite internal fears of a “risk of loss of public confidence”, the <a href="https://www.ft.com/content/8ce1b9be-1d51-466b-90de-54bff1a504ca?syn-25a6b1a6=1">Financial Times </a>reported.</p> <a href="https://www.theguardian.com/society/2026/may/11/palantir-access-nhs-england-patient-data">Continue reading...</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[1Password Lets Claude Sign In Without Revealing Passwords]]></title>
<description><![CDATA[1Password's new Claude integration lets AI agents sign in to websites without exposing passwords, adding user approval and credential protection.
The post 1Password Lets Claude Sign In Without Revealing Passwords appeared first on TechRepublic.]]></description>
<link>https://tsecurity.de/de/3694382/it-security-nachrichten/1password-lets-claude-sign-in-without-revealing-passwords/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694382/it-security-nachrichten/1password-lets-claude-sign-in-without-revealing-passwords/</guid>
<pubDate>Sat, 25 Jul 2026 18:55:34 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>1Password's new Claude integration lets AI agents sign in to websites without exposing passwords, adding user approval and credential protection.</p>
<p>The post <a href="https://www.techrepublic.com/article/news-1password-claude-passwordless-sign-in-ai-agents/">1Password Lets Claude Sign In Without Revealing Passwords</a> appeared first on <a href="https://www.techrepublic.com/">TechRepublic</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts]]></title>
<description><![CDATA[The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims.

Swiss cybersecurity company PRODAFT is tracking the centrally administ...]]></description>
<link>https://tsecurity.de/de/3694235/it-security-nachrichten/devman-raas-portal-centralizes-payload-builds-victim-management-and-affiliate-payouts/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3694235/it-security-nachrichten/devman-raas-portal-centralizes-payload-builds-victim-management-and-affiliate-payouts/</guid>
<pubDate>Sat, 25 Jul 2026 18:52:20 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims.

Swiss cybersecurity company PRODAFT is tracking the centrally administered RaaS operation under the name Funky Mantis.

"The portal combined build generation, finance,]]></content:encoded>
</item>
<item>
<title><![CDATA[‘Agent Kim Reactivated’ Episode 10 Finale Release Date and What to Expect]]></title>
<description><![CDATA[Agent Kim Reactivated Episode 10 will release on Saturday, July 25, 2026, bringing the Korean action drama’s first season to an end. The finale will air on SBS in South Korea before becoming available to international viewers on Netflix.



The final episode will begin at 9:45 p.m. KST, which is ...]]></description>
<link>https://tsecurity.de/de/3693855/ios-mac-os/agent-kim-reactivated-episode-10-finale-release-date-and-what-to-expect/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693855/ios-mac-os/agent-kim-reactivated-episode-10-finale-release-date-and-what-to-expect/</guid>
<pubDate>Sat, 25 Jul 2026 13:19:44 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Agent Kim Reactivated Episode 10 will release on Saturday, July 25, 2026, bringing the Korean action drama’s first season to an end. The finale will air on SBS in South Korea before becoming available to international viewers on Netflix.



The final episode will begin at 9:45 p.m. KST, which is five minutes earlier than the show’s usual 9:50 p.m. slot. SBS has also confirmed that Episode 10 will have a slightly extended runtime, giving the series more time to resolve its remaining conflicts.



Agent Kim Reactivated Episode 10 release details




Episode: 10



Release date: Saturday, July 25, 2026



SBS broadcast time: 9:45 p.m. KST



Streaming platform: Netflix



Total episodes: 10



Genre: Action, crime, comedy and thriller




Netflix normally adds new episodes after their Korean television broadcast, although the exact arrival time can differ by country.



Where is the story heading in the finale?



Spoilers for Episode 9 follow.



Episode 9 placed Manager Kim and his allies in the middle of a dangerous extraction operation. Kim attempted to rescue Ri Eung-ryeong from North Korean agents while Han-su, Jin-cheol and Sang-a helped him enter a heavily guarded hotel.



The operation quickly fell apart after communications were cut and the building lost power. Kim and Ri Eung-ryeong were surrounded by armed agents near the loading area, leaving their escape uncertain.



Meanwhile, Ju Gang-chan’s assistant kidnapped the children of Han-su and Jin-cheol. The episode ended with both fathers learning that their families were being used against them, setting up another personal rescue mission for the finale.



Episode 10 should therefore focus on Kim escaping the hotel, protecting Min-ji and helping his friends save their children. The finale must also settle Ju Gang-chan’s fate and reveal whether Kim can finally leave his violent past behind.



How did Agent Kim’s story begin?



The series started with Kim living quietly as an office worker and raising his teenage daughter, Min-ji, after his wife’s death. His ordinary life collapsed when Min-ji disappeared, forcing him to reveal the black-ops abilities he had kept hidden for years.



As Kim searched for his daughter, the mission exposed old enemies, secret government operations and unresolved connections to North Korea. His former life gradually placed everyone around him in danger.



Agent Kim Reactivated Episode 10 now has several major storylines to complete during its extended finale. Do you expect Manager Kim and Min-ji to receive a happy ending? Let us know in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[Build 2026: Furthering Windows as the trusted platform for development]]></title>
<description><![CDATA[Build is one of our favorite moments each year - a chance to connect with the global developer community and share what we’ve been building.
Over the past year, we have connected with many developers pushing the boundaries of what’s possible on 
The post Build 2026: Furthering Windows as the trus...]]></description>
<link>https://tsecurity.de/de/3693527/windows-tipps/build-2026-furthering-windows-as-the-trusted-platform-for-development/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693527/windows-tipps/build-2026-furthering-windows-as-the-trusted-platform-for-development/</guid>
<pubDate>Sat, 25 Jul 2026 10:17:37 +0200</pubDate>
<category>🪟 Windows Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Build is one of our favorite moments each year - a chance to connect with the global developer community and share what we’ve been building.</p>
<p>Over the past year, we have connected with many developers pushing the boundaries of what’s possible on </p>
<p>The post <a href="https://blogs.windows.com/windowsdeveloper/2026/06/02/build-2026-furthering-windows-as-the-trusted-platform-for-development/">Build 2026: Furthering Windows as the trusted platform for development</a> appeared first on <a href="https://blogs.windows.com/windowsdeveloper">Windows Developer Blog</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Windows platform security for AI agents]]></title>
<description><![CDATA[Making Windows the trustworthy OS for agents
AI agents are no longer just answering questions, they are taking actions across systems with increasing autonomy. As they become persistent participants in how software runs, they introduce new r
The post Windows platform security for AI agents appear...]]></description>
<link>https://tsecurity.de/de/3693526/windows-tipps/windows-platform-security-for-ai-agents/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693526/windows-tipps/windows-platform-security-for-ai-agents/</guid>
<pubDate>Sat, 25 Jul 2026 10:17:36 +0200</pubDate>
<category>🪟 Windows Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h2>Making Windows the trustworthy OS for agents</h2>
<p>AI agents are no longer just answering questions, they are taking actions across systems with increasing autonomy. As they become persistent participants in how software runs, they introduce new r</p>
<p>The post <a href="https://blogs.windows.com/windowsdeveloper/2026/06/02/windows-platform-security-for-ai-agents/">Windows platform security for AI agents</a> appeared first on <a href="https://blogs.windows.com/windowsdeveloper">Windows Developer Blog</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Increasing app discovery and engagement on Google TV]]></title>
<description><![CDATA[Posted by Paul Lammertsma, Developer Relations Engineer


  With over 300 million monthly active devices across Google TV and Android TV, it’s clear that the living room is a massive, distinct platform for apps to accelerate growth. Today, we’re excited to share Google TV features and developer t...]]></description>
<link>https://tsecurity.de/de/3693513/android-tipps/increasing-app-discovery-and-engagement-on-google-tv/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693513/android-tipps/increasing-app-discovery-and-engagement-on-google-tv/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:47 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQn4lINBGbNGjb1HQYUpv_Z0-JdltXyHegoQ-Ukl5l9K2ef4BSjX8c_yu0EWlnHSJnia8oXZYWvMtKxCP9t9PlJmI9GFIy34UDVfMBkEIaz3KJegu0j2TsivMZZPHg9tkIlsyK4NWd0vEq5v1MfQUay8zJ9-2QgLDLBlkqYVxnY7BaYa3QBTVRE3NKxxQ/s2048/GoogleForDevelopers-AndroidText-StrapiMetacard-2048x1323.png">


<div><div class="separator"><i>Posted by Paul Lammertsma, Developer Relations Engineer</i></div></div><div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjUUiNUfVyqYWETmRLzZjld7Nbk0wpVVqMlxvLssfmOzHDfOKdKI8vZkXau3HMhjkOKcXpeJ-K-JkXiKTLk9tG2XH-O5xPlj-AVfQBnelPGhzkOJwhmFeB3NqVssPj4Cnq9r1ZkAHh-44z-dq71bQOpjIz_8d1VF1m2nYs6azBGxNBrM2GOXm6uGJymbKk/s4209/GoogleForDevelopers-AndroidText-Blogger-4209x1253.png"><img border="0" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjUUiNUfVyqYWETmRLzZjld7Nbk0wpVVqMlxvLssfmOzHDfOKdKI8vZkXau3HMhjkOKcXpeJ-K-JkXiKTLk9tG2XH-O5xPlj-AVfQBnelPGhzkOJwhmFeB3NqVssPj4Cnq9r1ZkAHh-44z-dq71bQOpjIz_8d1VF1m2nYs6azBGxNBrM2GOXm6uGJymbKk/s16000/GoogleForDevelopers-AndroidText-Blogger-4209x1253.png"></a></div><br><i><br></i><p dir="ltr"><br></p>

<p dir="ltr">
  With over 300 million monthly active devices across Google TV and Android TV, it’s clear that the living room is a massive, distinct platform for apps to accelerate growth. Today, we’re excited to share Google TV features and developer tools designed to increase the discoverability of your content and prepare your app for future TV experiences.
</p>

<h2 dir="ltr">Drive discovery and engagement with Gemini</h2>

<p dir="ltr">
  Last year, we brought our AI voice assistant, <a href="https://blog.google/products-and-platforms/platforms/google-tv/gemini-google-tv/">Gemini</a>, to our platform, so that people can easily find what to watch, learn something new on the big screen, and get everyday tasks done with just their voice.
</p>

<p dir="ltr">
  Since launch, we’ve made <a href="https://blog.google/products-and-platforms/platforms/google-tv/new-gemini-features-march-2026/">improvements</a> to how Gemini provides tailored responses to questions. Gemini shares a mix of visuals, videos, and text to help users find what they need, when they need it. For our streaming partners, Gemini is a helpful discovery engine—pulling from your app's metadata to surface your relevant content to viewers.
</p>

<div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhN7u9KDZ7L8CIw5cVB_qdWf6PRcm86N8RsrlWPdEYsfwchPZwFBpMaajSqkPwXXAoBP0_v0GpQsWp4_gF_SsBC0DuZlN0qVystQ3fWmHs1qU6dKclljJaea-Phak7qEoGFiu_i3-dj0l7WmA7Tm7T2v8kERsfhKp6BCFs-7y7eSdxVWmFkpIzXYsceaJM/w640-h360/GTV%20Gemini%20-%20GOAT%20overview%20%5B10.8%20MB%5D.gif"></div>

<h2 dir="ltr">Declare support for pointing modality</h2>

<p dir="ltr">
  The TV experience that we once knew is changing. Gemini is changing the way we discover and stream content with voice, but how we use the remote is evolving, too.
</p>

<div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5hNXf8y8wwFxJAgZ0N4QwO5v6QUe7vn4Qy70-ndmo2iTye1qdhKP5WxKPJVwoPi0qdadX25BUJzxtLQZVAHXASOibVD0y3Xd_gFuOzp5GOIBwtXy_2jFa4lsTi4r1k6OzkTe5HyJGkOK-fNspRoo54mEA5IB8K4f0fVZ9UpgTWlringYByYxw3Bn_X1c/w640-h360/GTV%20Pointer%20Remote%20Demo_SHELL.gif"></div>

<p dir="ltr">
  Pointer remotes bring motion-controlled input to the big screen, unlocking faster user navigation across the Google TV Home page and within content-heavy apps. To ensure your app is ready for this shift and provides a great experience for all users, now is the time to start thinking about pointing input. Here’s how to get started:
</p>

<h4><span>1. Adapt your TV app UI Library</span></h4>
<p dir="ltr">
  You’ll need support for hover states, scrollable containers, and cursor clicks to enable pointer remote interactions for your app on Google TV. While implementation varies by UI stack, Jetpack Compose streamlines this transition, as most core components handle these multi-modal interactions natively out of the box.
</p>

<ol type="a">
  <li><strong>Hover state:</strong> Every focusable element on your screen (buttons, movie posters, setting toggles) needs a clear visual feedback mechanism for a hover state. This is often subtler than a focus state but critical for feedback.</li>
  <li><strong>Scrollable containers:</strong> Pointer remotes will also have a small circular touchpad for scrolling. Users can use this touchpad to scroll up or down, or left or right in your app. Your app will need to respond to touch events to scroll.</li>
  <li><strong>Cursor clicks:</strong> Many TV apps today expect a simple D-pad OKAY button “click.” With a pointer remote, a user may “click” on an element that’s not the D-pad focus state, but is instead from a hovered state (similar to a mouse click).</li>
</ol>

<h4><span>2. Test pointing interactions with a mouse today</span></h4>
<p dir="ltr">
  To see how your app handles hover, scroll, and clicks, simply connect a bluetooth mouse or wired mouse to your Google TV. Keep in mind that a mouse has more precise control, since users are closer to the screen and typically rest the mouse in a stable position. Pointer remotes can often be less precise, since users are sometimes 10 feet away from the screen, making rough gestures with the remote from their couch. As a TV designer or developer, you can mitigate this lack of input precision by having larger hover targets for elements.
</p>

<h4><span>3. Declare TV app support for pointer remotes on Google Play</span></h4>
<p dir="ltr">
  Finally, tell Google Play that your TV app is designed to work with a pointer. This ensures that users with pointer remotes will be able to easily find, install, and interact with your app.
</p>

<p dir="ltr">
  Within your AndroidManifest.xml, declare the meta-data tag, <span>android.software.leanback.</span><span>supports_touch</span>. This tag informs the platform that your TV app “spatially supports touch,” since pointer remotes simulate touch events from a distance.
</p>

<p dir="ltr"><strong><em>AndroidManifest.xml</em></strong></p>

<pre>&lt;manifest ...&gt;
    &lt;!-- Signal whether the app is adaptive or built just for TV --&gt;
    &lt;uses-feature android:name="android.software.leanback" android:required="true|false" /&gt;

    &lt;!-- Ensure the app can be installed on conventional TVs --&gt;
    &lt;uses-feature android:name="android.hardware.touchscreen" android:required="false" /&gt;

    &lt;!-- Signal whether the app supports pointer remotes --&gt;
    &lt;meta-data android:name="android.software.leanback.supports_touch" android:value="true|false"/&gt;

    &lt;application ...&gt;
        ...
    &lt;/application&gt;
&lt;/manifest&gt;
</pre>

<p dir="ltr"><strong>Tips:</strong></p><ul>
  <li>The <span>android.<strong>software</strong>.<strong>leanback</strong></span> feature declaration indicates that your app supports D-pad navigation and is intended for distribution only on TV devices via Google Play.</li>
  <li>The new software attribute of <span>android.software.leanback.</span><span>supports_touch</span> declares that in addition to D-pad, you have ensured that your TV app works well for pointer/cursor experiences via mouse (of today) and pointer remotes (of future).</li>
  <li>If you haven't already, now is the time to adopt <a href="https://developer.android.com/compose">Jetpack Compose</a>. Hover, scroll, and clicks are common input modalities that are supported on various form factors, and building your app with an adaptive UI framework enables code reusability and reduced maintenance.</li>
</ul>

<h2 dir="ltr">Onboard the Engage SDK</h2>
<p dir="ltr">
  The Engage SDK, formerly known as the Video Discovery API, optimizes Resumption, Entitlements, and Recommendations across all Google TV form factors to boost app discovery and engagement.
</p>

<ul>
  <li><strong>Resumption:</strong> Partners can easily display a user's paused video within the 'Continue Watching' row from the Home page.</li>
  <li><strong>Entitlements:</strong> The Engage SDK streamlines entitlement management, which matches app content to user eligibility. Users appreciate this because they can enjoy personalized recommendations without needing to manually update all their subscription details. This allows partners to connect with users across multiple discovery points on Google TV.</li>
  <li><strong>Recommendations:</strong> The Engage SDK even highlights personalized recommendations based on content that users watched inside apps.</li>
</ul>

<p dir="ltr">
  It’s a great time to start onboarding the Engage SDK now, since the legacy Watch Next API, which has been powering your continue watching 1.0 experience, will lose support in the 2nd half of 2027. To get started, head to <a href="https://goo.gle/engage-tv">goo.gle/engage-tv</a> to learn more.
</p>

<p dir="ltr">
  We're excited to see how our latest Gemini experience and developer tools will optimize your discovery and drive user engagement on our platform.
</p>Explore this announcement and all Google I/O 2026 updates on <a href="https://io.google/2026/?utm_source=blogpost&amp;utm_medium=pr&amp;utm_campaign=devblogs&amp;utm_content=">io.google</a>.</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Build native Android apps in Google AI Studio]]></title>
<description><![CDATA[Posted by Emma-Louise Leavey, Group Product Manager and Mike Taylor-Cai, Product Manager

    Starting today Google AI Studio can build entire Android apps for you in minutes from just a prompt. You don't need to install any software or configure any libraries, which significantly lowers the barr...]]></description>
<link>https://tsecurity.de/de/3693512/android-tipps/build-native-android-apps-in-google-ai-studio/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693512/android-tipps/build-native-android-apps-in-google-ai-studio/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:46 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjd6QUmqCnkvDT9M0IoWA6y_752MRk01nHVQOa644yYkgoMGMDk8Dy6ow6X4SqFzzODP-a1kRaNcuF-1ZyR_lk5fTfdbuEMKDvuX4s7LFaGNuMswzvMCFoYeaQ3RLf2OZPYUWN5BsnqRIsmDub85hpYZNGY7AsaHCsHlfkxLqfqm0PozMhkyqK4i6WfgGM/s2048/GoogleForDevelopers-AndroidCombo2-StrapiMetacard-2048x1323.png">


<div><div class="separator"><i>Posted by Emma-Louise Leavey, Group Product Manager and Mike Taylor-Cai, Product Manager</i></div></div><div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVwPsGVUMbwR9wQP6ABNBXOWboTfwBPXTg-WwhpVo-nJsWJkXeFMUdU5lPsXYc6jh4bnFwI03EG8fIYgmwEkU8hUKHNgSfSYpDLzUgEX1kGLGoTXXfzqcIsh6ZVOHLcripkRitSymdVGwC0Hnwm1H6S-LdsKXLdkefuPp5mtBWC5H1ACTICDI_fNqsdoc/s4209/GoogleForDevelopers-AndroidCombo2-Blogger-4209x1253.png"><img border="0" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVwPsGVUMbwR9wQP6ABNBXOWboTfwBPXTg-WwhpVo-nJsWJkXeFMUdU5lPsXYc6jh4bnFwI03EG8fIYgmwEkU8hUKHNgSfSYpDLzUgEX1kGLGoTXXfzqcIsh6ZVOHLcripkRitSymdVGwC0Hnwm1H6S-LdsKXLdkefuPp5mtBWC5H1ACTICDI_fNqsdoc/s16000/GoogleForDevelopers-AndroidCombo2-Blogger-4209x1253.png"></a></div><br><div><br></div>

    Starting today <a href="https://ai.dev/apps?features=build_android_app">Google AI Studio</a> can build entire Android apps for you in minutes from just a prompt. You don't need to install any software or configure any libraries, which significantly lowers the barrier to development. Whether you’re a seasoned developer looking to prototype at lightning speed or a creator building your first-ever mobile experience, you can now go from a single prompt to a high-quality, Kotlin-based Android app in AI Studio. You can easily install the app on your device, share it with others for testing, or send it to Android Studio for any further development.</div><div><h2>The power of native Android</h2>While AI has made it easy to generate web-based apps, people want more on their mobile devices. They expect the beautiful and usable modern app design and capabilities that come with native Android user experiences, built with the Kotlin programming language using Jetpack Compose, the official and recommended toolkit for Android development. Native Android apps bring the reliability of offline support, continuous background services, and the deep integration of hardware sensors like GPS, Bluetooth, and NFC. We've brought the technology that enables you to <a href="https://developer.android.com/studio/gemini/create-a-new-project-with-ai">quickly create new projects with Gemini in Android Studio</a> directly into the web-based AI Studio. Now, you get the best of both worlds: the ease of a prompt-based interface paired with the power of the Android SDK, all in your browser, no installation required.<br><h2><span>A seamless, end-to-end workflow</span></h2>
    We have streamlined the entire development lifecycle so you can focus on your idea: </div><div><b><br></b></div><div><b>1. Create your app and iterate in the cloud:</b> Use the embedded Android Emulator directly in your browser to preview and interact with your app as it’s being built. No heavy SDKs to download, no local setup required.</div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWOTqLBbAXBibOw5wN_-49Q21RuGxwPjhQESK5r3KctKIPz1uV4dg0_LiK0w6xxdvbLECzMHzQk-kQO9h1VdflTPKi3wM9sKrwZvLcPbtISBnL2H4acnG8gpEuPtbxpDHexKi4S8Eg_hcQv1_dZOCh78pFGi27aiWHMYZc1gsDA_Iq7SRbVRUkHhngrgw/w640-h544/AI_Studio_creation_step_v2.gif"></div><i><div><i>Use the embedded Android Emulator to create and edit Android Apps right in the web browser</i></div></i><div><br></div><b>2.</b> <b>Install instantly: </b>Connect your Android phone using a USB cable and install your app directly from AI Studio using the integrated Android Debug Bridge (adb).</div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHMqfor305bPNhs_X2ahAxG8QmtpxtLKPrq44Uh4q1OpdsZyDlAuIyKJJDk-2v75-ErSLNp8yCyHQZn-6IQ-mkz8mfedEFtEJuD6VILIhtt8ypGpXmRuqM9LoJDDNnn-xrX3_Cr2MRUUcaEhVpJgCsjrjz-kwHHQeIhq8celQjg5Rt5_S5-j-_eSYpYaU/w640-h544/AI_Studio_Install_v2.gif"></div><div><i>Install the app on your Android device</i></div><div><br></div><b>3. Streamlined Publish to Google Play: </b>Using your <a href="https://play.google.com/console/signup">Google Play developer account</a>, you can now publish your app directly from AI Studio for testing. AI Studio will automatically create your app record, package the bundle, and upload it to an internal testing track in Google Play Developer Console. Your app is available for you to install within minutes, and you can automatically update your app on your device as you develop it further in AI Studio. </div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqGamXSrq6MNtz-PUt17netBXi_JiOMVERsoYV2mEArG8x5f-zCbU8WwTTaClpruCTsN4o3xeyMylDJLaWe0yCteqZJghc6sEXLYwoLPbTtnoa7761JVR_XEbm2Fj20IX142L2mGzU39vuNwLVVw0bDiSwICFelQZhxO63sG9N3GCo8Xx8wHY6gPEDj8c/w640-h544/AI_Studio_Play_v3.gif"></div><div class="separator"><i>Publish the app to an internal test track in Google Play</i></div>

    <br><div><b>Seamless app development handoff </b></div><div>As you iterate on your app in AI Studio, you may find you need more advanced Android tools or support for a wider variety of Android device types. To move beyond the browser, you can seamlessly hand off your project to <a href="https://developer.android.com/studio">Android Studio</a> by downloading a ZIP file or exporting it directly to GitHub.</div><div><br></div><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNTwSv8o6QwB9QYZS_OezD7WhWQZiShTEu5aJz6_oGUfOu-2RQWmANs0jgeC1G1jrsZauVbeWzLHkjoZa_Ai_cjKvgbB_-Qzqh8-obzcNf9zKTJSG4AfvXTogb0xsCxcHRS4P-LHFKk1pm8sTdDjIn8A5b9vX8GRRvHrCvN9_xoPm6hPzN1rct5Aph3Zc/w640-h206/AI_Studio_Download.png"></div><div><span><i>Download zip file of Android app project files</i></span></div><div><span><i><br></i></span></div>When transitioning to a team environment or local development, you can leverage any IDE or agent you prefer. For a specialized experience, we recommend <a href="https://developer.android.com/gemini-in-android">Gemini in Android Studio</a>, which features models designed with Android in mind, or Antigravity, which integrates <a href="https://developer.android.com/tools/agents/android-cli">Android CLI</a> commands into Google’s agentic development platform. This workflow makes building high-quality apps more accessible while giving you total flexibility in how you use AI to scale your project.</div><div><h2>Start building today</h2><div>To ensure a safe, high-quality ecosystem from day one, we have focused our initial release on specific capabilities including:</div><div><ul><li><b>Personal utilities and simple social apps: </b>You can rapidly prototype single or multi-screen apps, such as habit trackers, study quizzes, or event itineraries.</li><li><b>Hardware-enabled experiences:</b> Because you are building native apps, you can leverage device features like the Camera, GPS/Location, Accelerometer and Bluetooth using the native Android APIs, letting you optimize hardware-level performance.</li><li><b>AI-powered experiences: </b>You can create apps that feature Gemini API integrations, seamlessly embedding powerful AI capabilities directly into your mobile experience.</li></ul></div><h2><span>What’s Next?</span></h2>
    <div>We are moving fast to expand what’s possible for creators in AI Studio. Here is a sneak peek at what is coming soon:</div><div><ul><li><b>Managing Google Play Test Tracks: </b>Coming soon, we will be adding the ability to invite testers to try your app directly from AI Studio. </li><li><b>Firebase integrations: </b>Out-of-the-box support for Firestore, Firebase Auth, Firebase App Check and other tooling critical for Android developers is coming soon.</li></ul></div><div><br></div><div>Head over to <a href="https://ai.dev/apps?features=build_android_app">Google AI Studio</a> right now to start building. Here is some inspiration to get you started… </div><div><br></div><table border="1">
        <tbody><tr>
            <td colspan="2">Turn your Google Pixel Watch into an aviation assistant</td>
        </tr>
        <tr>
            <td>
                <strong>Prompt:</strong><br>
                <div>Build a small airplane "6-pack" instrument app for Google Pixel Watch. The 6 instruments should include attitude indicator, airspeed indicator, altimeter, turn coordinator, vertical speed indicator, and heading indicator. Use the Google Pixel Watch's sensors to power the instruments and display them clearly. Display one instrument at a time on the display. Swiping to the left or right should cycle through the instruments.</div>
            </td>
            <td><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhRi7_vRI0TgaUYUE-g6kX-Gbg5Vf8ZVNY0H5n-2p8Ml32hyphenhyphenFvWAjp5re6AWpFKHLv1-rokBy_qfXexN61uQ9bpeDE_1DKfTrY3CkepiZMkNIEC5UlvBYng_OqersnyVS5Nu_zCuJJQ2w4NBaxWDC8duVnC0ILvWEpeg49N7aoJh1z6o_-BJHfBCnZKpz0/s320/wearOS_ai_studio.gif"></div><br></td>
        </tr>
    </tbody></table>

    <br><table border="1">
        <tbody><tr>
            <td colspan="2">Interactive Harmonium app on Google Pixel Fold</td>
        </tr>
        <tr>
            <td>
                <strong>Prompt:</strong><br>
                <div>Build a Harmonium app for Pixel Fold devices, which plays like the instrument based on the hinge angle and touch gestures. The app should simulate the bellows and reeds accurately.</div>
            </td>
            <td><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8hUGuJaj76omAAgO2RqZKZ_qGvgThfE0tKA-99BJ82G2UOw8h1qT5H7sM5C7n_k2tN5CD0LpJyOFor3HefsKarRPmWTo35ltnDihv2MsddEUcZN5t5fgeJWuJ60Y3XCEqqLhd7gkGyAbM6vnGau0PLE8BohPat8lQ-63fQLudrFUVRVpkFUJ9wMFX1oc/w179-h200/Tiny%20Harmonica%20demo.gif"></div></td>
        </tr>
    </tbody></table>

    <br><table border="1">
        <tbody><tr>
            <td colspan="2">An Android app for guitarists to become better musicians by jamming to backing tracks </td>
        </tr>
        <tr>
            <td>
                <strong>Prompt:</strong><br>
                <div><div><span>Build an Android guitar practice companion app that features a two-tab navigation system: 'Fretboard' and 'Library'.</span></div><div><span><br></span></div><div><span>The 'Fretboard' primary screen must contain an interactive guitar neck UI that visually maps out user-selected root notes, musical scales, and chords. Above the fretboard, implement a WebView-based YouTube player configured to play embedded videos inline. Additionally, include an AI generation feature that uses Retrofit to call Gemini Lyria 3 to create custom, 30-second backing tracks based on the user's currently selected key and scale. The generated audio files and their metadata must be saved locally using a database and displayed as a list in the 'Library' tab, where users can delete or play them.</span></div><div><span><br></span></div><div><span>Finally, implement a persistent, globally visible mini audio player at the bottom of the screen, complete with play/pause toggles, a progress slider for seeking, and timestamp text, allowing the user to seamlessly practice on the fretboard tab while listening to their tracks.</span></div><div><br></div></div>
            </td>
            <td><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2pWobL4G7-4deWwvMpRmtfHG1OuXyc_bHwq6fPszYT1Vztm4g_HaN28PVg6Hwd3_N2Qd82HS1QtpUGKCTUFiCuLBwMpcA-8sMC6dJtSDGKEVAaV1kxumYMZi3kTB9NnUIEf9xQPKyyfvKb8MZUyNGnYNAEHTxyHpWCEvN2xgQsj5X09LW_FHU1n0aJQg/w221-h400/guitar_app_AI_Studio.gif"></div></td>
        </tr>
    </tbody></table>

    We are looking forward to seeing what you build next!</div><div><br></div><div>Explore this announcement and all Google I/O 2026 updates on <a href="https://io.google/2026/?utm_source=blogpost&amp;utm_medium=pr&amp;utm_campaign=devblogs&amp;utm_content=">io.google</a>.</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[17 Things to know for Android developers at Google I/O]]></title>
<description><![CDATA[Posted by Matthew McCullough, VP, Product Management, Android DeveloperToday at Google I/O, we announced the many ways we’re powering agentic workflows to increase your productivity and ensure your apps shine across the expanding Android ecosystem. Here’s a recap of 17 of our favorite announcemen...]]></description>
<link>https://tsecurity.de/de/3693511/android-tipps/17-things-to-know-for-android-developers-at-google-io/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693511/android-tipps/17-things-to-know-for-android-developers-at-google-io/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:45 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjP7OJeCTRC-RN9j39-rULmU26qB-lZoyIZjjDrq07Z7b5GsfHz3q18ftSgcWReGBgIBkp03B6BVghzWllOC38o4jckzzq-e4a8R23ISeegev98zubhGXbIzhTZaqbCTaPLJC2zkxKYvvNspcM4yXkk94f6PEQHpdyMvlpwogicTWQRn3GEksJHOTQDIG4/s2048/GoogleForDevelopers-AndroidText-StrapiMetacard-2048x1323.png">


<div><div class="separator"><div class="separator"><div class="separator"><i>Posted by Matthew McCullough, VP, Product Management, Android Developer</i></div></div></div></div><div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVq21_VInGStxa8CNxcwiU_tpvlkPXci8aDeSb8qUqBe4teuWUN_vIqBf_W64xjTQMBYFyJkdXB-nshsp9DXXEwzUV8-Zn9feQTbuyLk8l98kAlFQqz3_LZrYaEvCukqXCZuY95tmNzrLFqXSviaTTSxflyAkpXJb88cB7mZ7g0x6fdnKzXqY8i1jmhqM/s4209/GoogleForDevelopers-AndroidText-Blogger-4209x1253.png"><img border="0" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVq21_VInGStxa8CNxcwiU_tpvlkPXci8aDeSb8qUqBe4teuWUN_vIqBf_W64xjTQMBYFyJkdXB-nshsp9DXXEwzUV8-Zn9feQTbuyLk8l98kAlFQqz3_LZrYaEvCukqXCZuY95tmNzrLFqXSviaTTSxflyAkpXJb88cB7mZ7g0x6fdnKzXqY8i1jmhqM/s16000/GoogleForDevelopers-AndroidText-Blogger-4209x1253.png"></a></div><div><br></div>Today at <a href="https://io.google/2026/">Google I/O,</a> we announced the many ways we’re powering agentic workflows to increase your productivity and ensure your apps shine across the expanding Android ecosystem. Here’s a recap of 17 of our favorite announcements for Android developers; you can also <a href="https://www.youtube.com/live/KvTRMSa1w4E?si=QBAxNvihPwJCJUuS">see what was announced last week</a> in <a href="https://developer.android.com/events/show">The Android Show: I/O Edition</a>. Stay tuned over the next two days as we dive into all of the topics in more detail!<h2><strong><span>Build High Quality Android Apps Using Agents</span></strong></h2>

  <h3><strong><span>1: Android CLI: helping you build with any agent, LLM, and tool</span></strong></h3>
  <a href="https://goo.gle/CLI_IO26">Android CLI is now stable</a>. It offers programmatic tools that allow any AI agent, including Claude Code, Codex, or Antigravity, to perform core Android tasks much more easily and efficiently. With today’s release, it also provides a bridge to tap directly into the "heavy-lifting" power of Android Studio to give you the production-ready polish needed for professional Android development. By leveraging the new android studio commands, developers can now grant their preferred agents the ability to perform semantic symbol resolution, analyze files for warnings, and even render Jetpack Compose previews. This release also enables official support for "Journeys" through new <a href="https://developer.android.com/tools/agents/android-skills">Android skills</a>, which enables agents to execute end-to-end UI tests under your direction. Watch the <a href="https://www.youtube.com/watch?v=aqmpZocmR8o&amp;list=PLOU2XLYxmsIKL_eEgkKJWDRhYUEvS9eYz&amp;index=23">developer keynote</a>, and tune into the <a href="https://io.google/2026/explore/pa-keynote-7">What’s New in Android tools talk</a> for more information.    <p><span></span></p><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXrW3yDK9uH_I8MDyVxgYbPAXfrNTJvlMkXhaZFrM1X9ob0LvQbGe_ZC6anUeO_VNd181iptI_MIuEEpX-9GZdf6ZTJCN-WHpPzDCLOeSblo8vrjliSZ0rRrHwIsERWBjbbosP-M_WvA2pva9mF5FWVygAwQbdiW3SLZgJj9TpRIruG4H-ILsvSq_b4dc/w640-h442/agy-android-cli%20(2).png"></div><div class="separator"><span><i>You can now easily install Android CLI for use with Google Antigravity 2.0.</i></span></div><p></p>

  <h3><strong><span>2: Build production-ready apps with ease in Google AI Studio</span></strong></h3>
  Developers and creators can now <a href="http://android-developers.googleblog.com/2026/05/build-android-apps-google-ai-studio.html">build native Android apps, simply with a prompt in Google AI Studio</a>. The apps are built with development best practices like Jetpack Compose, Kotlin, and APIs that leverage our recommended developer patterns. Google AI Studio enables developers to prototype, iterate via an embedded emulator, and deploy to physical devices without heavy local installations. Developers are then able to take those apps and share them to Android devices, as well as share them with others for testing through Google Play Console’s internal testing track. If a developer wants to prepare their app for a wider release, they’re able to take it to Android Studio for advanced debugging, testing, and UI polish. Watch the <a href="https://www.youtube.com/watch?v=aqmpZocmR8o&amp;list=PLOU2XLYxmsIKL_eEgkKJWDRhYUEvS9eYz&amp;index=23">developer keynote</a>, and tune into the <a href="https://io.google/2026/explore/pa-keynote-7">What’s New in Android tools talk</a> for more information.<br><br><div><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdRaw1v6rolr4alo0C6AWKdFchsMEQgtOGfmk2Ramb0IoOB7smDcVU3yC7YJMkvVQuCPJ9vQW53tQjaV-5wcgOGzMtFDmb_Jbv40an1kvQdqYburXnsONvLqckKL2MWuShi3XmQEstW761oOLjujOk3FMsh3FyAiy5-Pe7xdTwFdfkWOmEnHhQfUJhtCo/w640-h544/image1.gif"></div><i><div class="separator"><i>Use the embedded Android Emulator to create Android apps in Google AI Studio</i></div></i></div><h2><strong><span>3: Accelerating AI coding assistance with Android Bench</span></strong></h2>
  <a href="http://d.android.com/bench">Android Bench</a> is our LLM leaderboard for Android development challenges. The goal is to accelerate model improvements, so you have more useful options for AI assistance. Many of you have been using open-weight models for AI assistance, so we’re now adding commonly used ones, such as Gemma 4, to the leaderboard, so you can see how LLMs that offer offline access and additional flexibility for power-users measure up. We're continuously working on increasing the difficulty of challenges we’re giving LLMs, to continue encouraging more useful improvements. <h3><strong><span>4: Convert iOS apps to Android with the Migration Assistant in Android Studio</span></strong></h3>
  The Migration Assistant in Android Studio is designed to port apps from platforms like iOS, React Native, or web frameworks to native Android. By simply selecting an existing project, developers can have the agent intelligently map features, convert assets like storyboards and SVGs, and implement Android best practices using Jetpack Compose and our recommended Jetpack libraries. This effectively transforms what used to be weeks of manual porting into a streamlined agentic workflow that only takes hours. We shared a preview of the incoming feature in the <a href="https://www.youtube.com/watch?v=aqmpZocmR8o&amp;list=PLOU2XLYxmsIKL_eEgkKJWDRhYUEvS9eYz&amp;index=23">developer keynote</a>. </div><div><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjK7UKI_nzS7gOkDXYONAjCNbQ4eSqlgT8qqMT5D4qf0OjQUNtxj4Urpq-eTROMEDgrqLKGlwMm_lHA7ayG_BC1DkitQI1ZKsF5gYr-mPIxFUsz_8JPcVHFAtnHZoO2CrVjMEvJrqvBz8_WU1I0T1P2diDprR2B47PcA21oS3RLtbgrhmrpiWV-MAw9ks4/w640-h360/image9%20(1).gif"></div><div class="separator"><i>A sneak peek of the Migration Assistant converting an iOS app into a native Android app</i></div>

  <h2><strong><span>Building AI Into Your Apps</span></strong></h2>

  <h3><strong><span>5: Building Intelligent Apps with generative AI</span></strong></h3>
  Generative AI enables you to create apps that are more intelligent, personalized, and agentic than ever before. This year, we introduced the latest advancements in on-device intelligence with a preview of Gemini Nano 4 for tasks like data extraction and summarization. We also expanded cloud capabilities via Firebase AI Logic, allowing developers to leverage Gemini models with robust grounding (including URL, Maps, and web search) to build smarter, more capable assistants. Furthermore, we unveiled our hybrid inference approach and the new <a href="https://goo.gle/ADK_IO26">Agent Development Kit (ADK) for Android</a>, alongside communication protocols like AG-UI and A2UI that simplify the creation of autonomous, agentic experiences. To start integrating these powerful features, explore the <a href="https://developer.android.com/ai">developer documentation</a>, and watch the technical deep dive session where we showcase all these technologies.

  <h3><strong><span>6: Experiment with AppFunctions today</span></strong></h3>
  AppFunctions is an <a href="https://developer.android.com/reference/android/app/appfunctions/package-summary">Android platform API</a> with an accompanying <a href="https://developer.android.com/jetpack/androidx/releases/appfunctions">Jetpack library</a> to simplify building Android MCP integrations. It empowers your apps to behave like on device MCP servers, contributing functions that act as tools for use by agents and assistants. AppFunctions integration with Gemini is currently in a private preview with trusted testers, and you can begin preparing your apps already. You can sign up for the <a href="http://goo.gle/eap-af">Early Access Program</a> and start experimenting using the <a href="http://d.android.com/ai/appfunctions">API guidance</a>, <a href="https://github.com/android/appfunctions">sample</a>, and <a href="https://github.com/android/skills/blob/main/device-ai/appfunctions/SKILL.md">skill</a> today.

  <h2><strong><span>The Future is Adaptive</span></strong></h2>

  <h3><strong><span>7: Android is now Compose First; Views are now in maintenance mode.</span></strong></h3>
  Compose is our standard for UI development, and we are moving to a Compose-first approach for all future guidance and libraries. Building on five years of evolution, the latest releases deliver a more mature toolkit, from the highly customizable Styles API to refined shared element transitions and enhanced input support. These updates allow you to build beautiful, adaptive apps with less code and better performance. Learn more about what Compose-first means for Android Development in <a href="http://android-developers.googleblog.com/2026/05/android-ui-development-is-compose-first.html">our blog post</a>. <br><br></div><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgq9kh5gxOfSdY2w9ZeKdWropXpqP7rj4KtodIZA5B_j7ujQu-blrsQKKC0lI4VEsEycpLEwsZeJhHaNOY1Xe9DrIHDwVszYfQN0GQlwxz8xoVfg1oiIr9zNlUyqqdCl2M7pyHoHgVvC7omKRthmXNaO3GE5Q15XeZ1ALiugszd8qHxpWuHo2Eh79zYW4M/w640-h416/image5.png"></div><div><div><i>Build Android UI with Compose</i></div><h3><strong><span>8: Building seamless Android experiences across devices with Jetpack Compose</span></strong></h3><div>The Android ecosystem is now <a href="https://goo.gle/AdaptiveApps_IO26">Adaptive by Default</a>, moving fluidly across phones, foldables, tablets, cars, XR, and expanding usages with <a href="https://developer.android.com/googlebook">Googlebook</a> and connected displays. With over 580 million large-screen devices, and users on multiple devices spending up to 14x more on apps, the investment in adaptive design presents a massive opportunity. <a href="https://developer.android.com/compose">Jetpack Compose</a> is the definitive engine for this transition, offering core tools like our latest <a href="http://goo.gle/nav3">Jetpack Navigation 3</a> release, new experimental <a href="https://developer.android.com/develop/ui/compose/layouts/adaptive/grid">Grid</a> and <a href="https://developer.android.com/develop/ui/compose/layouts/adaptive/flexbox">FlexBox</a> layouts, enhanced non-touch input support, and <a href="https://developer.android.com/media/camera/camerax">CameraX</a> for correct camera previews across any window size. Furthermore, new <a href="https://developer.android.com/tools/agents/android-skills">skills</a> in Android Studio make updating your existing app to adopt these adaptive patterns easier than ever.

  <img src="https://blogger.googleusercontent.com/img/a/AVvXsEi3DD3G6IUrmOwYh7bMq0uieBvGL8li2W48YnUfQfa3ZXy2kD7QvPorNfAyCSmFlBs4q0csXDqmZjhyGf8UHFE2pUNjvqxLaaJhmm6QpSBumq2YkMHI1jyiTNfh5WQhEEY9hP6vWhcbbwflygdTwYzoIdnuIqoht0S6iGKk4pVCnxL2wVXYBMBlcdeneD8"><i>Notability’s Android debut sets a new standard for premium productivity apps. Built with Jetpack Compose, Navigation 3, and Kotlin Multiplatform, it delivers an intuitive, adaptive experience across devices.</i></div><h3><strong><span>9: Create seamless experiences for Googlebook</span></strong></h3>
  Last week we announced <a href="https://developer.android.com/googlebook">Googlebook</a>, a high-performance laptop that provides a large-screen canvas for your existing apps. Building with adaptive principles today helps ensure your app will work on Googlebook. Get started by reviewing relevant <a href="https://developer.android.com/design/ui/desktop">design guidance</a> and <a href="https://developer.android.com/docs/quality-guidelines/adaptive-app-quality/experiences/desktop">developer guidelines</a> for desktop experiences. Try out the new Desktop Emulator available in the Android Studio Canary to to test your apps for this form factor today.</div><div><br></div><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtH3cjiXICi8dNCtQTDV9PTyjt4wPQBl1xA9XGKGU6FmqLRuBm9YyH7HNQsydD6H6F2GIPw2TdUsFyeu2xMFUO2Jk36k5QXjuWNdm_VE8AQftq2w2m0RPFyYfyZjTppSOjzuOEpJMzF08t9V0YZr-xI7mu31uvcRItugwvVxPUBouSmOXt1MsqbB1WPC0/w640-h360/image3.png"></div><div><div><i>New Desktop Android Emulator</i></div><h3><strong><span>10: Unified widget development experience with Jetpack Glance</span></strong></h3>
  Android 17 marks a shift toward a single, Compose-based development model for all widgets. By unifying the experience across mobile, Wear OS, and cars through Jetpack Glance, you can soon scale UI components across the ecosystem with a familiar workflow. <br><br>The breakthrough this year is the integration of RemoteCompose. On mobile and cars, it powers high-fidelity animations, while on Wear OS, it allows Wear Widgets (formerly Tiles) to render complex UI logic natively on remote surfaces. This ensures peak performance on low-power hardware while allowing a cohesive user journey—like checking a flight status on your car dashboard and seeing gate change updates on your wrist.</div><div><br></div><div><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiA5s4g4hCW89qdeC2oqrTtxh6q7t9q3-wkOSt3tfVzCT3vhLUd1GMYJrhCjK04O2jyxBGl0R2pclnRq3Kb0f0Td-hV9aukKvZQTfGpGJS6GLK0MqUkpVW_0qiNC1eMGe6NPPhlCHrnQWFYhmbdSzpDnUHh5tjvpmUzZOvY2w_dX1LBnpNctSRmeahXUl4/w640-h320/blog_widgets.gif"></div><div><i>Four widgets are shown cycling through in the Android Auto interface. A clock, a contact card, Google Home favorites and a photo.</i></div><div><i><br></i></div><div><strong><span>11: Expand your reach on the road with Android for Cars</span></strong><br>To help you expand your reach when you build in-car experiences, we're making it easier to build once and deliver your apps to Android Auto and Android Automotive OS. With the latest releases of the Car App Library, you can build customized, distraction-optimized <a href="https://developer.android.com/training/cars/apps/media">templated media apps</a> for both platforms. We're introducing new <a href="https://developer.android.com/design/ui/cars/guides/components/overview">components</a> and template capabilities to give you increased flexibility and more options for laying out content. Parked experiences are expanding too, with immersive video playback coming to Android Auto for phones running Android 17. You can easily adapt your video apps for these parked experiences; <a href="https://docs.google.com/forms/d/e/1FAIpQLSf0z4Nfw8wrloVhlgHDpLgdkg4WXsFj9ni5c1pw0qTvJ3Q4fQ/viewform">apply now to the early access program</a> to publish in these beta categories and learn more about the latest updates in our <a href="http://android-developers.googleblog.com/2026/05/android-for-cars-unifying-platforms-premium-experiences.html">blog</a>.<h3><strong><span>12: Accelerate your development with Android XR Developer Preview 4</span></strong></h3>Inspired by the innovative experiences you’ve built for the platform, we’re continuing to mature our tools with <a href="https://goo.gle/XRSDK_IO26">Developer Preview 4 of the Android XR SDK</a>. A key milestone in this journey is the transition of our core libraries, XR Runtime, Jetpack SceneCore, and ARCore for Jetpack XR, moving to Beta soon to provide a more stable and performant foundation. We are also accelerating hardware access through the <a href="https://goo.gle/Catalyst_IO26">Android XR Developer Catalyst Program</a>, where you can apply for XREAL’s Project Aura, audio glasses, or display glasses developer kits. Watch The latest in Android XR session or <a href="https://goo.gle/XRSDK_IO26">read our blog</a> to see how these updates help you build experiences across the ecosystem.</div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyjbgGH7RwGkOkQLoXeLd88Vo7cXRjHLBSRokBWkzvYQUrqqbfrTXukM1u_SuGq0-AoXRPoGABpCOF-HMad4-aoNvXjTVyNXgGpbffTlSQMbTaXJva1c2GiUBx1fhC4fCCd0XO9XFzKNzs6edNqo0RAx-p2ZNXy0l-StJh7AxhyphenhyphenrXi-lqe-jXL0n8oprs/w640-h360/Aura%20Geospatial%20Tour%20Demo%20-%20Draft%2001%20(1).gif"></div><i><div><i>Early preview of the Geospatial API  in ARCore for Jetpack XR, enabling high-precision anchoring of digital content to real-world locations.</i></div></i><h3><strong><span>13: Android is your new home for professional-grade media experiences</span></strong></h3>
  Android 17 streamlines the entire media lifecycle with a production-ready toolkit. High-fidelity capture is now simplified with the CameraXViewfinder Composable, which handles complex scaling and responsiveness on foldables and tablets. For post-production, the new Media3 AI Effects library provides a single interface for premium features like Magic Eraser and Studio Sound, automatically optimizing for the device's hardware. <br><br>The pipeline is completed by CodecDB, offering chipset-specific encoding recommendations to eliminate export noise, and a new Scrubbing Mode in ExoPlayer for ultra-smooth seeking. Whether you’re compositing multi-asset edits with Media3 Transformer or using the streamlined CastPlayer API, these updates ensure a professional-grade experience with significantly less development overhead.</div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXXvjrWhhRUXdYJyhuu-Vnf0UP2jKcYhAvUggZJi10kndrixZdx4cD8HEhrWVmavlxAUT5N025Fx1kgOLJP5w83LDUSR3E9YzfIJUuZ3WBedFSBtI_oLgIcxSOYg-s53obwX_8HtYqfxSaz95LVzSiMAdrrwgL4T6TVETwtxxkZV2mSkkAfvYA681zNlc/w640-h542/supercharge%20(1).gif"></div><div class="separator"><i>Low Light Boost and Magic Eraser in action</i></div><h3><strong><span>14: Increase app discovery and engagement on Google TV</span></strong></h3>
  Pointer remotes, which enable motion-controlled input, will be a future way for users to interact with Google TV as it unlocks faster user navigation. App developers can start <a href="https://developer.android.com/training/tv/get-started/hardware#no-touchscreen">declaring support for pointing input</a> to ensure their apps are discoverable on future TVs with pointer remotes. Additionally, the Engage SDK, formerly known as the Video Discovery API, optimizes Resumption, Entitlements, and Recommendations across all Google TV form factors to boost app discovery and engagement. It’s a great time to start onboarding the Engage SDK now, since the legacy Watch Next API, which has been powering your continue watching 1.0 experience, will lose support in the 2nd half of 2027. Get all the details in our <a href="http://android-developers.googleblog.com/2026/05/increase-google-tv-app-discovery.html">blog</a>.</div><div><h3><strong><span>15: Performance: the foundation of a great app experience</span></strong></h3>To help developers navigate memory limits in Android 17, we've launched a suite of optimization tools. The <a href="https://developer.android.com/r8-analyzer">R8 Configuration Analyzer</a> identifies keep rules that are bloating your binary, while <a href="https://developer.android.com/topic/performance/tracing/profiling-manager/how-to-capture">ProfilingManager</a> and the integrated LeakCanary in Android Studio streamline memory leak detection. Furthermore, the new <a href="https://developer.android.com/android-performance-analyzer">Android Performance Analyzer</a> offers advanced AI integration for complex trace analysis and automated SQL query generation to pinpoint performance bottlenecks.     <h2><strong><span>And The Latest on Driving Business Growth </span></strong></h2>

  <h3><strong><span>16: What’s new in Google Play</span></strong></h3>Today's <a href="https://goo.gle/play-io26">updates from Google Play</a> help expand your reach and scale your business with less complexity. We’re redefining Play Store discovery with an immersive, short-form video format called Play Shorts, while expanding your audience beyond the store with app discovery in the Gemini app on Android and web. Plus, we’re introducing powerful new capabilities like agentic catalog management for seamless bulk price and SKU updates, and using Gemini models to enable Play Console  to pre-populate store listings from imported documents—making global localization effortless. </div><div><br><div class="separator"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOB1wGZNYGPgY0ED70X7Dtl2KiFk8kRH4fv3HrXXTWX0-xKkN4Em0mi8QAB0g2w_-4SNcTR4fJazpiQ7XI6-XKeyQniFhULKWNmV8YvyWMuQ9tosvT5ixZ0FOye27DI90R5Tra1eWX3FCX7OrWkgzhvhCD6vtfD8_6-FMfMWDvXoVv3zSTauZwraDGsM4/w640-h360/IO26_BlogInLine_App-discovery-in-Gemini_1920x1080_1605.gif"></div><div><i>Gemini will provide users with app suggestions during a search</i></div>

  <h3><strong><span>17: And of course, Android 17</span></strong></h3>
  Android 17 includes new performance &amp; system architecture improvements (in addition to app memory limits) like a lock-free MessageQueue and a GC with more frequent, less intensive young-generation collections to ensure system-wide stability and smoother UIs. The new <a href="https://developer.android.com/about/versions/17/features/contact-picker">contact picker</a> and <a href="https://developer.android.com/reference/android/content/Intent#ACTION_OPEN_EYE_DROPPER">eyedropper API</a> help minimize the use of sensitive permissions and unnecessary access to user data. <br><br>Review <a href="https://developer.android.com/about/versions/17/behavior-changes-all">the behavior changes</a> to make sure your app is ready for Android 17, including <a href="https://developer.android.com/about/versions/17/behavior-changes-all#bg-audio">background audio hardening</a> and <a href="https://developer.android.com/about/versions/17/behavior-changes-all#sms-otp-all-apps">SMS OTP protection</a>. Get ready to <a href="https://developer.android.com/about/versions/17/behavior-changes-17">target Android 17</a> (API 37) with changes such as mandatory large-screen resizability, certificate transparency by default, and restricted local network access. You can start testing today by enrolling your device <a href="https://android-developers.googleblog.com/2026/04/the-fourth-beta-of-android-17.html">in the Beta</a> or using the latest 17.0 emulator images. <br><br>One more thing. the third beta of our Android 17 quarterly platform release (QPR1) just came out, and it contains a minor SDK release to support a few features that just couldn't wait for QPR2.

  <h2><strong><span>Check out all of the Android &amp; Play Content at Google I/O </span></strong></h2>
  <p><span face="sans-serif">This was just a preview of some of the updates for Android developers at Google I/O. Tune into <a href="https://io.google/2026/explore/pa-keynote-5">What’s New in Android</a> for the latest news and announcements and <a href="https://io.google/2026/">follow Google I/O</a> for much more over the following week!</span></p></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Top AI on Android updates for building intelligent experiences from Google I/O ‘26]]></title>
<description><![CDATA[Posted by Jingyu Shi, Staff Developer Relations EngineerAt Google I/O 2026, we introduced Android’s shift from an operating system to an intelligence system. We also demonstrated how you can build intelligent experiences natively with the system and bring the power of Google’s AI into your apps. ...]]></description>
<link>https://tsecurity.de/de/3693510/android-tipps/top-ai-on-android-updates-for-building-intelligent-experiences-from-google-io-26/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693510/android-tipps/top-ai-on-android-updates-for-building-intelligent-experiences-from-google-io-26/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:43 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqtr_NVZaXiVnywBK8bKIamZw4oM3DFopMeWXl_DsHJktlRpmuCkOCQEkc85z-xJ8id7DT8ggl6OopYCndxxYb8kA2LIttV3DlL1Mzmt5OffK_Lyq1q_mxg4RdUjQ23rOyNY5N3wopBtBODH-HQsPRqBc8cS8Kw0Azhz14Jn8EjEdKQ3znXGLRVUpM_-g/s4097/Blog_Meta@2x.png">



<i>Posted by Jingyu Shi, Staff Developer Relations Engineer</i><div><i><br></i><div><name content="IMG" twitter:image=""><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnWqvWK7oNvOOsTjwsLlEtnmvh7HwduYCahIBBtGUCUZQmQ0pfEWvk3hH0xlrnhyi5oZzY_ZU22jLYl-IA00DVLLi0No_oYWTXYZSk95GLU5P-IirCS74fx2MAUV5mKO_p_6SvFiiNmFnuUoet0QHyMjc8TeLE4Ie7HE3wcFfNeFzkN66IDCkNx1QYQiI/s8419/BLOG%20HERO_BLOGGER@2x.png"><img border="0" data-original-height="2507" data-original-width="8419" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnWqvWK7oNvOOsTjwsLlEtnmvh7HwduYCahIBBtGUCUZQmQ0pfEWvk3hH0xlrnhyi5oZzY_ZU22jLYl-IA00DVLLi0No_oYWTXYZSk95GLU5P-IirCS74fx2MAUV5mKO_p_6SvFiiNmFnuUoet0QHyMjc8TeLE4Ie7HE3wcFfNeFzkN66IDCkNx1QYQiI/s16000/BLOG%20HERO_BLOGGER@2x.png"></a></div><br><i><br></i><p></p><p><i></i></p><br></name><div>At Google I/O 2026, we introduced Android’s shift from an operating system to an intelligence system. We also demonstrated how you can build intelligent experiences natively with the system and bring the power of Google’s AI into your apps. If you missed these updates, check out our quick recap video here: </div><div><div><name content="IMG" twitter:image=""><br><div class="separator">
<div class="separator">
  
  
</div>
  <br></div></name><h4><name content="IMG" twitter:image=""><b><span>1. Putting your apps at the center of the intelligence system</span></b></name></h4><name content="IMG" twitter:image=""><div>The Android OS already enables agents like <a href="https://www.android.com/gemini-intelligence/?utm_source=blog.google&amp;utm_medium=owned&amp;utm_campaign=next">Gemini</a> to complete task automation, where it can navigate an app on the users behalf. </div><div><br></div><div><a href="https://developer.android.com/ai/appfunctions">AppFunctions</a> (Android MCP) provides you with more control over how your app integrates with the intelligence system. This new platform API and Jetpack library are currently available in experimental preview. </div><p></p><ul><li><name content="IMG" twitter:image=""><b>Android MCP:</b> AppFunctions allows your application to act as an on-device Model Context Protocol (MCP) server. It means you seamlessly share your app's tools, services and data to the system and agents.</name></li></ul><p></p><p></p><ul><li><name content="IMG" twitter:image=""><b>Streamlined Development: </b>You can leverage the new <a href="https://github.com/android/skills/tree/main/device-ai/appfunctions">skill</a> to easily generate AppFunctions within your codebase.  </name></li></ul><p></p><p></p><ul><li><name content="IMG" twitter:image=""><b>Exploration and Testing:</b> We’ve released a new <a href="https://github.com/android/appfunctions/releases">test agent</a> that allows you to experiment and debug your AppFunctions in a simulated agent environment. </name></li></ul><span><div align="center" dir="ltr"><table><colgroup><col></colgroup><tbody><tr><td><div><span face='"Google Sans Text", sans-serif'>Early Access Program</span><span face='"Google Sans Text", sans-serif'>: Want to be among the first apps to deploy app functions in production? </span><a href="https://docs.google.com/forms/d/e/1FAIpQLScEoIsgzE-LbgRrYcQMc-Lit_5VlKRA0iWw7Pvg1brIc8wXAw/viewform"><span face='"Google Sans Text", sans-serif'>Join</span></a><span face='"Google Sans Text", sans-serif'> our early access program today!</span></div></td></tr></tbody></table></div></span></name></div><div><br></div><div>To see it in action, check out the live demo showcased during the <i>What’s New</i> in Android presentation.</div><div><br></div><div class="separator">
<div class="separator">
  
  
</div>
  <div><div><span><br></span></div><h4><b> <span>2. On-Device Power with Gemini Nano 4 Preview</span></b></h4><br><div>Last month, we launched <a href="https://android-developers.googleblog.com/2026/04/gemma-4-new-standard-for-local-agentic-intelligence.html">Gemma 4</a>, our state-of-the-art open models. You can already preview and prototype with the next generation of Gemini Nano (Nano 4) models with the <a href="https://developers.google.com/ml-kit/genai/aicore-dev-preview">AIcore developer preview</a>. To make productionizing with Gemini Nano more reliable and performant, we are adding a few new features in <b>ML Kit GenAI APIs</b>: </div><br><p></p><p></p><ul><li><b>Prototype to Production: </b>Transition from prototyping in the AICore Developer Preview to building production-ready apps using the ML Kit GenAI <a href="https://developers.google.com/ml-kit/genai/prompt/android/get-started">Prompt API</a> to leverage Gemini Nano 4 that’s launching in flagship devices later this year.</li></ul><p></p><p></p><p></p><ul><li><b>Structured Output:</b> The upcoming Structured Output API will allow you to define object classes to be returned as outputs from Prompt API, ensuring reliable outputs in productionizing your intelligent features. </li></ul><p></p><p></p><ul><li><b><a href="https://developers.google.com/ml-kit/genai/prompt/android/prefix-caching">Prefix Caching</a>:</b> It optimizes your on-device inference performance with the prompt API. The new Prefix caching reduces inference time by storing and reusing the intermediate LLM state of processing a shared and recurring part of the prompt.</li></ul><p></p><div><b><br></b></div><div>For highly customized or niche use cases, you can also use LiteRT-LM to <a href="https://youtu.be/boy-UjB8hpA?si=MCPddRD7eblz8ICr">bring your own</a> fine-tuned small language model to Android.</div></div><br><div class="separator">
<div class="separator">
  
  
</div>
</div><div class="separator"><br></div><div class="separator"><br></div><b><div><b><span>3. Hybrid Inference &amp; Agents</span></b></div></b><div><div><br></div><div>To help you build more advanced AI features like hybrid inference and explore building in-app agents, we’ve released new APIs, framework and guidances:</div><p></p><p></p><ul><li><b><a href="https://android-developers.googleblog.com/2026/04/Hybrid-inference-and-new-AI-models-are-coming-to-Android.html">Firebase AI Logic Hybrid Inference</a>: </b>This new API provides the simple routing capability between on-device models and powerful cloud infrastructure. You can set explicit orchestration modes, such as <code>PREFER_ON_DEVICE</code>, <code>PREFER_CLOUD</code>, <code>ONLY_ON_DEVICE</code>, or <code>ONLY_CLOUD</code>, based on your need.</li></ul><p></p><p></p><p></p><ul><li><b>A2UI Jetpack Compose Renderer:</b> The new A2UI library allows your agents to "speak UI". With the upcoming Jetpack Compose Renderer, you can automatically render these A2UI messages as native UI components.</li></ul><p></p><p></p><ul><li><b><a href="https://developers.googleblog.com/adk-kotlin-android-building-ai-agents/">ADK for Android</a>:</b> The first version of ADK for Android is available for experimentation. It allows you to build multi-agent workflows across both on-device and Cloud models while managing orchestration, context handling and sessions between agents.</li></ul><div><br></div><div>From building with on-device models, exploring hybrid inference to building agents, you can see them in action in this talk: </div></div><div> <br><p></p><div class="separator">
<div class="separator">
  
  
</div>
  </div><div class="separator"><br></div><div class="separator"><h3>Start Building Today</h3><div class="separator"><div class="separator"><div class="separator">Whether you are experimenting with AppFunctions to prepare for the intelligence system, or looking to bring the power of Google’s AI within your own app, we’ve got you covered. Dive deeper into the code snippets, samples and comprehensive developer guides on the Android AI <a href="https://developer.android.com/ai">hub</a>. For the full breakdown of what’s new, check out the official <b>AI on Android at Google I/O 2026</b> <a href="https://www.youtube.com/playlist?list=PLWz5rJ2EKKc-GL3584TkxUyoPfzPkB1mV">playlist</a>.</div><div class="separator"><br></div><div class="separator">We are excited to see what you build! </div><div><br></div></div><div><br></div></div></div></div></div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Android 17 is here]]></title>
<description><![CDATA[Posted by Matthew McCullough, VP of Product Management, Android DeveloperToday we're releasing Android 17 and making it available on most supported Pixel devices. Look for new devices running Android 17 in the coming months.

Android 17 marks the start of our transition to an intelligence system,...]]></description>
<link>https://tsecurity.de/de/3693505/android-tipps/android-17-is-here/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693505/android-tipps/android-17-is-here/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:36 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgV7zuuXjulHty999mGDWY1kfL8Q9SXjYYWn-7JTpMfVdNP78eb5fW9shOpvVdEqK0WnNp7AhdO0qc7pXAaqcfTwXgOGsfZyqcQv8wyD-9niWBpZuP6ZAPHBSetWenN2lMlRS5wi2d71-n8RCYqrLsFhUCEvM7KeoGLnNaDbiyOZQ0vvyr0O580nXK4Vas/s2048/Metadata%20-%20Static.png"><div><i>Posted by Matthew McCullough, VP of Product Management, Android Developer</i></div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5KPJZylMSUXRpKFRUd6oM4fNdEoDRdJzdkzg69P_BVUuIDtXqCqTid6hGH40CoHRw7-f50HsT6rISArklGH982MM4K1jKU16SSymes4JPoE4qOZ5s1lLnkbInpUpdJGu5erAYmSgiefzkkOX_ng3AUJKOzzwC1WMTjk2DxLNia8R1C-ErWc7jT4VP8ew/s4209/Blogger%20Hero%20-%20White.png"><img border="0" data-original-height="1253" data-original-width="4209" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5KPJZylMSUXRpKFRUd6oM4fNdEoDRdJzdkzg69P_BVUuIDtXqCqTid6hGH40CoHRw7-f50HsT6rISArklGH982MM4K1jKU16SSymes4JPoE4qOZ5s1lLnkbInpUpdJGu5erAYmSgiefzkkOX_ng3AUJKOzzwC1WMTjk2DxLNia8R1C-ErWc7jT4VP8ew/s16000/Blogger%20Hero%20-%20White.png"></a></div><br><p><br></p><p>Today we're releasing Android 17 and making it available on most supported Pixel devices. Look for new devices running Android 17 in the coming months.</p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjaHGBWXu3yvdXZ-wYQgN6DjN5TEMRIYDJvQDZTOybRZFWsAMhqhl14b9UZmrlXlEIRDioqRc8m3xRjOnQHJPoICkVpCho4qrmKihPbu_SB7dGVNKwlAaX6eWdjLF4VUdGyzGfxtW0ziFggj63e778VVo38qpMKar4E1wuw0MiPCBvBdrTTXCgI1XD04Q/s1080/AfD-Android-17.gif"><img border="0" data-original-height="1080" data-original-width="1080" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjaHGBWXu3yvdXZ-wYQgN6DjN5TEMRIYDJvQDZTOybRZFWsAMhqhl14b9UZmrlXlEIRDioqRc8m3xRjOnQHJPoICkVpCho4qrmKihPbu_SB7dGVNKwlAaX6eWdjLF4VUdGyzGfxtW0ziFggj63e778VVo38qpMKar4E1wuw0MiPCBvBdrTTXCgI1XD04Q/s320/AfD-Android-17.gif" width="320"></a></div>

<p>Android 17 marks the start of our transition to an intelligence system, putting your apps at the center. It's shifting to an adaptive-first development standard by introducing mandatory large-screen resizability, all while delivering next-generation privacy, security, media, camera, and performance. We'll cover all that in this post, as well as how we're bringing together next generation tools, libraries, and agent skills to help your apps embrace the opportunity.</p>

<p>Throughout the past year, from our Canary channel to our Beta releases, we’ve collaborated with you in the developer community to build a platform you and your users can trust. To that end, this moment marks the availability of the source code at the <a href="https://source.android.com/">Android Open Source Project</a> (AOSP). This allows you to <a href="https://cs.android.com/">examine the source code</a> for a deeper understanding of how Android works.</p>

<p>Let's dive deeper into Android 17.</p>

<h3>An intelligence system</h3>

<p>With deep integration between hardware, software and AI, we’re transforming Android from an operating system to an intelligence system. It's about delivering new helpful experiences that anticipate user needs, and it brings more opportunities for engagement with your apps. To that end, Android 17 expands the capabilities of AppFunctions, a platform API with a corresponding Jetpack library. It allows you to contribute your app's unique capabilities as orchestratable "tools" for Android MCP, the on-device equivalent of the <a href="https://modelcontextprotocol.io/">Model Context Protocol</a>. AI agents and assistants (like Google Gemini) can discover and execute AppFunctions to perform workflows on behalf of the user with direct access to the app's local state.</p>

<p>The Jetpack library, currently in alpha, makes adding AppFunctions as easy as annotating a class and adding KDoc comments.</p>

<pre><code>/**
 * A note app's [AppFunction]s.
 */
class NoteFunctions(
    private val noteRepository: NoteRepository
) {
    /**
     * Adds a new note to the app.
     *
     * @param appFunctionContext The execution context.
     * @param title The title of the note.
     * @param content The note's content.
     */
    @AppFunction(isDescribedByKDoc = true)
    suspend fun createNote(
        appFunctionContext: AppFunctionContext,
        title: String,
        content: String
    ): Note {
        return noteRepository.createNote(title, content)
    }
}</code></pre>

<p>We’ve also launched an <a href="http://github.com/android/skills/tree/main/on-device/appfunctions">AppFunctions agent skill</a> that analyzes your app’s key workflows, automatically generates the required Kotlin code, optimizes your KDocs for LLM tool-calling, and provides ADB commands for testing and debugging.</p>

<p>The Gemini integration is currently in a private preview with trusted testers, but you can begin preparing your apps now. In addition to ADB commands to execute your AppFunctions, we've provided a <a href="http://github.com/android/appfunctions/releases/initial">test agent app</a> that includes an interface to discover and execute your app functions and simulate an AI agent integration. Join our integration early access program at <a href="http://goo.gle/eap-af">goo.gle/eap-af</a> for a chance to be among the first apps to deploy AppFunctions to production.</p>

<h3>Adaptive-first</h3>
<p>Your users no longer rely on a single form factor; they transition between phones, foldables, tablets, laptops, automotive displays, and immersive XR environments. Now, with over <a href="https://developer.android.com/blog/posts/adaptive-development-for-the-expanding-android-ecosystem">580 million large screen devices</a> in the hands of users and the <a href="https://blog.google/products-and-platforms/platforms/android/meet-googlebook/">forthcoming launch of Googlebooks</a>, the next generation of ChromeOS built on the Android stack, adaptive is no longer just a technical goal. It’s a massive opportunity to reach highly engaged users, which is one of the reasons we're shifting to an <a href="https://developer.android.com/adaptive-apps">adaptive-first development standard</a>.</p>

<h2>No resizability/orientation restrictions on large screens</h2>
<p>To ensure apps deliver a premium experience across all form factors, including mobile devices running in desktop mode on connected displays, Android 17 (API level 37) removes the developer opt-out for orientation and resizability restrictions on <a href="https://developer.android.com/guide/topics/large-screens">large screen devices</a> (sw &gt; 600 dp) for apps targeting API level 37. The system will ignore legacy manifest attributes and runtime APIs, including screenOrientation, setRequestedOrientation(), resizeableActivity=false, and aspect ratio constraints (minAspectRatio/maxAspectRatio). Games (based on <a href="https://support.google.com/googleplay/android-developer/answer/9859673?hl=en">app category</a> in Google Play) remain exempt. Your app must be ready to adapt to any window size, respect the user's preferred device posture, and support free-form windowing natively.</p>

<h2>Next-gen multitasking: App Bubbles, Bubble Bar, and desktop interactive PiP</h2>
<p>Android 17 introduces powerful new windowing capabilities that redefine how users multitask, demanding even greater layout flexibility from your apps:</p>
<ul>
    <li><strong>App Bubbles:</strong> Moving beyond the messaging bubbles API, users can now transform any app into a floating bubble by long-pressing its icon on the launcher. This feature is available across phones, foldables, and tablets, enabling lightweight multitasking for any workflow.</li>
    <li><strong>The Bubble Bar:</strong> On large screens (tablets and foldables), the system taskbar now includes a dedicated Bubble Bar to organize, transition between, and dock these floating app bubbles.</li>
    <li><strong>Desktop interactive PiP:</strong> In desktop environments, Android 17 introduces interactive Picture-in-Picture (PiP). Unlike traditional PiP windows which are read-only, these pinned windows remain fully interactive while staying always-on-top of other application windows.</li>
</ul>

<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg12FRQ31sUiyMj_ZalamTRI4VyI2tMXYKEoRy6b-u0Het272IDbRhznXot7b8AvFJEX-ubw_-pNxyS5JTKPUTBj1CNXwIYkTE906vembUcHeyGzE4Lb72WRyGNF7dOP_aBssNeCplOjEnKAc3d3hkak81LOpG0g9Hlep0AvC11MjdJ1MkqAp7ViUCu2bw/s1600/Bubbles%20(1).gif"><img border="0" data-original-height="1600" data-original-width="1544" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg12FRQ31sUiyMj_ZalamTRI4VyI2tMXYKEoRy6b-u0Het272IDbRhznXot7b8AvFJEX-ubw_-pNxyS5JTKPUTBj1CNXwIYkTE906vembUcHeyGzE4Lb72WRyGNF7dOP_aBssNeCplOjEnKAc3d3hkak81LOpG0g9Hlep0AvC11MjdJ1MkqAp7ViUCu2bw/s16000/Bubbles%20(1).gif"></a></div><p><i>App Bubbles and Bubble Bar in action</i></p>

<h2>Activity recreation updates</h2>
<p>To prevent disruptive state loss and stutter, Android 17 updates the default behavior for Activity recreation. The system will no longer restart activities by default for typical configuration changes that do not require a full UI redraw (including <a href="https://developer.android.com/reference/kotlin/android/content/pm/ActivityInfo#config_keyboard">CONFIG_KEYBOARD</a>, <a href="https://developer.android.com/reference/kotlin/android/content/pm/ActivityInfo#config_keyboard_hidden">CONFIG_KEYBOARD_HIDDEN</a>, <a href="https://developer.android.com/reference/kotlin/android/content/pm/ActivityInfo#config_navigation">CONFIG_NAVIGATION</a>, <a href="https://developer.android.com/reference/kotlin/android/content/pm/ActivityInfo#config_touchscreen">CONFIG_TOUCHSCREEN</a>, and <a href="https://developer.android.com/reference/kotlin/android/content/pm/ActivityInfo#config_color_mode">CONFIG_COLOR_MODE</a>).<br>
Instead, running activities will receive these updates via onConfigurationChanged(), enabling smooth transitions. If your application explicitly relies on a full restart to reload resources for these changes, you must now explicitly opt-in using the new <a href="https://developer.android.com/reference/kotlin/android/R.attr#recreateonconfigchanges">android:recreateOnConfigChanges</a> manifest attribute.</p>

<h2>Continue On</h2>
<p>Android 17 adds Continue On to help users seamlessly transition a task between Android devices. The user sees a suggestion for the most recently opened app from their mobile device in their tablet taskbar, providing a one-tap affordance to launch the app and deep-link where they left off. Continue on can support app-to-web transitions, including falling back to using the web if the app isn't installed.</p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc8K42DCZ0VTYpFhTlEazp9_AthhqYdm786k1NFolZrP7HwXk2QlF7UV1CU7ECK9N-CiHSfSbH_E2_cXwL3zUuesP-shpa1nau5QmVWDOQeErnCMtvZUw_wwAHNewZZ5S3811f0n_FNoX4U9kyptZQONM_eDB1AAHaoFjMFgTCC7G1d0X2iRo1MN8sev0/s1920/Continue%20On.png"><img border="0" data-original-height="1200" data-original-width="1920" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc8K42DCZ0VTYpFhTlEazp9_AthhqYdm786k1NFolZrP7HwXk2QlF7UV1CU7ECK9N-CiHSfSbH_E2_cXwL3zUuesP-shpa1nau5QmVWDOQeErnCMtvZUw_wwAHNewZZ5S3811f0n_FNoX4U9kyptZQONM_eDB1AAHaoFjMFgTCC7G1d0X2iRo1MN8sev0/s16000/Continue%20On.png"></a><i>Handoff Suggestion on a Tablet</i></div><p><br></p>

<pre><code>class MyHandoffActivity : Activity() {

    ...

  override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)
    // Do stuff
    ...
    // Enable handoff
    setHandoffEnabled(true, null)
  }

  // Override and implement onHandoffActivityDataRequested
  override fun onHandoffActivityDataRequested(handoffRequestInfo: HandoffActivityDataRequestInfo) : HandoffActivityData {
    // Create and return handoff data
  }
}</code></pre>

<h2>Go adaptive-first with Jetpack Compose</h2>
<p>To help you adapt your apps to meet the new Android 17 requirements, we've launched the <a href="https://github.com/android/skills/tree/main/jetpack-compose/adaptive">Jetpack Compose adaptive skill</a>. This AI-powered developer workflow helps you implement the best adaptive practices:</p>
<ul>
    <li><strong>Adaptive navigation:</strong> Automatically transition between bottom navigation bars on mobile and edge-anchored navigation rails on large screens using NavigationSuiteScaffold from the Material 3 Adaptive library.</li>
    <li><strong>Multi-pane layouts:</strong> Implement list-detail and supporting pane layouts natively using Navigation 3 Scenes (ListDetailSceneStrategy and SupportingPaneSceneStrategy) instead of fragile fragment transactions.</li>
    <li><strong>FlexBox &amp; Grid APIs:</strong> Utilize Compose 1.11's dynamic layout components to easily adjust row and column spans on the fly, ensuring your content always fills the space beautifully.</li>
    <li><strong>Advanced non-touch input:</strong> Leverage Compose 1.11's enhanced trackpad and mouse support, including native focus rings and new APIs (like TrackpadInjectionScope and performTrackpadInput) to easily test and deliver a true "laptop-class" experience on Googlebooks and Desktop Mode.</li>
    <li><strong>Dynamic window states:</strong> Leverage Compose's reactive state model to seamlessly adapt your UI when the app transitions from full screen to a floating App Bubble or an interactive Desktop PiP window, ensuring a premium experience even at minimal dimensions.</li>
</ul>

<h2>Android is Compose-first</h2>
<p>Compose offers the easiest way to build adaptive apps, and that's just one of the <a href="https://developer.android.com/develop/ui/compose/first#why-compose-first">many reasons</a> we believe that all Android UI should be built with Compose. To that end, <a href="https://developer.android.com/develop/ui/compose/first">Android development is now Compose-first</a>. All new Android APIs, libraries, tools, and developer guidance will be built exclusively for Jetpack Compose. Legacy View components (in the android.widget package) and View-based Jetpack libraries (like Fragments, RecyclerView, and ViewPager) are now in maintenance mode. They will receive only critical bug fixes, and no new features.</p>

<blockquote>
    <p><strong>TIP</strong><br>
    Ready to migrate? Use our AI-driven <a href="https://developer.android.com/develop/ui/compose/migrate/migrate-xml-views-to-jetpack-compose">XML to Compose Migration Skill</a> to automatically analyze your legacy View layouts and convert them into highly-adaptive Compose code.</p>
</blockquote>

<h3>Performance &amp; efficiency</h3>
<p>App performance means a smooth user interface, fast app start times, and efficient multitasking; Android 17 has impactful improvements in all of these areas.</p>

<h2>App memory limits</h2>
<p>Memory usage is one of the silent foundations of overall performance. When a foreground app or service grows unchecked, memory management spikes CPU and battery utilization and eventually leads to the termination of other well-behaved cached apps and background jobs, ultimately forcing slower cold starts and impaired multitasking. </p>

<p>Starting in Android 17, the system will enforce strict app memory limits based on a device's total RAM, abruptly terminating offending processes. New things to help you navigate these tighter requirements:</p>
<ul>
    <li><strong>R8 Optimizer:</strong> The R8 optimizer significantly reduces your app's bytecode memory footprint by shrinking classes, methods, and fields into shorter names, and stripping out unused code and resources. Use R8 in full mode along with the new <a href="https://developer.android.com/topic/performance/app-optimization/r8-configuration-analyzer">R8 configuration analyzer</a> to make sure your app is getting the most from R8.<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQePgjeISaotpA-miDPKel-qgAYtepLjMMBaiKZQqTf_iYRTJurn_iAFdC7utLnKRKAh9OhSjF_D83skA2PPg7xts0ORX7aVxBkoax6b9uEPqTlGiY_sh8Xv7U1pr0h4Nm8FLo-h3IJD8FhTJc-gOtpBwyLCnDBUPRJAuaaBjsIOhvUmTXFSna0ykksak/s2048/R8%20Configuration%20Analyzer.png"><img border="0" data-original-height="397" data-original-width="2048" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQePgjeISaotpA-miDPKel-qgAYtepLjMMBaiKZQqTf_iYRTJurn_iAFdC7utLnKRKAh9OhSjF_D83skA2PPg7xts0ORX7aVxBkoax6b9uEPqTlGiY_sh8Xv7U1pr0h4Nm8FLo-h3IJD8FhTJc-gOtpBwyLCnDBUPRJAuaaBjsIOhvUmTXFSna0ykksak/s16000/R8%20Configuration%20Analyzer.png"></a></div></li></ul><div><span><u><br></u></span></div><div><span><u><br></u></span></div><div><br></div><div><br></div><div>The R8 Configuration Analyzer</div><ul><li><strong>LeakCanary in Android Studio Panda:</strong> The profiler now features native LeakCanary integration as a dedicated task, fully integrated with your IDE and source code.</li>
    <li><strong>ApplicationExitInfo:</strong> If your app is terminated by these limits, getDescription() from ApplicationExitInfo will return "MemoryLimiter:AnonSwap".</li>
    <li><strong>On-Device Anomaly Detection:</strong> Part of ProfilingManager, you can leverage trigger-based profiling using TRIGGER_TYPE_ANOMALY to automatically capture heap dumps when the memory limit is reached.</li>
</ul>

<pre><code>val profilingManager = applicationContext
   .getSystemService(ProfilingManager::class.java)

val triggers = ArrayList&lt;ProfilingTrigger&gt;().apply {
  add(ProfilingTrigger.Builder(
    ProfilingTrigger.TRIGGER_TYPE_ANOMALY).build())
}
profilingManager.addProfilingTriggers(triggers)</code></pre>

<p>And, we're working to surface more in-field memory metrics to you within Google Play Console.</p>

<h2>Generational garbage collection</h2>
<p><a href="https://developer.android.com/about/versions">Android 17</a> introduces more frequent, less resource-intensive young-generation collections to <a href="https://developer.android.com/guide/platform#art">ART</a>'s Concurrent Mark-Compact garbage collector (GC). By separating short-lived objects from stable, long-lived ones, the system runs frequent, lightweight "young-generation" sweeps rather than expensive full-heap scans, drastically reducing CPU usage, power drain, and UI stutter. Our testing has shown significant improvements in GC interference with application threads and a reduction in the maximum memory resident set size (RSS). ART improvements are also available to over a billion devices running Android 12 (API level 31) and higher through Google Play System updates.</p>

<h2>Lock-Free MessageQueue</h2>
<p>For apps targeting SDK 37 or higher, the core <a href="https://developer.android.com/reference/android/os/MessageQueue"><b>android.os.MessageQueue</b></a> now implements a lock-free architecture, significantly reducing missed frames, improving app startup time, and radically improving the performance of busy queues in multithreaded scenarios. Note: This can break apps that use reflection on private <a href="https://developer.android.com/reference/android/os/MessageQueue"><b>MessageQueue</b></a> fields and methods.  The <a href="https://developer.android.com/reference/android/os/TestLooperManager#peekWhen()"><b>peekWhen</b></a> and <b><a href="https://developer.android.com/reference/android/os/TestLooperManager#poll()">poll</a> </b>APIs have been added to <a href="https://developer.android.com/reference/android/os/TestLooperManager"><b>TestLooperManager</b></a> for instrumentation testing without relying on <a href="https://developer.android.com/reference/android/os/MessageQueue"><b>MessageQueue</b></a> internals.</p>

<h2>Static final fields now truly final</h2>
<p>Starting from Android 17, apps targeting SDK 37 or higher won’t be able to modify “static final” fields, allowing the runtime to apply performance optimizations more aggressively. An attempt to do so via reflection (or deep reflection) will lead to an IllegalAccessException being thrown. Modifying them via JNI’s <b><code>SetStatic&lt;Type&gt;Field</code></b> methods family will immediately crash the application.</p>

<h2>Custom notification view restrictions</h2>
<p>To reduce memory usage we are further restricting the size of <a href="https://developer.android.com/develop/ui/views/notifications/custom-notification">custom notification views</a>. This update closes a loophole that allows apps to bypass existing limits using URIs. This behavior is gated by the target SDK version and takes effect for apps targeting API 37 and higher.</p>

<h3>Privacy &amp; Security</h3>
<p>Maintaining user trust is at the heart of the Android ecosystem. Android 17 introduces robust features that protect sensitive data while simplifying user experiences.</p>

<h2>Privacy-preserving choices</h2>
<p>Historically, apps required broad, permanent permissions to access information like contacts, precise location and media files. Android 17 continues the shift toward privacy-preserving choices that grant temporary, session-based access only to the data the user explicitly selects:</p>
<ul>
  <li><strong>System-Level Contact Picker:</strong> Utilizing <code>ACTION_PICK_CONTACTS</code>, apps can request temporary access only to specific fields (e.g., email or phone number) chosen by the user, eliminating the need for the broad <code>READ_CONTACTS</code> permission. It also fully supports work/personal profile separation.</li>
    <li><strong>Customizable Photo Picker aspect ratio:</strong> Using<b><code>PhotoPickerUiCustomizationParams</code></b>, you can customize the system photo picker to show thumbnails in portrait mode. This is perfect for apps that always display photos and videos in portrait such as video based social media apps.</li>
    <li><strong>System-rendered Location Button:</strong> A new system-rendered location button that you can embed in your app grants precise location access for the current session only.</li>
    <li><strong>EyeDropper API:</strong> A new system-level API, <code>ACTION_OPEN_EYE_DROPPER</code>, allows your app to create a system-powered eyedropper enabling the user to select color from any pixel on the display. This provides a secure, privacy-preserving color-picking experience that eliminates the need for broad, sensitive screen capture or media projection permissions.</li>
</ul>

<pre><code>val eyeDropperLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result -&gt;
   if (result.resultCode == Activity.RESULT_OK) {
       val color = result.data?.getIntExtra(Intent.EXTRA_COLOR, Color.BLACK)
       // Use the picked color in your app
   }
}
fun launchColorPicker() {
   val intent = Intent(Intent.ACTION_OPEN_EYE_DROPPER)
   eyeDropperLauncher.launch(intent)
}</code></pre>

<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8m_oR9WymjE9G26nGUCqdhS9GrBd6FXN3ujWbjq7ECD6OMGhS4xUApWkAWpPpRef7lwLhsRE2jYL9FADoF_FX2eMXD-0hp9JVaCzrDhfU8RYJ9qv-Ds9YIwyQK7yHKidW0oOtX1rpg2pG9x2yNp3UkGJDPqUlHX7hiLb-bvDue67FPZK1O-22SuXbO8I/s1267/Eyedropper%20Tester.webp"><img border="0" data-original-height="713" data-original-width="1267" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8m_oR9WymjE9G26nGUCqdhS9GrBd6FXN3ujWbjq7ECD6OMGhS4xUApWkAWpPpRef7lwLhsRE2jYL9FADoF_FX2eMXD-0hp9JVaCzrDhfU8RYJ9qv-Ds9YIwyQK7yHKidW0oOtX1rpg2pG9x2yNp3UkGJDPqUlHX7hiLb-bvDue67FPZK1O-22SuXbO8I/w640-h360/Eyedropper%20Tester.webp" width="640"></a></div><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><br></h3><h3><span><span face="Arial, sans-serif"><i>Picking a color from anywhere on the screen with the system EyeDropper</i></span></span></h3><h2>Local network access</h2>
<p>Apps targeting Android 17 now either require the <code><a href="https://developer.android.com/reference/kotlin/android/Manifest.permission#access_local_network">ACCESS_LOCAL_NETWORK</a></code> runtime permission or the use of system-mediated, privacy-preserving device pickers for local network communication, such as talking to smart home devices or casting receivers. Because <code>ACCESS_LOCAL_NETWORK</code>  falls under the existing <code><a href="https://developer.android.com/reference/android/Manifest.permission_group#NEARBY_DEVICES">NEARBY_DEVICES</a></code> permission group, users who have already granted other <code><a href="https://developer.android.com/reference/android/Manifest.permission_group#NEARBY_DEVICES">NEARBY_DEVICES</a></code> permissions will not be prompted again. </p>

<h2>SMS OTP protection</h2>
<p>Android 17 expands SMS one-time-password (OTP) protection by delaying access to SMS messages for three hours:</p>
<ul>
  <li>WebOTP Format: <a href="https://developer.android.com/about/versions/17/behavior-changes-all#sms-otp-all-apps">Delayed for all apps that are not the intended recipient (domain mismatch)</a>.</li>
  <li>Standard SMS OTP: <a href="https://developer.android.com/about/versions/17/behavior-changes-17#sms-otp-protection">Delayed for all apps targeting SDK 37+</a>.</li>
  <li>Exemptions: Default SMS, assistant, and connected companion apps are exempt. Apps are strongly encouraged to migrate to the <a href="https://developer.android.com/identity/sms-retriever">SMS Retriever</a> or <a href="https://developers.google.com/identity/sms-retriever/user-consent/overview">SMS User Consent APIs</a>.</li>
</ul>

<h2>Post-Quantum Cryptography (PQC)</h2>
<p>Android 17 is ready for the next generation of cryptographic security:</p>
<ul>
  <li>Keystore Integration: Supported devices can generate ML-DSA (Module-Lattice-Based Digital Signature Algorithm) keys in secure hardware to produce quantum-safe signatures, exposed via standard JCA APIs.</li>
  <li>Hybrid APK Signing: Introducing the v3.2 APK Signature Scheme, which combines classical signatures with ML-DSA signatures to secure app delivery.</li>
</ul>

<h2>Safer native dynamic code loading </h2>
If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection <a href="https://developer.android.com/about/versions/14/behavior-changes-14#safer-dynamic-code-loading">introduced in Android 14</a> for DEX and JAR files now extends to native libraries. All native files loaded using System.load must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError

<h2>Smarter password protection for physical inputs</h2>
<p>With Android 17, we're making it safer to enter passwords, PINs, and other secrets when using a physical keyboard by no longer showing the last typed character by default.</p>
<p>Users can still easily customize these display settings to match their preferences (availability may vary by device manufacturer).</p>
<p>These enhanced privacy protections are automatically supported byAndroid's built-in SDK components and will be supported in Compose 1.12 for SecureTextFields. </p>

<h3><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFjWXyRLybiLVAIrIm1_60XHXhPmpB1QEph7AuqsGHs-NihIDRFbUgBh32gUKxo30173W-RpEInX9hmYFVnW5V8ZqtM3n_CzxlT0B0PVQr0LSOuOi7x2kZgN_jHRRlYJ7bYInZllvUGNoA_SrXkNi5wwHvUghUcnl0Gsgx_-ts4QEHq_KdbEYgWCg92xA/s798/Hide%20First%20Letter.gif"><img border="0" data-original-height="449" data-original-width="798" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFjWXyRLybiLVAIrIm1_60XHXhPmpB1QEph7AuqsGHs-NihIDRFbUgBh32gUKxo30173W-RpEInX9hmYFVnW5V8ZqtM3n_CzxlT0B0PVQr0LSOuOi7x2kZgN_jHRRlYJ7bYInZllvUGNoA_SrXkNi5wwHvUghUcnl0Gsgx_-ts4QEHq_KdbEYgWCg92xA/s16000/Hide%20First%20Letter.gif"></a></div></h3><h3><br></h3><h3><br></h3><h3><br></h3><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><i><div><i>Smarter password protection for physical inputs</i></div></i><div><br></div><h2>Media and camera features that empower creators and delight users
</h2><p>Android 17 introduces new <a href="https://blog.google/products-and-platforms/platforms/android/android-17-creator-features/">creator features</a> that give access to pro-quality cameras and media, all while improving the experience for consumers.</p>

<ul>
  <li><a href="https://developer.android.com/media/platform/integrate-eclipsa-video">Eclipsa Video</a>: HDR video standard built upon the <a href="https://github.com/SMPTE/st2094-50">SMPTE ST 2094-50 specification</a> that introduces new metadata to help devices adapt content for their display headroom and ambient light conditions, as well as improve the simultaneous display of standard and HDR content.</li>
  <li>RAW14 image format: New support for the <a href="https://developer.android.com/reference/kotlin/android/graphics/ImageFormat#raw14">RAW14 image format</a> provides a way for your professional camera app to capture the highest level of detail and color depth from compatible camera sensors.</li>
  <li>Vendor-defined camera extensions: Vendor-defined extensions enable hardware partners to define and implement custom camera extension modes, providing access to the best and latest camera features.</li>
  <li>Extended HE-AAC software encoder: A new system-provided Extended HE-AAC software encoder, supports both low and high bitrates using unified speech and audio coding, providing significantly better audio quality for voice messages in low-bandwidth conditions, including support for loudness metadata.</li>
  <li><a href="https://developer.android.com/guide/topics/media/media-formats#video-formats">Versatile Video Coding (H.266)</a>:  Enables OEMs to add codec support by defining the <a href="https://developer.android.com/guide/topics/media/media-formats#video-formats">video/vvc</a> MIME type in <a href="https://developer.android.com/reference/android/media/MediaFormat"><code>MediaFormat</code></a>, adding new VVC profiles in <a href="https://developer.android.com/reference/android/media/MediaCodecInfo"><code>MediaCodecInfo</code></a>, and integrating support into <a href="https://developer.android.com/reference/android/media/MediaExtractor"><code>MediaExtractor</code></a>.</li>
  <li>Camera device type: New APIs that query the underlying device type to identify if a camera is built-in hardware, an external USB webcam, or a virtual camera.</li>
  <li>Constant Quality for Video Recording: <a href="https://developer.android.com/reference/android/media/MediaRecorder#setVideoEncodingQuality(int)"><code>SetVideoEncodingQuality</code></a> in <a href="https://developer.android.com/reference/android/media/MediaRecorder"><code>MediaRecorder</code></a> configures a constant quality (CQ) mode for video encoders to ensure uniform visual fidelity across the entire video.</li>
</ul>

<h2>Better support for hearing aids</h2>
<ul>
  <li>Bluetooth LE Audio hearing aid support: Android now includes a specific device category for Bluetooth Low Energy (BLE) Audio hearing aids with the new <a href="https://developer.android.com/reference/android/media/AudioDeviceInfo#TYPE_BLE_HEARING_AID"><code>AudioDeviceInfo.TYPE_BLE_HEARING_AID</code></a> constant, so your app can distinguish hearing aids from regular headsets to provide a tailored experience for users with assistive listening devices.</li>
  <li>Granular audio routing for hearing aids: Android 17 allows users to independently manage where specific system sounds are played. They can choose to route notifications, ringtones, and alarms to connected hearing aids or the device's built-in speaker, helping to avoid unwanted in-ear interruptions while maintaining a Bluetooth connection for hearing aid management apps.</li>
</ul>

<h2>CameraX and  Media3</h2>
<p><a href="https://developer.android.com/jetpack/androidx/releases/camerax">CameraX</a> and <a href="https://developer.android.com/jetpack/androidx/releases/media3">Media3</a> have been updated for Android 17. They are there to do the heavy lifting, smoothing the rough edges of media development and simplifying building reliable camera capture,  smooth media playback, and creative and complex editing experiences. </p>

<p>We've released an <a href="https://github.com/android/skills/tree/main/camera">agent skill</a> that can migrate legacy Android camera implementations (Camera1 or raw Camera2 APIs) to CameraX.</p>
  
<p>Note: You'll need to update your CameraX version to either 1.5.2 or 1.6.0+ to avoid a crash related to an added dynamic range mode on Android 17 devices.</p>

<h3>Get your apps, libraries, tools, and game engines ready!</h3>
<p>If you develop an Android SDK, library, tool, or game engine, it's critical to prepare any necessary updates now to prevent your downstream app and game developers from being blocked by compatibility issues and allow them to target the latest SDK features. Please let your downstream developers know if updates are needed to fully support Android 17.</p>

<p>Testing involves installing your production app or a test app making use of your library or engine using Google Play or other means onto a device or emulator running Android 17 Beta 4. Work through all your app's flows and look for functional or UI issues. Each release of Android contains platform changes that improve privacy, security, and overall user experience; review the app impacting behavior changes for apps <a href="https://developer.android.com/about/versions/17/behavior-changes-all">running on</a> and <a href="https://developer.android.com/about/versions/17/behavior-changes-17">targeting</a> Android 17 to focus your testing, including the following:</p>
<ul>
  <li>Resizability on large screens: Once you target Android 17 (SDK 37), you can no longer opt out of maintaining orientation, resizability and aspect ratio constraints <a href="https://developer.android.com/about/versions/17/changes/ff-restrictions-ignored">on large screens</a>.</li>
  <li>Dynamic code loading: If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection <a href="https://developer.android.com/about/versions/14/behavior-changes-14#safer-dynamic-code-loading">introduced in Android 14 </a>for DEX and JAR files now extends to native libraries. All native files loaded using System.load() must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError.</li>
  <li>Enable CT by default: <a href="https://developer.android.com/privacy-and-security/security-config#CertificateTransparencySummary">Certificate transparency (CT)</a> is enabled by default. (On Android 16, CT is available but apps had to <a href="https://developer.android.com/privacy-and-security/security-config#certificateTransparency">opt in</a>.)</li>
  <li>Local network protections: Apps targeting SDK 37 or higher have <a href="https://developer.android.com/privacy-and-security/local-network-permission#android-17-enforcement">local network access blocked by default</a>. Switch to using privacy preserving pickers if possible, and use the new <a href="https://developer.android.com/reference/kotlin/android/Manifest.permission#access_local_network"><b><code>ACCESS_LOCAL_NETWORK</code></b>permission for broad, persistent access.</a></li>
  <li>Background audio hardening: Starting in Android 17, the audio framework enforces <a href="https://developer.android.com/about/versions/17/changes/bg-audio">restrictions on background audio interactions</a> including audio playback, <a href="https://developer.android.com/media/optimize/audio-focus">audio focus</a> requests, and <a href="https://developer.android.com/reference/android/media/AudioManager#adjustStreamVolume(int,%20int,%20int)">volume change</a> APIs. Based on your feedback, we’ve made some changes since beta 2, including targetSDK gating while-in-use FGS enforcement and exempting alarm audio. Full details available in the <a href="https://developer.android.com/about/versions/17/changes/bg-audio">updated guidance</a>.</li>
  <li>NPU access declaration: Apps targeting Android 17 that need to directly access the NPU must declare <a href="https://developer.android.com/reference/kotlin/android/content/pm/PackageManager#feature_neural_processing_unit">FEATURE_NEURAL_PROCESSING_UNIT</a> in their manifest to avoid being blocked from accessing the NPU. This includes apps that use the <a href="https://ai.google.dev/edge/litert/next/npu">LiteRT NPU delegate</a>, vendor-specific SDKs, as well as the deprecated <a href="https://developer.android.com/ndk/guides/neuralnetworks">NNAPI</a>.</li>
</ul>

<h3>Get started with Android 17</h3>
<p>Your Pixel device should get Android 17 shortly if you haven't already been on the Android Beta. If you don’t have a Pixel device, you can <a href="https://developer.android.com/about/versions/17/get#on_emulator">use the 64-bit system images with the Android Emulator</a> in Android Studio. If you are currently on Android 17 Beta 4.1 and have not yet taken an Android 17 QPR1 beta, you can opt out of the program and you will then be offered the release version of Android 17 over the air.</p>
<h3>Getting the Android 17 beta on partner devices</h3>
<p>Android 17 is available in beta on handset, tablet, and foldable form factors <a href="https://developer.android.com/about/versions/17/devices">from partners</a> including Honor, iQOO, Lenovo, OnePlus, OPPO, Realme, Sharp, vivo, and Xiaomi.</p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjy5cwRcpdR2j-1KMzQPpsxvIODRLlVkaFNQEIQoNaPQa4X4rgEna5imminlwFdcSJ3xihXdUSFouOC0-ZKyK1A53cBmoaU03au-FjfsqkPXm0tPLtOaWT_7z8tqnMmQjFOr-YIKeP3BMVq8Hmd7yH0zllW1aFMuiW6AAAcDUVL7aIyCAIZUs0d_0VMdF4/s1653/android-17-beta-partners.jpg"><img border="0" data-original-height="624" data-original-width="1653" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjy5cwRcpdR2j-1KMzQPpsxvIODRLlVkaFNQEIQoNaPQa4X4rgEna5imminlwFdcSJ3xihXdUSFouOC0-ZKyK1A53cBmoaU03au-FjfsqkPXm0tPLtOaWT_7z8tqnMmQjFOr-YIKeP3BMVq8Hmd7yH0zllW1aFMuiW6AAAcDUVL7aIyCAIZUs0d_0VMdF4/s16000/android-17-beta-partners.jpg"></a></div><br><h3><br></h3>

<p>For the best development experience with Android 17, we recommend that you use the latest Canary build of <a href="https://developer.android.com/studio/preview">Android Studio Quail</a>. Once you’re set up, here are some of the things you should do:</p>
<p>Test your current app for compatibility, learn whether your app is <a href="https://developer.android.com/about/versions/17/behavior-changes-all">affected by changes in Android 17</a>, and install your app onto a device or <a href="https://developer.android.com/studio/run/emulator">Android Emulator</a> running Android 17 and extensively test it.</p>

<p>Thank you again to everyone who participated in our Android developer preview and beta program. We're looking forward to seeing how your apps take advantage of the updates in Android 17, and have plans to bring you updates in a fast-paced release cadence going forward.</p>
<p>For complete information on Android 17 please visit the <a href="https://developer.android.com/about/versions/17">Android 17 developer site</a>.</p><br><br>]]></content:encoded>
</item>
<item>
<title><![CDATA[Building a Mixed-Reality Tour Guide with Android XR, the Geospatial API, and Gemini]]></title>
<description><![CDATA[Posted by Coco Fatus, UX Designer, Alon Hetzroni, UX Engineer, Azin Mehrnoosh, Product Manager Android XRAt this year's Google I/O, we announced an update for spatial experiences: the Geospatial API is now available as a preview in ARCore for Jetpack XR. By bringing Google's Visual Positioning Sy...]]></description>
<link>https://tsecurity.de/de/3693504/android-tipps/building-a-mixed-reality-tour-guide-with-android-xr-the-geospatial-api-and-gemini/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693504/android-tipps/building-a-mixed-reality-tour-guide-with-android-xr-the-geospatial-api-and-gemini/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:35 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKrortZT9X64_5gun79eaNo1niWelmj6Mixfrw4eBLKkec02_w-el6vVXR8IuyPA40B4lB22yEdCK5KNVOZ3DwG3sja7MJArx60irN7gP9P7rnzMjx8sejJeE6puifztBfMv_mExAuAjKkE3rjW1PRulfU0wTfIVLtmb9lEUW4L9hhFme1ArGmV09GuXM/s320/MM%20Android%20XR%20Geospatial%20V02_Meta%20(1).png"><div><i>Posted by Coco Fatus, UX Designer, Alon Hetzroni, UX Engineer, Azin Mehrnoosh, Product Manager Android XR</i></div><div><i><br></i></div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTa2M7znb9EjsONU5iM1tvB_KPswY-yT7pqYZ2gZmJGk9Z6WONXgDOsTj9vvTPD8a38-XvPm7HafuF1-nChC7dix2CQfnTpH6T-YdPhaL85A7rRugnlwwtPtwH-Z5WWSFVNYXCclOOL5DtNbNqRLX-ZJVAIrRDxYs8pgfWS0O0O2P_e-W6TjYH_RjnCuM/s8000/MM%20Android%20XR%20Geospatial%20V02_Blog.png"><img border="0" data-original-height="2442" data-original-width="8000" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTa2M7znb9EjsONU5iM1tvB_KPswY-yT7pqYZ2gZmJGk9Z6WONXgDOsTj9vvTPD8a38-XvPm7HafuF1-nChC7dix2CQfnTpH6T-YdPhaL85A7rRugnlwwtPtwH-Z5WWSFVNYXCclOOL5DtNbNqRLX-ZJVAIrRDxYs8pgfWS0O0O2P_e-W6TjYH_RjnCuM/s16000/MM%20Android%20XR%20Geospatial%20V02_Blog.png"></a></div><br><div><br><br><i><br></i><div><i><br></i><p><a href="https://www.youtube.com/watch?v=1KOO2lqsdaA">At this year's Google I/O</a>, we announced an update for spatial experiences: the <a href="https://developer.android.com/reference/kotlin/androidx/xr/arcore/Geospatial">Geospatial API</a> is now available as a preview in <a href="https://developer.android.com/develop/xr/jetpack-xr-sdk/arcore">ARCore for Jetpack XR</a>. By bringing Google's Visual Positioning System (VPS) to Android XR, Android XR enables anchoring digital content to the physical world with sub-meter accuracy and precise orientation in supported areas.* To explore what the Geospatial API could unlock, our team built a demo: the XR Geospatial Tour.</p>

<p>Imagine walking into a new city, putting on a pair of wired XR glasses (like the upcoming XREAL Project Aura), and instantly having a knowledgeable, local guide showing you around. You don't need to stare down at a 2D map—instead, 3D models gently guide your path, and an intelligent voice tells you about the historical landmarks right in front of you. We combined the <a href="https://developer.android.com/reference/kotlin/androidx/xr/arcore/Geospatial">Geospatial APIs</a>, <a href="https://firebase.google.com/docs/ai-logic">Gemini API using Firebase AI Logic</a>, <a href="https://ai.google.dev/gemini-api/docs/maps-grounding">Google Maps Grounding</a>, and <a href="https://developer.android.com/develop/xr/jetpack-xr-sdk">Jetpack XR SDK</a> to create a hands-free, immersive walking tour experience.</p>

<div class="separator">
  
<p>*Disclaimer: Video and Tour Guide application are for demonstration purposes only. Some sequences have been shortened. Any hardware depicted may be under development; final product details may differ.</p>

<p>Let’s walk through the implementation details and show how we tied these APIs together to build a world-scale spatial experience.</p>

<h3>1. Pinpointing the User with ARCore Geospatial API (VPS)</h3>
<p>Enhance your navigation experience on XR by combining the power of GPS with the precision of VPS. The accuracy and precise orientation that comes with VPS allows 3D waypoints to align with the physical world.</p>

<p>This is why the Geospatial API on Android XR can help you build custom experiences. By using advanced computer vision, VPS tries to provide a <a href="https://developer.android.com/reference/kotlin/androidx/xr/runtime/math/GeospatialPose">GeospatialPose</a> (including latitude, longitude, and heading) that is more accurate than GPS.</p>

<p>Here's how we retrieve the user's Geospatial pose by mapping the device's orientation to a Geospatial coordinate:</p>
<pre><div>// Retrieve the current geospatial pose from the ARCore session</div><code><div>val result = geospatial.createGeospatialPoseFromPose(arDevice.state.value.devicePose)</div><div>if (result is CreateGeospatialPoseFromPoseSuccess) {</div><div>    val pose = result.pose</div><div>    Log.d("VPS", "Accurate Location: ${pose.latitude}, ${pose.longitude}")</div><div>}</div></code></pre>

<p>Because the entire experience relies on this accuracy, we monitor the horizontalAccuracy and orientationYawAccuracy until they meet our thresholds. If the user is indoors or in an unrecognized area, we prompt them to "walk to an outdoor public space and look around".</p>

<h3>2. Crafting the Itinerary with Gemini API &amp; Google Maps Grounding</h3>
<p>Once we have a location, we use the <a href="https://firebase.google.com/docs/ai-logic">Gemini API using Firebase AI Logic</a> to prompt the Gemini model to act as a local tour guide. We pass the user's coordinates to the model and ask it to output a structured JSON response containing nearby walking tours:</p>

<pre><div>   val configForTools = ToolConfig(</div><code><div>      functionCallingConfig = null,</div><div>      retrievalConfig = retrievalConfig {</div><div>        latLng = FirebaseLatLng(pose.latitude, pose.longitude)</div><div>        languageCode = "en"</div><div>      }</div><div>    )</div><div></div><div>    val responseJsonSchema = Schema.obj(</div><div>      mapOf(</div><div>        "locationIntro" to Schema.string(),</div><div>        "tours" to Schema.array(</div><div>          Schema.obj(</div><div>            mapOf(</div><div>              "title" to Schema.string(),</div><div>              "description" to Schema.string(),</div><div>              "stops" to Schema.array(</div><div>                Schema.obj(</div><div>                  mapOf(</div><div>                    "name" to Schema.string(),</div><div>                    "detailedName" to Schema.string(),</div><div>                    "description" to Schema.string()</div><div>                  )</div><div>                )</div><div>              )</div><div>            )</div><div>          )</div><div>        )</div><div>      )</div><div>    )</div><div></div><div>    val model = Firebase.ai(backend = GenerativeBackend.googleAI()).generativeModel(</div><div>      modelName = "gemini-3.5-flash",</div><div>      tools = listOf(Tool.googleMaps()),</div><div>      generationConfig = generationConfig {</div><div>        responseMimeType = "application/json"</div><div>        responseSchema = responseJsonSchema</div><div>      }</div><div>    )</div><div></div><div>   val result = model.generateContent("The user is at latitude ${pose.latitude} and longitude ${pose.longitude}. Generate exactly 3 diverse tours near this location (e.g., historical, food, nature). All tour ideas should be walking distance only.")</div></code></pre>

<p>Large Language Models are great at generating rich descriptions, but they can sometimes hallucinate exact latitude/longitude coordinates. To solve this, we used <a href="https://ai.google.dev/gemini-api/docs/maps-grounding">Google Maps Grounding</a> to ground the AI.</p>

<h3>3. A Voice to Guide You: Gemini 2.5 TTS</h3>
<p>To make the tour guide feel truly present, we implemented dynamic voiceovers.</p>

<p>Using the gemini-2.5-flash-tts model, we can configure our model generation config to natively return audio data instead of just text! Here’s how you can request the ResponseModality.AUDIO:</p>

<pre><div>val ttsModel = Firebase.ai(backend = GenerativeBackend.googleAI())</div><code><div>    .generativeModel(</div><div>        modelName = "gemini-2.5-flash-tts",</div><div>        generationConfig = generationConfig {</div><div>            // Instruct the model to return Audio</div><div>            responseModalities = listOf(ResponseModality.AUDIO)</div><div>        }</div><div>    )</div><div></div><div>val response = ttsModel.generateContent("Say in a neutral but positive voice:\n$prompt")</div><div></div><div>// Extract the raw audio bytes from the response</div><div>val audioBytes = response.candidates.firstOrNull()?.content?.parts</div><div>    ?.filterIsInstance&lt;InlineDataPart&gt;()</div><div>    ?.firstOrNull { it.mimeType.contains("audio") }?.inlineData</div></code></pre>

<h3>4. Bringing it to Life in 3D with Jetpack XR</h3>
<p>The final piece of the puzzle is rendering this data in the user's field of view. The Jetpack XR SDK makes it intuitive to transition from  a 2D Android UI to spatial computing.</p>

<p>We used Jetpack Compose for XR to build spatial components. To represent points of interest along the tour, we built a Composable called InfoSphere, which contains a GltfModel of a 3D orb that floats in space and can be interacted with to reveal information.</p>

<p>Using Jetpack XR SDK, we can place 3D models alongside the Compose UI using <a href="https://developer.android.com/reference/kotlin/androidx/xr/compose/subspace/SpatialBox.composable">SpatialBox</a> and <a href="https://developer.android.com/reference/kotlin/androidx/xr/compose/subspace/SceneCoreEntity.composable">SceneCoreEntity</a>. We also used <a href="https://developer.android.com/reference/androidx/xr/scenecore/InteractableComponent">InteractableComponent</a> to respond to user taps.</p>
<pre><div>@Composable</div><code><div>fun InfoSphere(</div><div>    content: InfoBubbleContent,</div><div>    session: Session,</div><div>    sphereModel: GltfModel,</div><div>    isSelected: Boolean,</div><div>    onClick: () -&gt; Unit</div><div>) {</div><div>    // SpatialBox lets us arrange 3D components and SpatialPanels together</div><div>    SpatialBox(</div><div>        SubspaceModifier</div><div>            .offset(x = 2.dp, y = 1.dp, z = (-3).dp) // Positioned in 3D space</div><div>    ) {</div><div>        // Smoothly animate the visibility of our 2D Compose UI Panel</div><div>        AnimatedSpatialVisibility(visible = isSelected) {</div><div>            SpatialPanel {</div><div>                InfoBubble(content) // Regular 2D Compose UI</div><div>            }</div><div>        }</div><div>        // Render our interactive 3D sphere</div><div>        SceneCoreEntity(</div><div>            factory = {</div><div>                GltfModelEntity.create(session, sphereModel).also { entity -&gt;</div><div>                    // Make the 3D model respond to user taps</div><div>                    entity.addComponent(InteractableComponent.create(session) { inputEvent -&gt;</div><div>                        if (inputEvent.action == InputEvent.Action.UP) {</div><div>                            onClick()</div><div>                        }</div><div>                    })</div><div>                }</div><div>            }</div><div>        )</div><div>    }</div><div>}</div></code></pre>

<p>By combining <a href="https://developer.android.com/reference/kotlin/androidx/xr/compose/subspace/animation/AnimatedSpatialVisibility.composable">AnimatedSpatialVisibility</a> for traditional Compose UI surfaces with SceneCoreEntity 3D elements, we're able to seamlessly blend data into the physical world.</p>

<h3>Explore what’s possible with Android XR today</h3>
<p>Building the XR Geospatial Tour app showed us that the barrier to entry for world-scale spatial experiences is lower than ever for Android developers. With the Geospatial API now available in preview on Android XR, your apps can seamlessly understand the physical world around them. By combining <a href="https://developer.android.com/develop/xr/jetpack-xr-sdk/ui-compose">Compose for XR</a>’s APIs with the high-precision location data of VPS and the generative capabilities of Gemini, we can create experiences that understand both where the user is and what they are looking at.</p>

<p>To help you get hands-on with Android XR, we are thrilled to open applications for the <a href="https://developer.android.com/develop/xr/catalyst">Android XR Developer Catalyst Program</a>, which includes XREAL Project Aura. Starting today, you can apply to get access to an XREAL Project Aura devkit or our display glasses devkit over the coming months! </p>

<footer>
  <p>*Disclaimer: Available on select devices. Internet connection required. Works on compatible apps and surfaces. Results may vary.</p>
  <p><br></p>
</footer></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Android developer verification: Building a safer ecosystem together]]></title>
<description><![CDATA[Posted by Matthew Forsythe, Director Product Management, Android App SafetyJuly 15, 2026: Updated Play Console requirements for Play developersTo meet Android developer verification and updated Play Console Requirements, Play developers must register their Play apps in Play Console. While 99% of ...]]></description>
<link>https://tsecurity.de/de/3693503/android-tipps/android-developer-verification-building-a-safer-ecosystem-together/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693503/android-tipps/android-developer-verification-building-a-safer-ecosystem-together/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:33 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2JeeSz9AeQDASycrf2ssGmJn2yQGvGFjyU29jKSs5hFtYySX9X5wDw4Pb63DF3co77osfiLeYj6LGt-_1v66X3svzCOdWAZz3w9Q2WKF28T4qZ4tCbiTEsP88lIZ44Ua6mLfg6VIQL_k3PVWlU4vDnJkTc9mJkdz188lH-smTL3oA47Yongl1w8sf4RY/s1235/260317_ADV%20Blog_Metadata.png"><div><i>Posted by Matthew Forsythe, Director Product Management, Android App Safety</i></div><div><br></div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4_MWnkCTsO9zdnVQqFu2Aep5Q_GMvQvuXoGn-H_LXNpOYIVYFqbHi0R0iKpChOEJ-GB0p_7fLCiK_IGETshue4Fjd3tjyg95M3i92-DzdZpND5GPhr9jeBuj620YHAhPJ6CLdDXD8jsA1XyyYiBCS4p4eoZizZnA0DHKpwJqDUq-agwXl_GbtLrKdM5Y/s4210/260317_ADV%20Blog_Header.png"><img border="0" data-original-height="1254" data-original-width="4210" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4_MWnkCTsO9zdnVQqFu2Aep5Q_GMvQvuXoGn-H_LXNpOYIVYFqbHi0R0iKpChOEJ-GB0p_7fLCiK_IGETshue4Fjd3tjyg95M3i92-DzdZpND5GPhr9jeBuj620YHAhPJ6CLdDXD8jsA1XyyYiBCS4p4eoZizZnA0DHKpwJqDUq-agwXl_GbtLrKdM5Y/s16000/260317_ADV%20Blog_Header.png"></a></div><br><br><div><br></div><div><br></div><div><br></div><b>July 15, 2026: Updated Play Console requirements for Play developers</b><br><br><blockquote>To meet Android developer verification and <a href="https://support.google.com/googleplay/android-developer/answer/17125096">updated Play Console Requirements</a>, Play developers must <a href="https://support.google.com/googleplay/android-developer/answer/16984799">register their Play apps</a> in Play Console. While 99% of apps on Play have been registered automatically, you should check your <a href="https://play.google.com/console/u/0/developers/5700313618786177705/android-developer-verification">Play Console Home page</a> to register any remaining apps by September 30, 2026 to avoid global removal from Google Play and ensure a seamless user installation experience. </blockquote><br><blockquote>You can also use Play Console to register apps you distribute outside of Google Play to ensure they can be installed on certified Android devices.</blockquote><span><div><br></div></span><div>Last year, we introduced <a href="https://developer.android.com/developer-verification">Android developer verification</a> to strengthen ecosystem security and stop malicious actors from hiding behind anonymity to release harmful apps. Millions of apps have been registered since the verification launched in March, covering nearly all installs on Google Play and a large majority of installs from outside of Google Play. We appreciate the feedback and partnership from industry leaders, developers, and Android communities that helped us design this experience and drive strong adoption.<h2>Initial launch across seven stores and four countries</h2>

<p>These new developer verification protections will take effect on September 30, 2026, starting with users in Brazil, Indonesia, Singapore, and Thailand.</p>

<p>This rollout is an <b>industry-wide effort to create a safer ecosystem</b>. We will begin by verifying app installations from the following stores:</p>

<ul>
    <li>Google (Google Play)</li>
    <li>Honor (HONOR App Market)</li>
    <li>OPlus (OPPO App Market)</li>
    <li>Samsung (Galaxy Store)</li>
    <li>Transsion (Palm Store)</li>
    <li>vivo (V-Appstore)</li>
    <li>Xiaomi (GetApps)</li>
</ul>

<p>Following this initial phase with our partners, we will expand these protections globally for all apps on certified Android devices in 2027.</p><h2>Automate your workflow with new APIs</h2>

<p>To further streamline app registration, we are<b> launching a suite of developer-requested APIs</b> to help you register apps in bulk or directly through your continuous integration and deployment (CI/CD) pipelines. The Android Developer ID Status API will let you check if a package name has already been registered, and the Android Developer Console API will let you register and manage package names directly within your development environment. Both APIs also support OAuth delegation, allowing third-party platforms, like Android app stores, to perform these operations natively on your behalf.</p>

We'll launch these APIs over the next few months.<h2>What’s next</h2>

<p></p><ul><li><strong>June 2026:</strong> Starting this month, we are rolling out a new <a href="https://support.google.com/android/answer/17065026">system service</a> that will be automatically installed on most Android devices. This service will be used later this year to verify developer registration.</li><li><strong>July 2026:</strong> We’ll launch the Android Developer ID Status API globally and begin early access for the Android Developer Console API. Early access also starts for <a href="https://developer.android.com/developer-verification/guides/limited-distribution">limited distribution accounts</a> on Android Developer Console. This new type of Android developer account is designed for students, hobbyists, and learners and lets you share your apps to up to 20 devices without a government-issued ID or a fee.</li><li><strong>August 2026:</strong> Limited distribution accounts and the new Android Developer Console API will launch globally. We’ll also launch an <a href="https://android-developers.googleblog.com/2026/03/android-developer-verification.html">advanced flow</a> for installing apps from unverified developers, which includes security checkpoints to resist coercion scams, while allowing power users to maintain the ability to <a href="https://developer.android.com/developer-verification/guides/faq#sideload-apps">sideload apps</a> from unverified developers.</li><li><strong>September 30, 2026:</strong> App registration becomes required for <b>participating stores in Brazil, Indonesia, Singapore, and Thailand</b>. Unregistered apps can be sideloaded with Android Debug Bridge (adb) or advanced flow.</li><li><strong>2027 and beyond:</strong> After incorporating the feedback from our partners, users, and developer community, we’ll expand the Android verification requirement globally.<br></li></ul><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFUMAeS0ew75nme5xUK0qAQraK0-WpiUXp1B6m1yJFMqOrHUo7AyMMEfO-aYq9mZ6vy7GYPcBxRByKGQNgRbS99uW1b5hwbViEmIbGFVsLqhw7e-LSF_dozTAlKb7D1n_0Rc42S5MxzpxI5rrbSdDIQMVt6SXEErcnI-HrA0McFfL_BMoe2xMJtG9UU6I/s960/ABL_83_Blog%20in%20line%20asset%20-%20ADV%20July.png" imageanchor="1"><img border="0" data-original-height="540" data-original-width="960" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFUMAeS0ew75nme5xUK0qAQraK0-WpiUXp1B6m1yJFMqOrHUo7AyMMEfO-aYq9mZ6vy7GYPcBxRByKGQNgRbS99uW1b5hwbViEmIbGFVsLqhw7e-LSF_dozTAlKb7D1n_0Rc42S5MxzpxI5rrbSdDIQMVt6SXEErcnI-HrA0McFfL_BMoe2xMJtG9UU6I/s1600/ABL_83_Blog%20in%20line%20asset%20-%20ADV%20July.png"></a></div><br><div><br></div><h2>Get started with Android developer verification</h2>

<p>If you distribute apps in Brazil, Indonesia, Singapore, or Thailand via the stores listed above, please ensure your verification is complete by the September deadline.</p>

<p></p><ul><li><strong>Google Play developers:</strong> Most Play developers are already verified, and over 99% of their apps have been registered. Go to your <a href="https://play.google.com/console/developers/app-list">Play Console Home page</a> to see your app’s verification status, and <a href="https://support.google.com/googleplay/android-developer/answer/16984799">register apps</a> you want to continue distributing that weren't automatically registered.</li><li><strong>Developers who distribute only outside of Google Play:</strong> Sign up for the <a href="https://android.google.com/developerconsole/developers">Android Developer Console</a> today to register your apps.</li></ul><p></p>



<p></p><ul><ul><li><strong>Students and hobbyists:</strong> Sign up <a href="https://google.qualtrics.com/jfe/form/SV_4N7NGE06NjJJdl4">here</a> for early access to limited distribution accounts to help us refine the feature with your feedback.</li></ul></ul><p></p>

Thank you for helping us build a safer Android ecosystem. Stay tuned for more updates as we approach September and the 2027 global rollout.</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Eclipsa Video: HDR That Looks Right on Every Screen]]></title>
<description><![CDATA[Posted by Tibian Elsheikh, Product Manager, Android Core Graphics and Jeffrey Jose, Product Manager, Android Core Graphics
We’ve all been there: You’re scrolling through your favorite social media feed in a dim room, and suddenly an HDR video pops up. It’s so intensely bright that you have to squ...]]></description>
<link>https://tsecurity.de/de/3693501/android-tipps/eclipsa-video-hdr-that-looks-right-on-every-screen/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693501/android-tipps/eclipsa-video-hdr-that-looks-right-on-every-screen/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:30 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGg9E8BsBcgigJ3Pwhp0Wbd85wffhQKw9jT9eW4_IJHtJsxtaqBqZoWIc4agLIZu9h2eWFEnMgipcv2PnMM2UC9tsZOJp3AMjsOX1KQRoisg5IKTRS20hFOIvJmlViYFz-QOh3-KdyFRIgUaiKs2ehjrJBd9W_yW13aP4xgRQovNCEAviajCLWFTTVrjs/s2469/Eclipsa%20Video%20V01%20White_Meta.png"><div><i>Posted by Tibian Elsheikh, Product Manager, Android Core Graphics and Jeffrey Jose, Product Manager, Android Core Graphics</i></div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0slfG8CUVGmPiAUHIXkeIVZGveJMOvf1TorUdONiRYV1THM80OzIIjGV5-bOboEhNz7FB4sTYx72ySEjFhQ4oW97-sLZ4scOX2Sb5BBU9qPMvOXvq2XRj098K7ElBnvy4k68jKELpDZ7vd4NIs2Hud2w14re18dOx7dksdFXRBR_Nd8yOiBrw8cLr_kM/s8583/Eclipsa%20Video%20V02_Blog.png"><img border="0" data-original-height="2601" data-original-width="8583" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0slfG8CUVGmPiAUHIXkeIVZGveJMOvf1TorUdONiRYV1THM80OzIIjGV5-bOboEhNz7FB4sTYx72ySEjFhQ4oW97-sLZ4scOX2Sb5BBU9qPMvOXvq2XRj098K7ElBnvy4k68jKELpDZ7vd4NIs2Hud2w14re18dOx7dksdFXRBR_Nd8yOiBrw8cLr_kM/s1600/Eclipsa%20Video%20V02_Blog.png"></a></div><br><p><br></p>
<p>We’ve all been there: You’re scrolling through your favorite social media feed in a dim room, and suddenly an HDR video pops up. It’s so intensely bright that you have to squint, or maybe you find yourself turning down your screen brightness just to read the caption. Other times, a video that looks vibrant on your phone looks flat, dark, or washed out when you watch it on your living room TV. </p><p>While High Dynamic Range (HDR) technology was designed to make videos look richer and more lifelike, the lack of unified industry guidelines means that the exact same clip can render in unexpected and jarring ways depending on the display you’re using.</p>

<p>To solve this, we’re introducing Eclipsa Video—a new standard built to make your favorite videos look consistent, balanced, and comfortable on every screen. Eclipsa Video builds on the open <a href="https://github.com/SMPTE/st2094-50">SMPTE ST 2094-50 specification</a>, which Google developed in collaboration with Apple and NBCUniversal.</p><br><p></p><i><div><i><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLDY0gLjHQYTZZfRzikfPu8P3jZkXhq6Wqo1GFj3CvBh9YaboIDUstPcnV94Qan8nVkXXBlXLm5vSktLM_q9DJIIn_jyeW9LyZchI5Fpm6AD7A5XD3ZRslzBFhJLAvRj589ukW0etBNCg7004SjySw_SYsGkg6dQ8AtgfofOZeFTx8R3H7xWfwAuA-Rqc/s1066/Eclipsa_9-16_Transparent%20(2).gif"><img border="0" data-original-height="1066" data-original-width="600" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLDY0gLjHQYTZZfRzikfPu8P3jZkXhq6Wqo1GFj3CvBh9YaboIDUstPcnV94Qan8nVkXXBlXLm5vSktLM_q9DJIIn_jyeW9LyZchI5Fpm6AD7A5XD3ZRslzBFhJLAvRj589ukW0etBNCg7004SjySw_SYsGkg6dQ8AtgfofOZeFTx8R3H7xWfwAuA-Rqc/w225-h400/Eclipsa_9-16_Transparent%20(2).gif" width="225"></a></div>Sudden brightness spikes during feed scrolling—fixed with Eclipsa Video.</i></div></i><p></p>

<h3><strong><span>More consistency, comfort, and creative control</span></strong></h3>Eclipsa Video moves past individual display guesswork. Instead of leaving it up to your device to interpret a video’s brightness on its own, our format carries precise guidelines that tell compatible displays exactly how to render the image. <br><p>Designed to scale with your hardware, Eclipsa Video provides three core benefits:</p>

<ul>
    <li><strong>A consistent baseline:</strong> Eclipsa Video introduces a shared rulebook for screens. It establishes a consistent benchmark for normal brightness—known as the <b>HDR reference white</b>. This ensures standard text, app interfaces, and standard-range colors remain vibrant and readable without causing uncomfortable screen glare.</li>
    <li><strong>Adaptive headroom:</strong> Screens have different physical brightness limits, or "headroom." Eclipsa Video guides how displays handle highlights dynamically. Bright details remain brilliant on a premium television, while being scaled intelligently on a mobile screen to prevent sudden blinding transitions.</li>
    <li><strong>Preserved creative intent:</strong> Rather than applying a single static setting to an entire video, Eclipsa Video carries adaptive, frame-by-frame instructions. Think of it as a set of digital notes from the creator traveling with the video, ensuring the exact colors, contrast, and mood they graded are preserved on your display.</li></ul>

<div class="separator"><img border="0" data-original-height="1080" data-original-width="2200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirgS5TsogRUxWbypUiFlWIRuL8nQhdagvc7UHVFjoDG00SjqSrMniKFEys-EzgcrHKi6Am5BrtALEs7px1oaaJ5ciaO7hP0_49i8RuD7uCckjW7jYWrSoFkDlob6dJhL42MPLiBQqAjaPMOMJDEjZjDgvVe0P28fw13RlMNSiMEAlx5XFXCr8o6L8SRo0/s1600/Eclpsa%20Blog%20post%20image-AlphaB.png"><br><div><i>Eclipsa Video preserves true highlight detail on any screen you watch.</i></div></div><h3><strong><span>Built natively into Android 17</span></strong></h3>

<p>Starting with Android 17, support for Eclipsa Video is built directly into the platform. This means a more comfortable, true-to-life HDR experience is coming natively to the phones, tablets, and TVs you rely on every day. The video you capture carries its creative intent with it, and the video you watch is shown exactly the way it was meant to be seen.</p>

<h3><strong><span>Guidelines for developers &amp; creators</span></strong></h3>

<p>We’re inviting the developer and creator ecosystem to help build a more reliable HDR environment:</p>

<ul>
    <li><strong>Get started with implementation:</strong> Learn how to configure playback and capture in your apps with our <a href="https://developer.android.com/media/platform/integrate-eclipsa-video">official guide</a>.</li>
    <li><strong>ExoPlayer &amp; Media3 integration:</strong> Standard playback handling built directly into <a href="https://developer.android.com/media/media3/exoplayer">Jetpack Media3,</a> allowing ExoPlayer to support Eclipsa Video metadata automatically with no additional player configuration.</li>
    <li><strong>Explore open source tools:</strong> View and inspect <a href="https://github.com/SMPTE/st2094-50">SMPTE ST 2094-50</a> metadata and dynamic gain curves in real time using <a href="https://webmproject.github.io/hdr-explorer/">HDR Explorer</a>.</li>
</ul>

<h3><strong><span>What’s next</span></strong></h3>

<p>Eclipsa Video is rolling out now, and you’ll see more apps and devices supporting it over time. Because it’s an open standard, any app developer or hardware manufacturer can integrate it to elevate the viewing experience.</p>

<p>Try out the new tools in Android 17, explore the open-source metadata, and let us know what you think on our developer channels. We can’t wait to see what you create.</p>

<h3><strong><span>Notes &amp; Availability</span></strong></h3>
<p><strong>1. Device Compatibility:</strong> Eclipsa Video playback and capture are supported natively on devices running Android 17 (API level 37) and above with HDR displays passing Eclipsa Compliance tests.</p>
<p><strong>2. Developer Resources:</strong> The <a href="https://github.com/SMPTE/st2094-50">SMPTE ST 2094-50 Specification</a> is openly accessible for technical evaluation.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Android Studio Quail 2 is Stable: Multi-task with the Android Studio AI agent]]></title>
<description><![CDATA[Posted by Amman Asfaw, Product Manager, Android Studio

Android Studio Quail 2 is now stable and ready for you to use in production, bringing a shift to your IDE with concurrent agentic workflows, natively integrated memory leak profiling, and context-aware crash remediation. Whether you are perf...]]></description>
<link>https://tsecurity.de/de/3693500/android-tipps/android-studio-quail-2-is-stable-multi-task-with-the-android-studio-ai-agent/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693500/android-tipps/android-studio-quail-2-is-stable-multi-task-with-the-android-studio-ai-agent/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:29 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitwUFdkGaqVNsaJ2iCtprD4WZuFjvI1rR6WX35ewxin0wbtVadUtkRb3qYG-KGEKepmtC4WFv2mSAmUBRmZ-oR5ey_-codg1_MhbagflhqgWk2MdNX6-yL8SaADve6mn3v0aJ_uh-qLizIgdImHaQ_KdJfVYqvCga_v_fyJYPHKDyhuhVklAfo145xays/s2461/QuailBlog_Meta.png"><p>Posted by Amman Asfaw, Product Manager, Android Studio</p><p></p><p></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-nTZM4cgutSVcLIdjSDqJoeiaES_FELwFC84O01Roy0P81-mAyqz3X2w4pwzAZwdhiMeUuhRSyT4euWZkWtGderw6LRu-fK6k-w8lB-9k7GMXOFBy0IzgtGmUk6QkRriFX24lchlTD0SQhbywxli4p4iZ7JzMAN80YoCdruEeruJ58bwhmuo0cj9Y_yg/s2152/QuailMovement_V1_a.gif"><img border="0" data-original-height="608" data-original-width="2152" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-nTZM4cgutSVcLIdjSDqJoeiaES_FELwFC84O01Roy0P81-mAyqz3X2w4pwzAZwdhiMeUuhRSyT4euWZkWtGderw6LRu-fK6k-w8lB-9k7GMXOFBy0IzgtGmUk6QkRriFX24lchlTD0SQhbywxli4p4iZ7JzMAN80YoCdruEeruJ58bwhmuo0cj9Y_yg/s1600/QuailMovement_V1_a.gif"></a></div><br><p></p><p><br></p><p><br></p><p><br></p>

<p>Android Studio Quail 2 is now stable and ready for you to use in production, bringing a shift to your IDE with concurrent agentic workflows, natively integrated memory leak profiling, and context-aware crash remediation. Whether you are performing a sweeping architectural overhaul, tracing a memory leak, or resolving a critical production crash, Android Studio keeps you anchored in your workspace by reducing manual friction.</p>
<p>Here’s a deep dive into what’s new:</p>
<h2>Multi-tasking with parallel chats</h2>

<p>In Android Studio Quail 2, we've been hard at work redesigning Agent Mode from the ground up. This new architecture provides better performance, offers more flexibility for decomposing complex tasks, and improves the suite of internal tools the agent uses to do its work.</p>In addition to these behind-the-scenes improvements, these changes also allow you to converse across multiple agent chats simultaneously. Waiting for the Android Studio agent to finish a task before you can ask another question or initiate a separate task in Agent Mode is a bottleneck of the past. You can multi-task seamlessly: kick off a UI refactor in one tab, fix a ProGuard rule in a second, and generate documentation in a third.<br><br> You can also change which models the agent uses from chat to chat based on the requests you have. Take a look at <a href="http://d.android.com/bench">Android Bench</a> for an analysis of how LLMs perform Android development tasks. 

<p></p><ul><li><strong>How to use:</strong> Click the "+" icon to start a new parallel conversation, and use the <b>History</b> icon to navigate between active tasks. Alternatively, select File &gt; New &gt; New Agent Tab to open a conversation in a dedicated tab.</li><li><strong>Note:</strong> Worktree support is currently unavailable. Exercise caution when running concurrent chats that modify the same project files, which can potentially lead to editor conflicts.</li></ul><p></p>

<div class="separator">
  
</div>

<p><i>Run multiple agent tasks in parallel with different models of your choice.</i></p><p></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwUDucsd939pAvvfRC8VvmNkDp-1nDBMaP3TGFwdjspFgPz7_CVS-7NVzNhP278oKO3MNJL0RZy3k9aCZgmVtuqsahIZh79bGXhB026yKqPPiMYVMFkkSUgTBSLLajNObkMkke_iF6i_cIMRRQ_5Zl8zLgXWKYItToSiyLaZfok-pd-KVkAkRfup_yCsI/s3456/Screenshot%202026-06-17%20at%2012.56.57%E2%80%AFAM.png"><img border="0" data-original-height="2044" data-original-width="3456" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwUDucsd939pAvvfRC8VvmNkDp-1nDBMaP3TGFwdjspFgPz7_CVS-7NVzNhP278oKO3MNJL0RZy3k9aCZgmVtuqsahIZh79bGXhB026yKqPPiMYVMFkkSUgTBSLLajNObkMkke_iF6i_cIMRRQ_5Zl8zLgXWKYItToSiyLaZfok-pd-KVkAkRfup_yCsI/s1600/Screenshot%202026-06-17%20at%2012.56.57%E2%80%AFAM.png"></a></div><span><div><i>Use the History icon to navigate between active tasks.</i></div></span><p></p>

<h2>Memory leak detection with LeakCanary</h2>

<p>Memory leaks in Android occur when your code holds onto an object's reference long after its life cycle has ended. This prevents the Garbage Collector from reclaiming that memory, eventually leading to sluggish performance or <code>OutOfMemoryError</code>.</p>

<p>Hunting down memory leaks can be a tedious, manual task. Starting with Android Studio Quail 2, the popular open-source leak detector <a href="https://square.github.io/leakcanary/">LeakCanary</a> is natively integrated directly into the Profiler as a dedicated, first-class task.</p>

<p>This integration transforms your debugging performance by lifting and shifting the heap analysis off your resource-constrained testing phone, and onto your powerful development computer. By running the analysis on your computer, leak tracing is up to five times faster and jank-free, leaving your test app running smoothly on the device.</p>

<p>Once a leak is detected during a profiling session:</p>
<ul>
  <li>The Profiler renders an interactive, color-coded leak trace, grouping occurrences and estimating lost memory.</li>
  <li>You can click <b>Go to declaration</b> on any leaking object in the trace to instantly jump to that exact line of code in your editor.</li>
  <li>You can click <b>Fix with Agent</b> to have the Gemini agent ingest the trace, explain the root cause of the retained reference, and write the exact code change (such as unbinding a listener or clearing a static reference) to plug the leak.</li>
</ul>

<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjwBONeahZYC_5KBtkgQkc5vTjzmN5D-ypyOOScCRcp6Cy8CZeNHVWeNViBS6D_we7HaRy_AjIg1tptZAVEqNTeQ4IVVjoQp4_XJp45648fhiD0H5qvNmiPphikYGDNbEyus-QTVkSU9imwJm4QN0CKnWFs6JZsVkC21SXl9LXAnSndereOvE6iDWOmsEo/s1250/Leak_Canary_4e3675ccb2_ZXI2sE.webp"><img border="0" data-original-height="640" data-original-width="1250" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjwBONeahZYC_5KBtkgQkc5vTjzmN5D-ypyOOScCRcp6Cy8CZeNHVWeNViBS6D_we7HaRy_AjIg1tptZAVEqNTeQ4IVVjoQp4_XJp45648fhiD0H5qvNmiPphikYGDNbEyus-QTVkSU9imwJm4QN0CKnWFs6JZsVkC21SXl9LXAnSndereOvE6iDWOmsEo/s1600/Leak_Canary_4e3675ccb2_ZXI2sE.webp"></a><span><i>Review memory leaks identified via LeakCanary through the Fix with Agent button.</i></span></div>

<h2>App Quality Insights agent integration</h2>

<p>Tracking down the root cause of an app crash can require manually synthesizing stack traces, device data, and source code. However Android Studio’s App Quality Insights (AQI) is now fully integrated with Agent Mode to do the heavy lifting for you.</p>

<p>When you click on a crash in the AQI panel, you immediately get a concise, high-level summary of the issue. If you need to dig deeper, simply click <b>See more</b>. This opens a dedicated chat where the agent uses your selected model and pulls in local source code and the full stack trace to deliver a comprehensive explanation of the failure.</p>

<p>With the new agent integration, you move directly from issue identification to resolution. By clicking <b>Fix with AI</b>, the agent will analyze the issue, propose a step-by-step fix plan, and—upon your approval—apply the necessary code changes directly to your project and verify the resulting fix</p>

<div class="separator">
  
</div><p><i>The <b>Fix with AI</b> button triggering the agent to analyze the issue, then propose the fix</i></p>

<h2>Quality &amp; stability improvements</h2>

<p>Beyond new features, we’ve continued our focus on quality by addressing numerous bugs and incorporating the latest stability and performance improvements from the IntelliJ platform, making this a significant enhancement for your daily development.</p>

<h2>Get Started</h2>

<p>Ready to dive in and accelerate your development? <a href="https://developer.android.com/studio">Download</a> Android Studio Quail 2 and start exploring these new features today! As always, your feedback is crucial to us. <a href="https://developer.android.com/studio/known-issues">Check known issues</a>, <a href="https://developer.android.com/studio/report-bugs">report bugs</a>, and be part of our vibrant community on <a href="https://www.linkedin.com/showcase/androiddev/posts/?feedView=all">LinkedIn</a>, <a href="https://medium.com/androiddevelopers">Medium</a>, <a href="https://www.youtube.com/c/AndroidDevelopers/videos">YouTube</a>, or <a href="https://twitter.com/androidstudio">X</a>. </p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Build intelligent Android apps: Integrate into Android's intelligence system using AppFunctions]]></title>
<description><![CDATA[Posted by Ben Weiss, Senior Developer Relations Engineer, Android Developer RelationsWelcome back to the blog post series "Build intelligent Android apps" where we take a basic Android app and transform it into a personalized, intelligent, and agentic experience. In our previous post, we explored...]]></description>
<link>https://tsecurity.de/de/3693499/android-tipps/build-intelligent-android-apps-integrate-into-androids-intelligence-system-using-appfunctions/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693499/android-tipps/build-intelligent-android-apps-integrate-into-androids-intelligence-system-using-appfunctions/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:27 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi961epgT3N_Za_k2-pCJ30tegn7DM-Umh1LWh7Q4NxhryR5H57JB00zKQcek56ccAvEM95i6wyXWWCZZ7486_Gq1ewxPHtsMY13UVsVTmndAvkOJtHPjUXuZ3XW_yBEFtlOr2ocBFIKr0PCRZhIRs67h6bX6zDKihwcxQs8bGbYTqIp5azuBKcX4PNMMY/s2469/AFD%20-%20%5BABL_104%5D%20JetPacker%20AppFunctions_Meta.png"><p></p><p><i>Posted by Ben Weiss, Senior Developer Relations Engineer, Android Developer Relations</i></p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi92OFxAOxVMpResmBcBoUfxzgcMmVOMn3mXQabB9O-xkC7pjYxrvXS7YLTEWLIBstwuDLc0ePCC-Tf7AKq62mgAXjSYg9-VUIjKvokK6BhGHqPDSXCTQowbpj40plsP3V3Ju3ck4gzNdJmGQ6C1-twuob2UnPu7oY9B_oSwnYSkaif7lSEMwFnStzWknM/s8583/AFD%20-%20%5BABL_104%5D%20JetPacker%20AppFunctions_Blog.png"><img border="0" data-original-height="2601" data-original-width="8583" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi92OFxAOxVMpResmBcBoUfxzgcMmVOMn3mXQabB9O-xkC7pjYxrvXS7YLTEWLIBstwuDLc0ePCC-Tf7AKq62mgAXjSYg9-VUIjKvokK6BhGHqPDSXCTQowbpj40plsP3V3Ju3ck4gzNdJmGQ6C1-twuob2UnPu7oY9B_oSwnYSkaif7lSEMwFnStzWknM/s1600/AFD%20-%20%5BABL_104%5D%20JetPacker%20AppFunctions_Blog.png"></a></div><br><p><br></p><p>Welcome back to the blog post series "<a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-introduction-jetpack.html" target="_blank">Build intelligent Android apps</a>" where we take a basic Android app and transform it into a personalized, intelligent, and agentic experience. In our <a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-cloud-hybrid-inference.html">previous post</a>, we explored how to leverage Firebase AI Logic to build cloud-hosted and hybrid AI features.</p>Traditional mobile UIs excel at focused, hands-on tasks, and the Android intelligence system is introducing complementary features to make complex, multi-step actions even easier. By supplementing traditional user interfaces, AppFunctions provide a powerful new entry point: A privileged agent on the device can access app features in the background. This can be particularly helpful when users are driving, walking or otherwise multitasking. 

<p>In this article, we'll show you how we designed and integrated these capabilities into our travel planning app, <a href="https://github.com/android/ai-samples/tree/main/jetpacker">JetPacker</a>, using Android AppFunctions. We'll explore the rationale behind our feature choices, discuss the specialized tooling we used to accelerate development, and dive into the code that makes it all work.</p>

<h2>Designing AI-ready features: making choices that matter for your users</h2>

<p>To select which features to provide to the intelligence system, we looked for tasks where a voice or text command is objectively faster than tapping through screens. In this side-by-side screen recording you can see this contrast perfectly: on the left, a user tapping through multiple screens to log an expense; on the right, the same task completed instantly in the background via a privileged agent.</p>

<div class="vertical-video-grid">
  <div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIr2ssY2GiOlBmFzcP-91j91VjH9QX_sOP8FcmtirYPyXZmYRzNJmfqI_GT6aXYXye8-ntylv-gTNu1Qlnbx5gHiFn9naHqt7tJOQBA3HpQ5uz8XRdavXh7b3IP3FzJb4SsbC4mClGLUHupDwIeE9Du3PNRQr0SGs2lgHZTdHXnv8TagNBRtoJsbpeE6c/s960/Comp%201.gif"><img border="0" data-original-height="540" data-original-width="960" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIr2ssY2GiOlBmFzcP-91j91VjH9QX_sOP8FcmtirYPyXZmYRzNJmfqI_GT6aXYXye8-ntylv-gTNu1Qlnbx5gHiFn9naHqt7tJOQBA3HpQ5uz8XRdavXh7b3IP3FzJb4SsbC4mClGLUHupDwIeE9Du3PNRQr0SGs2lgHZTdHXnv8TagNBRtoJsbpeE6c/s1600/Comp%201.gif"></a></div><br><div class="vertical-video-wrapper"><br></div>

<p>Our first choice was expense tracking. Logging a coffee expense during a trip usually takes quite a few taps—unlocking the phone, opening the app, finding the active trip, navigating to the expenses tab, tapping the add button, taking a picture of the receipt, and checking the result. By providing the <code>addExpense</code> and <code>getExpenses</code> features as AppFunctions, the system agent handles the heavy lifting. When the user says, "Add a five-dollar coffee expense to my Paris trip," the agent automatically searches for the correct trip ID in the background and inserts the expense, skipping the manual UI flow entirely.</p>

<p>We also prioritized itinerary management. Finding what activity is next on a busy trip itinerary usually requires scrolling through a dense timeline view. By providing <code>getItinerary</code> and <code>addItineraryEvent</code> to the system, the user can simply ask, "What am I doing next in Paris?" and get an immediate answer.</p><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRduisOXPFs0o2m-JwtESU1fUEanqH-A0eGt58MUuXs-vgN1af77M-j3ETdegzulBq-3TClrDvhO2K_8q4ep8xAlnW1y5T09ZxxHyZmTRtftA9DOmIk7ykfM_JihQ2c2fcUbEA-jCO1sgW2JnxN9qtB8IS58lbQoaIk4cPJPuPQavZNUoW2rNKo9r8g9M/s960/Comp%202.gif"><img border="0" data-original-height="540" data-original-width="960" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRduisOXPFs0o2m-JwtESU1fUEanqH-A0eGt58MUuXs-vgN1af77M-j3ETdegzulBq-3TClrDvhO2K_8q4ep8xAlnW1y5T09ZxxHyZmTRtftA9DOmIk7ykfM_JihQ2c2fcUbEA-jCO1sgW2JnxN9qtB8IS58lbQoaIk4cPJPuPQavZNUoW2rNKo9r8g9M/s1600/Comp%202.gif"></a></div><br><p><br></p>
  

<p>Finally, we focused on hands-free note capturing. Typing out reminders or notes while walking down a busy street is difficult and unsafe. Exposing a voice note capability allows the user to say, "The flight was amazing, I saw a beautiful sunset and managed to sleep well," and the privileged agent automatically transcribes and saves it directly into the travel database <span face="Roboto, sans-serif"> using the </span><span>addVoiceNote</span><span face="Roboto, sans-serif"> AppFunction.</span></p>

<h2>Android MCP powered by AppFunctions</h2>This entire experience is built on Android MCP. Under this design, the app acts as a local MCP server. Rather than remote APIs, you provide your app features directly to the on-device intelligence system.<br><br><a href="https://d.android.com/ai/appfunctions">Android AppFunctions</a> is the API that brings this concept to life. It reads annotated Kotlin functions and compiles them into type-safe, sandboxed tool definitions that the privileged agent can discover and invoke locally on the device.<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjypEvh8lAK1myAWpnG4A0TtdIaTxP69t7g9croAJSUZ2Od6AEkhwMusN3CvdGohdvYzoh1UaCxCHb22oJzCD_4B2K8vfQzcyAIaTl8lk3TCR9T0SoMHjjaDk4GMxxPazeCfT0aF7rifm7-LAvcMhyphenhyphenryDJpOPYon7jiISKB2sMLzAwHDuKFxIv16sDXjrM/s2500/Android%20MCP%20diagram.png"><img border="0" data-original-height="1406" data-original-width="2500" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjypEvh8lAK1myAWpnG4A0TtdIaTxP69t7g9croAJSUZ2Od6AEkhwMusN3CvdGohdvYzoh1UaCxCHb22oJzCD_4B2K8vfQzcyAIaTl8lk3TCR9T0SoMHjjaDk4GMxxPazeCfT0aF7rifm7-LAvcMhyphenhyphenryDJpOPYon7jiISKB2sMLzAwHDuKFxIv16sDXjrM/s1600/Android%20MCP%20diagram.png"></a></div><br><p><br></p>

<p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><i><div><i>Diagram highlighting our apps, the android platform, and system agents coordinate AppFunctions.</i></div></i><p>Under the Android MCP model, your app acts as a local MCP server that exposes structured tools, while the Android platform serves as the central tool registry. On the MCP client side, agent apps are registered with the intelligence system after being granted system-privileged permissions to access the registry.</p>

<p>When a user interacts with a registered agent, its LLM determines if the request can be handled by an AppFunction, queries the platform's metadata, and executes the appropriate registered functions in the background. This local MCP client-server design gives you full control: you choose exactly which features are accessible to the agent, keeping the rest of your app's data private.</p>

<h2>How we accelerated development with Android skills</h2>

To streamline the integration process, we leveraged the <a href="https://github.com/android/skills/tree/main/device-ai/appfunctions">AppFunctions development skill</a>. The AppFunctions development skill is a complete development companion. It guided us through the entire lifecycle: mapping Kotlin data classes to serialize parameters, generating the necessary <code>Service</code> entry points, refining our <code>KDoc</code> documentation to ensure the LLM understands parameter boundaries, and setting up automated testing using ADB.

<h2>Providing app features to the intelligence system</h2>

<p>Enough with the theory, let's dive into the implementation.</p>

<h4>Configuration and dependency setup</h4>

<p>We begin by adding the AppFunctions dependencies. One for the API and one for the Kotlin Symbol Processing compiler.</p>

<pre><code>implementation("androidx.appfunctions:appfunctions:1.0.0-alpha10")
ksp("androidx.appfunctions:appfunctions-compiler:1.0.0-alpha10")</code></pre>

<h4>Modeling custom data types</h4>

<p>Any custom object exchanged with the agent must be annotated with <code>@AppFunctionSerializable</code>. In our <a href="https://github.com/android/ai-samples/tree/main/jetpacker/android/feature/appfunctions/src/main/java/com/example/jetpacker/feature/appfunctions/TripSerializable.kt">TripSerializable.kt</a> file, we define our trip data model:</p>

<pre><code>@AppFunctionSerializable(isDescribedByKDoc = true)
data class TripSerializable(
    /** The trip's unique identifier. */
    val id: String,
    /** The trip's title. */
    val title: String,
    /** The trip's destination location. */
    val location: String,
    /** The trip's start date in milliseconds. */
    val startDate: Long,
    /** The trip's end date in milliseconds. */
    val endDate: Long,
    /** A list of participants. */
    val participants: List&lt;String&gt;,
)</code></pre>

<h4>Providing features using the @AppFunction annotation</h4>

<p>Next, the skill wrote the Kotlin functions that perform the database queries and annotate them with <code>@AppFunction</code>. We can view this in searchTrip:</p>

<pre><code>/**
 * Looks for trips based on optional filters like id, title (name), location, and dates.
 *
 * @param id The unique identifier of the trip.
 * @param title The title or name of the trip.
 * @param location The destination location.
 * @param startDate The minimum start date in milliseconds.
 * @param endDate The maximum end date in milliseconds.
 * @return A list of trips matching the filters.
 */
@AppFunction(isDescribedByKDoc = true)
suspend fun searchTrip(
    id: String? = null,
    title: String? = null,
    location: String? = null,
    startDate: Long? = null,
    endDate: Long? = null
): List&lt;TripSerializable&gt; {
    return withContext(Dispatchers.IO) {
    // implementation
}</code></pre>

<p>Since AppFunctions run on the UI thread by default, we use <code>withContext(Dispatchers.IO)</code> to switch to a background dispatcher. Additionally, we refine our KDoc to use clear, imperative verbs and specify parameter constraints. This documentation compiles directly into the tool's schema, which the privileged agent uses to resolve parameters and handle runtime errors.</p>

<h4>The service entry point and Hilt integration</h4>

<p>To register these features with the intelligence system, we create an abstract base class that extends <code>AppFunctionService</code>. We annotate it with <code>@AppFunctionServiceEntryPoint</code>:</p>

<pre><code>@RequiresApi(36)
@AndroidEntryPoint
@AppFunctionServiceEntryPoint(
    serviceName = "JetPackerAppFunctionService",
    appFunctionXmlFileName = "jetpacker_app_function_service"
)
abstract class BaseJetPackerAppFunctionService : AppFunctionService() {
    @Inject internal lateinit var tripDao: TripDao
    // DAOs and database references are injected here...
}</code></pre>

<p>During compilation, KSP generates the final concrete service subclass, <code>JetPackerAppFunctionService</code>, as declared with the <code>serviceName</code> parameter. We also register <code>app_metadata.xml</code> in the app's manifest. This file provides global operational rules for JetPacker's declared AppFunctions.</p>

<h2>Testing and verifying your AppFunctions</h2>

<p>Once implemented, you should verify that your AppFunctions are registered and working correctly.</p>

<p>Running devices or emulators with Android 17 or newer, you can use ADB commands from your terminal to list and invoke your functions. Running <code>adb shell cmd app_function list-app-functions</code> displays all registered functions for your package. You can then execute a specific function and test its database integration by running <code>adb shell cmd app_function execute-app-function</code> while passing a raw JSON parameters string.</p>

<p>Instead of these ADB commands, you can also use the <a href="https://github.com/android/appfunctions">AppFunctions Testing Agent</a> to inspect your configuration, list and execute AppFunctions, and even see how your AppFunctions behave in a real conversational flow.</p>

<h2>Wrapping it up</h2>

<p>When thinking about app features that can be contributed to the intelligence system using AppFunctions requires a slight shift in how we think about code and documentation. AppFunctions enable you to use this new interaction model for apps, which allows using an agent to access app features..</p>

<p>First, the <a href="https://github.com/android/skills/tree/main/device-ai/appfunctions">AppFunctions development skill</a> is an essential lifecycle tool, helping you discover features, implement and refine AppFunctions for your apps. Second, KDoc comments are a compiled API asset; clear parameter descriptions directly impact the execution accuracy of the system agent. Finally, Android MCP provides local-first execution allowing apps to safely collaborate with AI agents.</p>

<p>Contributing app features through AppFunctions makes your application ready for the intelligence system. Let us know how you are adapting your apps for the agentic era!</p>

<h2>Learn more</h2>

<p>Check out the other parts of this blog post series:<br><b><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-introduction-jetpack.html">Part 1:</a></b> Introduction of the app and a high-level overview.<br><a href="http://android-developers.googleblog.com/2026/07/android-on-device-inference.html"><b>Part 2:</b></a> On-device intelligence. Deep-dive into ML Kit’s GenAI APIs and Gemini Nano to build privacy-first features like itinerary summarization, receipt parsing, and local audio processing.<br><b><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-cloud-hybrid-inference.html">Part 3:</a></b> Hybrid and cloud reasoning. Explore how to use Firebase AI Logic to ground LLM answers in real-world data like Google Maps and web context.<br><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-appfunctions.html"><b>Part 4 (this post!):</b></a> System integration. Integrating with the Android intelligence system using AppFunctions. <br>Part 5 (coming soon): In-app agentic workflows. Extend the app with an end-to-end booking assistant powered by A2UI and ADK.</p>

<p>Interested in more on Android Development? Follow Android Developers on <a href="https://www.youtube.com/@AndroidDevelopers">YouTube</a> or <a href="https://www.linkedin.com/showcase/androiddev/">LinkedIn</a>!</p>

<p>
  All code snippets in this blog post follow the following copyright notice:
</p>
<pre><code>Copyright 2026 Google LLC.
SPDX-License-Identifier: Apache-2.0</code></pre></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Build intelligent Android apps: Introduction to Jetpacker]]></title>
<description><![CDATA[Posted by Jolanda Verhoef, Senior Developer Relations Engineer, Android Developer RelationsBuilding GenAI features in your app usually means navigating through various models, APIs and architecture choices: 

  Execution location: Where does your model run? On device, in the cloud, or both?
  Com...]]></description>
<link>https://tsecurity.de/de/3693498/android-tipps/build-intelligent-android-apps-introduction-to-jetpacker/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693498/android-tipps/build-intelligent-android-apps-introduction-to-jetpacker/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:26 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigBFwd7rJO49I_puODKBWFqPbpHaGyL3CTFuZBbr0HTQConFnc3JP0dL9Rr_i6wmyW0o4Ku2bvv3SEacwpC3Vc6b7cYy0aRbZKdUDudFcraYO8zcBVkrMfbrfMP9How0J1xSi91xLnR4s5Z3s-Lp6RF2SA0gU56B9nXD0NkD_CU8MT6wbgBw1tRaMWcMo/s2469/0713%20Jetpacker%20Meta.png">
<div><i>Posted by Jolanda Verhoef, Senior Developer Relations Engineer, </i><i>Android Developer Relations</i></div><div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFlbIY8mjuSzlWuS8mnGJ3v8Je-yrtFFaBHNXumMqS0rbaS32wv5HUhI4mv5pHT8ro0Rfb-duyMhK8_OeKnMyocY9s6GmC9_pgTEv6sgZoiaZpD00sODTTctYV8I4RHddKWcXAMUyTASk97cS1ysx4A2PFYB6PEeiHeN93BFgDiOTKH62ZJMig3kGP66E/s8583/0713%20Jetpacker%20Blog.png"><img border="0" data-original-height="2601" data-original-width="8583" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFlbIY8mjuSzlWuS8mnGJ3v8Je-yrtFFaBHNXumMqS0rbaS32wv5HUhI4mv5pHT8ro0Rfb-duyMhK8_OeKnMyocY9s6GmC9_pgTEv6sgZoiaZpD00sODTTctYV8I4RHddKWcXAMUyTASk97cS1ysx4A2PFYB6PEeiHeN93BFgDiOTKH62ZJMig3kGP66E/s1600/0713%20Jetpacker%20Blog.png"></a></div><br><i><br></i><p>Building GenAI features in your app usually means navigating through various models, APIs and architecture choices: </p>
<ul>
  <li><strong>Execution location:</strong> Where does your model run? On device, in the cloud, or both?</li>
  <li><strong>Complexity:</strong> How complex is your setup? Are you doing a single inference call or do you need a more agentic flow?</li>
  <li><strong>In-app or Android System:</strong> Should your feature be built into your Android app or does it fit better as an Android system integration?</li>
</ul>

<p>In this blog post series we'll navigate these choices with you. We will take you along on a journey, starting with a basic mobile app and transforming it into a <b>personalized</b>, <b>intelligent</b>, and <b>agentic</b> experience.</p>

<h2>Jetpacker: a demo travel app</h2>
<p>Jetpacker is a <b>technical showcase app</b> that our team built from the ground up for this year's Google I/O (built using Antigravity). At its core, Jetpacker helps users plan, explore, and enjoy their next big adventure. It shows an overview of your trips, the itinerary of each trip, and details of each event on that trip. Of course following all best practices of Android development, including a beautifully expressive Material UI design.</p><div>
  
  
</div>

<p>And best of all? It's fully <a href="https://github.com/android/ai-samples/tree/main/jetpacker" target="_blank">open source</a>!</p>

<p>Today we are publishing a series of<b> technical blog posts</b> diving deep into each of these features. We’ll provide detailed implementation steps, code snippets, and architectural insights to help you build your own intelligent Android applications.</p>

<h2><a href="http://android-developers.googleblog.com/2026/07/android-on-device-inference.html">On-device intelligence</a></h2>
<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7d4EqOTEFypjsqmFoZ8h-zPw3QqQkNY1F_vdbJ98vv1QJCqIE8P-reC0fttcMfNk05g3kGSLhGXVaeiOQDqARK6ptNhFe43miZgTNSmdF7V5hh6u4PhjQleWXmxDqkAf5YKPPyBU14V9z_wFfkiwVDCHN0rkLDtbZCGnb6Jq8d7Iu3YRVgDd9fcMeTiA/s1848/on-device-features.png"><img border="0" data-original-height="1256" data-original-width="1848" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7d4EqOTEFypjsqmFoZ8h-zPw3QqQkNY1F_vdbJ98vv1QJCqIE8P-reC0fttcMfNk05g3kGSLhGXVaeiOQDqARK6ptNhFe43miZgTNSmdF7V5hh6u4PhjQleWXmxDqkAf5YKPPyBU14V9z_wFfkiwVDCHN0rkLDtbZCGnb6Jq8d7Iu3YRVgDd9fcMeTiA/s1600/on-device-features.png"></a></div><div><i>On-device features in Jetpacker: Summarizing trip itineraries, managing expenses, and voice notes</i></div><p>Using an on-device model comes with <b>no additional cloud inference</b> costs, means you don't have to worry about <b>internet connectivity</b>, and lets users be confident that private information will be <b>processed locally</b>, on the device, without any of their data being sent to the cloud.</p>

<p>In Jetpacker, we chose on-device inference for three of our features:</p>
<ul>
  <li>The <b>trip overview</b> feature transforms a messy, multi-day itinerary into a concise, actionable summary. It leverages Gemini Nano through the <a href="https://developers.google.com/ml-kit/genai/prompt/android">ML Kit GenAI APIs</a> to process data locally on the device. We consider this a nice-to-have feature where we don't want to incur extra cloud costs, making on-device inference the right choice.</li>
  <li>The <b>expense tracker</b> automatically extracts structured data from receipt images to help users track their travel spending. It uses the <a href="https://developers.google.com/ml-kit/genai/prompt/android/get-started#provide-multimodal">multimodal capabilities</a> of Gemini Nano 4 through the ML Kit GenAI APIs. We choose an on-device solution so that any privacy-sensitive information on the receipt images never leaves the user's device.</li>
  <li>The <b>audio diary </b>records, transcribes, and categorizes voice notes into relevant trip activities. It is powered by the <a href="https://developers.google.com/ml-kit/genai/speech-recognition/android">ML Kit Speech Recognition</a> and <a href="https://developers.google.com/ml-kit/genai/prompt/android/get-started">GenAI Prompt APIs</a>. We chose an on-device solution for privacy and connectivity reasons.</li>
</ul>

<h2><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-cloud-hybrid-inference.html" target="_blank">Cloud &amp; hybrid inference</a></h2>
<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFPZiA1Obbj1gQKJ6S-U4UCR-jiUjasFY3jGQPeBRS27JJD5DzDIpGseazaNR3qcXR6xtYck8RYqKd0jgHGXVnfqQiPkW7jWVgTB_Hkds5EZcQDjosBZc7Ma9A-JaRaLeVxzEpTXYwSkalIyOIt-WQ_kqdlAvpDH1nB0Ajv7FdFJJ50aBOhP7a0p_RvN4/s2722/cloud-hybrid-features.png"><img border="0" data-original-height="1632" data-original-width="2722" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFPZiA1Obbj1gQKJ6S-U4UCR-jiUjasFY3jGQPeBRS27JJD5DzDIpGseazaNR3qcXR6xtYck8RYqKd0jgHGXVnfqQiPkW7jWVgTB_Hkds5EZcQDjosBZc7Ma9A-JaRaLeVxzEpTXYwSkalIyOIt-WQ_kqdlAvpDH1nB0Ajv7FdFJJ50aBOhP7a0p_RvN4/s1600/cloud-hybrid-features.png"></a></div><br><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><p><br></p><i><div><i>Cloud and hybrid features in Jetpacker: Museum assistant with web grounding, hybrid restaurant review drafting, and hotel support chat featuring custom-routed live translation.</i></div></i><p>Sometimes your use-case requires AI models with <b>greater world knowledge</b> or a much <b>larger context window</b> and with greater ability in <b>handling complex tasks</b>. In that case, we can switch from running an on-device model to using a cloud model instead.</p>

<p>Or, if you want to get the best of both worlds, you can use hybrid inference to <b>dynamically choose</b> either a cloud or on-device model at runtime. This allows us to <b>lower costs</b> by moving inference to the device when it is available, but at the same time <b>support all Android devices</b> running the app.</p>

<p>In Jetpacker, we implemented several features using cloud or hybrid inference:</p>
<ul>
  <li>The <b>place Q&amp;A</b> feature answers user questions about specific locations by grounding responses in real-world data. It uses <a href="https://firebase.google.com/docs/ai-logic">Firebase AI Logic</a> integrated with <a href="https://firebase.google.com/docs/ai-logic/grounding-google-maps">Google Maps</a> and <a href="https://firebase.google.com/docs/ai-logic/grounding-google-search">web context</a>. Using a cloud model is necessary here for its greater world knowledge.</li>
  <li>The <b>review drafting</b> feature helps users compose detailed reviews for the places they have visited. It leverages both on-device and cloud models through Firebase AI Logic's new <a href="https://firebase.google.com/docs/ai-logic/hybrid/android/get-started">Hybrid inference API</a>. This is a feature we wanted to make available to all app users, so we're using a cloud model as a fallback when an on-device model is unavailable.</li>
  <li>The <b>automatic chat translation</b> dynamically translates chat messages in real time to facilitate seamless communication, demonstrating custom hybrid inference logic. Again, we want this feature to be available to all app users, but at the same time have some specific considerations on when to choose on-device versus cloud.</li>
</ul>

<h2><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-appfunctions.html">System integration</a></h2><div>
  
  
</div>
<p>While not a feature you see in the app itself, the Android system integration opens up the app's core capabilities directly to the Android operating system. It uses the <a href="https://developer.android.com/ai/appfunctions">AppFunctions API</a> to integrate with system-level intelligence.</p>

<h2>In-app agentic workflows (coming soon!)</h2>
<div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3YAW_TWepCinuAvHQ7i9JKfhWtf-GSggI6CtD0Qp7-nfPA7UTmmYHTAtsEybWlmiPgxZqo_fUlqc44dmF_5WWH4tlTRze8qdsm9Jc5ARwL5k_PJjU1VTcAHRE3EdxL4JHSnsCt4VCzwPaR41LM34048icLNZLE1kUhpLTeiGpDH87Bh7utPJmXS4kn_8/s1618/agentic-feature-booking-assistant%20(1).png"><img border="0" data-original-height="1618" data-original-width="844" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3YAW_TWepCinuAvHQ7i9JKfhWtf-GSggI6CtD0Qp7-nfPA7UTmmYHTAtsEybWlmiPgxZqo_fUlqc44dmF_5WWH4tlTRze8qdsm9Jc5ARwL5k_PJjU1VTcAHRE3EdxL4JHSnsCt4VCzwPaR41LM34048icLNZLE1kUhpLTeiGpDH87Bh7utPJmXS4kn_8/w209-h400/agentic-feature-booking-assistant%20(1).png" width="209"></a></div><i><div><i>The booking assistant shows several in-progress flight bookings, asking the user for input before making a final booking.</i></div></i><p>Agenticness introduces a higher level of<b> autonomy</b>, enabling models to act as agents. Instead of a single inference call, an agent works towards a specific goal via an orchestration loop that allows it to <b>reason</b>, use <b>tools</b>, and <b>adapt </b>its path. Depending on your requirements, these intelligent agents can run either in the cloud, directly on-device, or in a hybrid setup.</p>

<p>For Jetpacker we added a <b>booking assistant</b> that automates end-to-end booking workflows directly within the application to streamline reservations. It is built using <a href="https://a2ui.org/">A2UI</a> and <a href="https://adk.dev/">ADK</a> running in the cloud. The Android app functions as a front-end to the multi-agentic system running in the cloud.</p>

<h2>Learn more</h2>
<p>Check out the other parts of this blog post series:</p><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-introduction-jetpack.html"><b>Part 1 (this post!):</b></a> Introduction of the app and a high-level overview.<br><a href="http://android-developers.googleblog.com/2026/07/android-on-device-inference.html"><b>Part 2:</b></a> On-device intelligence. Deep-dive into ML Kit’s GenAI APIs and Gemini Nano to build privacy-first features like itinerary summarization, receipt parsing, and local audio processing.<br><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-cloud-hybrid-inference.html"><b>Part 3:</b></a> Hybrid and cloud reasoning. Explore how to use Firebase AI Logic to ground LLM answers in real-world data like Google Maps and web context.<br><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-appfunctions.html"><b>Part 4:</b></a> System integration. Integrating with the Android intelligence system using AppFunctions.<br>Part 5 (coming soon): In-app agentic workflows. Extend the app with an end-to-end booking assistant powered by A2UI and ADK.<p>Interested in more on Android Development? Follow Android Developers on <a href="https://www.youtube.com/@AndroidDevelopers">YouTube</a> or <a href="https://www.linkedin.com/showcase/androiddev/">LinkedIn</a>!</p></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Build intelligent Android apps: Cloud and hybrid inference]]></title>
<description><![CDATA[Posted by Thomas Ezan, Jolanda Verhoef, Caren Chang, Senior Developer Relations Engineers, Android Developer RelationsWelcome back to the blog post series "Build intelligent Android apps" where we take a basic Android app and transform it into a personalized, intelligent, and agentic experience. ...]]></description>
<link>https://tsecurity.de/de/3693496/android-tipps/build-intelligent-android-apps-cloud-and-hybrid-inference/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693496/android-tipps/build-intelligent-android-apps-cloud-and-hybrid-inference/</guid>
<pubDate>Sat, 25 Jul 2026 10:15:23 +0200</pubDate>
<category>🤖 Android Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[
<img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBHTpa22SxEltoebLZYO_34iRtahN8z5tA3tnIryIii0s4_conN5qFYfmNro6nmZBfsgiZeRLtru-gE4XO2mf-RBDyIo00kf3QunWwUO-SICHkVSv0exAQQ4qA0KzjMGRpA8qj1TSMP0Ffe0FzrEc_S1zBaakKzCZFpqYLXqds9Zqmqr8yyeSgyNl9U0s/s2469/features%20in%20Jetpacker%20Features%20with%20Firebase%20AI%20Logic%20_Meta.png"><div><i>Posted by Thomas Ezan, Jolanda Verhoef, Caren Chang, Senior Developer Relations Engineers, Android Developer Relations</i></div><div><br></div><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjn2fO3T2xckksQ9pk3RUNPxZqqq2CyaifXnju0lCCpbfwJ4gZyq-df0kM_mK1TMV0F9YCMo19Ba9NvFAiUpzDH6Wlk_RyonRCK5Ono25CYyQ7xGC3q70mUhyphenhyphenOOYJ-5JX2KlFP1lIA3ULIhH86_hP2ptO0AllUIf6ZVh-SqoXVWcXrM8m3hHCkhGwZYfP4/s8583/AFD%20-%20%5BABL_101%5D%20Building%20AI%20features%20in%20Jetpacker%20Features%20with%20Firebase%20AI%20Logic%20_Blog.png"><img border="0" data-original-height="2601" data-original-width="8583" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjn2fO3T2xckksQ9pk3RUNPxZqqq2CyaifXnju0lCCpbfwJ4gZyq-df0kM_mK1TMV0F9YCMo19Ba9NvFAiUpzDH6Wlk_RyonRCK5Ono25CYyQ7xGC3q70mUhyphenhyphenOOYJ-5JX2KlFP1lIA3ULIhH86_hP2ptO0AllUIf6ZVh-SqoXVWcXrM8m3hHCkhGwZYfP4/s1600/AFD%20-%20%5BABL_101%5D%20Building%20AI%20features%20in%20Jetpacker%20Features%20with%20Firebase%20AI%20Logic%20_Blog.png"></a></div><br><p><br></p><p>Welcome back to the blog post series "<a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-introduction-jetpack.html" target="_blank">Build intelligent Android apps</a>" where we take a basic Android app and transform it into a <b>personalized</b>, <b>intelligent</b>, and <b>agentic</b> experience. In our <a href="http://android-developers.googleblog.com/2026/07/android-on-device-inference.html">previous post</a> we explored how to build intelligent on-device features using Gemini Nano through ML Kit's Prompt API.</p>

<p>In this post, we will look at how you can leverage <b><a href="https://firebase.google.com/docs/ai-logic">Firebase AI Logic</a> </b>to build cloud-hosted and hybrid AI features: </p>
<ul>
  <li>Grounding answers in real-world context</li>
  <li>Routing requests dynamically between cloud and local execution using hybrid inference</li>
  <li>Translating content with custom routing systems</li>
</ul>

<div>
  
  
</div><p><br></p><p>Sometimes a use case requires AI models with greater world knowledge, a much larger context window, or the ability to handle complex queries. In those scenarios, we can leverage cloud models. </p>

<p>Other times, you want the best of both worlds: using hybrid inference to run on-device when available to lower costs, while falling back to the cloud to ensure compatibility for all devices.</p><br><div class="separator"><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwlTUF1Kzkbrf2w64KO3jZJZZ_wLEu34vq6Cb7PX2alVUhFVdbkiWuXCkzUS-bPJkHMbmuNJ_Ov0HYZzujr69jCU9gPvmKaKMZt2q4-TolSDFCLABBIY1IBRY9Zn7D5S10hFcJD2kuVCm3N2glpqDJoHiqAZat4z6oyXxxwH4ZCGVBgfPObMevoJrgNPg/s8000/features_upscaled.png"><img border="0" data-original-height="4744" data-original-width="8000" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwlTUF1Kzkbrf2w64KO3jZJZZ_wLEu34vq6Cb7PX2alVUhFVdbkiWuXCkzUS-bPJkHMbmuNJ_Ov0HYZzujr69jCU9gPvmKaKMZt2q4-TolSDFCLABBIY1IBRY9Zn7D5S10hFcJD2kuVCm3N2glpqDJoHiqAZat4z6oyXxxwH4ZCGVBgfPObMevoJrgNPg/s1600/features_upscaled.png"></a></div><em>Cloud and hybrid features in Jetpacker: Museum assistant with web grounding, hybrid restaurant review drafting, and 
  support chat featuring custom-routed live translation.</em></div>

<p>Let’s look at how we implemented three cloud and hybrid features in <a href="https://github.com/android/ai-samples/tree/main/jetpacker" target="_blank">Jetpacker</a>:</p>
<ul>
  <li>a museum assistant with web grounding</li>
  <li>hybrid restaurant review drafting</li>
  <li>hotel support chat featuring custom-routed live translation.</li>
</ul>

<h2>Use LLM grounding for up-to-date informationMuseum assistant chatbot with LLM grounding</h2>
<p>The <b>Museum assistant </b>is an interactive chatbot designed to help users plan their museum visits. It provides visitors with up-to-date details regarding specific exhibits, current opening hours, ticket pricing, and more.</p><br><div class="separator"><em><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3pxeCVJfOo5G7McNB4RCIhoCUch8CHSAWI7gHijJJcE95b0gbu3lyAO1xIWc6mKllkpylSPBnVfU6RYnwfay4z6dH7TlufPuNw3Lw7s-bEuR4Ajx8IHK8k6zJcOHitqMRdDv8EVL-fCN6uuDo1QTnOgk_RW-AEM1_hZaJWbCGezMQF_D9Hia-Rm2T4-c/s4880/museum_assistant_upscaled.png"><img border="0" data-original-height="4880" data-original-width="2392" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3pxeCVJfOo5G7McNB4RCIhoCUch8CHSAWI7gHijJJcE95b0gbu3lyAO1xIWc6mKllkpylSPBnVfU6RYnwfay4z6dH7TlufPuNw3Lw7s-bEuR4Ajx8IHK8k6zJcOHitqMRdDv8EVL-fCN6uuDo1QTnOgk_RW-AEM1_hZaJWbCGezMQF_D9Hia-Rm2T4-c/w314-h640/museum_assistant_upscaled.png" width="314"></a></div>Museum assistant is a chatbot that answers questions, such as </em></div><div class="separator"><em>‘How can I get a ticket discount for Le Louvre?’</em></div>

<p>When building AI features, getting the model to answer with fresh, accurate, and specific real-world information is a common challenge. While cloud models possess massive amounts of world knowledge, they might not know about seasonal exhibits or the current day’s opening hours. </p><div class="separator"><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8He5M2JC5EwXZwa-M52UAXHSO4dWy4gx3aZoY2ZXM-x25pV4kc6BsICe_fG4Zn6-R37_UgTQ8LBSsrNcP50e3aQLgxNbHOfWLBqzaSqQ78ZDmNEJadZNc-I5bduHr0UtWOxYMTFAHgffxcuzaETHPe3lvfRod2rkeOUXnRaLJ_vIiAfO_xRKpESbX3L8/s8000/grounding_upscaled.png"><img border="0" data-original-height="4452" data-original-width="8000" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8He5M2JC5EwXZwa-M52UAXHSO4dWy4gx3aZoY2ZXM-x25pV4kc6BsICe_fG4Zn6-R37_UgTQ8LBSsrNcP50e3aQLgxNbHOfWLBqzaSqQ78ZDmNEJadZNc-I5bduHr0UtWOxYMTFAHgffxcuzaETHPe3lvfRod2rkeOUXnRaLJ_vIiAfO_xRKpESbX3L8/s1600/grounding_upscaled.png"></a></div><br><em><br>Grounding data is added to the context window to enable the model</em></div><div class="separator"><em> to answer questions correctly and accurately.</em></div>

<p>To bridge this gap, we can use grounding techniques to add extra context to the model’s context window. The <a href="https://firebase.google.com/products/firebase-ai-logic" target="_blank">Firebase AI Logic SDK</a> supports three types of grounding:</p>
<ul>
  <li><strong><a href="https://firebase.google.com/docs/ai-logic/url-context">URL grounding</a>:</strong> Grounding responses using content from a specific webpage (e.g. current ticket prices or museum rules).</li>
  <li><strong><a href="https://firebase.google.com/docs/ai-logic/grounding-google-search">Google Search grounding</a>:</strong> Letting the model query the real-time Google search index for up-to-date details.</li>
  <li><strong><a href="https://firebase.google.com/docs/ai-logic/grounding-google-maps">Maps grounding</a>:</strong> Using Google Maps location data.</li>
</ul>

<p>In Jetpacker, we dynamically construct the available tools based on enabled feature flags and initialize the generative model using the Firebase AI SDK:</p>

<pre><code>// implementation("com.google.firebase:firebase-ai-logic")

private var toolList = mutableListOf&lt;Tool&gt;()

init {
    if (ENABLE_SEARCH_GROUNDING) {
        toolList.add(Tool.googleSearch())
    }
    if (ENABLE_URL_GROUNDING) {
        toolList.add(Tool.urlContext())
    }
}

private val generativeModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash",
        systemInstruction = content {
            text("You are a helpful museum assistant answering questions about a museum. Use plain text.")
        },
        tools = toolList
    )</code></pre>

<p>When the user queries the assistant, if URL grounding is enabled, we append the specific museum resource URLs directly into the prompt:</p>

<pre><code>val groundingText = if (FeatureFlags.ENABLE_URL_GROUNDING) {
    "\n If the following message above is about the rules and terms to visit Le Louvre, " +
    "if needed answer this urls ${urlList.joinToString()}"
} else {
    ""
}

val prompt = "$text $groundingText"

var response = chat.sendMessage(prompt)
</code></pre>

<h2>Hybrid inference: On-device review generation with Maps deep link</h2>
<p>Not every AI task requires a cloud-based model, and not every device is online. To help developers balance latency, cost, and offline availability, we recently introduced the <a href="https://firebase.google.com/docs/ai-logic/hybrid/android/get-started?api=dev">Firebase API for Hybrid Inference</a>.</p>

<p>In Jetpacker, the <b>restaurant review</b> feature lets users review select topics and automatically drafts a review. To enable this for all users, we prioritize local execution with Gemini Nano, and fall back to cloud models on devices that don’t support Gemini Nano. </p><div class="separator"><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVa1o2Zh3v3Babi7gGmzOFYAKPEgS0HWmvisiKgK-QsSRh_ZhjTjuUYSS_QIH0JQw9NsqrkYe4Quud6cfCGwVc61_7HKcACj6c9yywWySn5xyHGgemBR5tYPP8q3bmLadaN6uLXspE9LqrcZkVdckEGHWDhdfYVa-xo8QomDaRn03mau2fHVyK0Fr1FaU/s4680/review_upscaled.png"><img border="0" data-original-height="4680" data-original-width="2392" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjVa1o2Zh3v3Babi7gGmzOFYAKPEgS0HWmvisiKgK-QsSRh_ZhjTjuUYSS_QIH0JQw9NsqrkYe4Quud6cfCGwVc61_7HKcACj6c9yywWySn5xyHGgemBR5tYPP8q3bmLadaN6uLXspE9LqrcZkVdckEGHWDhdfYVa-xo8QomDaRn03mau2fHVyK0Fr1FaU/w327-h640/review_upscaled.png" width="327"></a></div><br></div><div class="separator"><em>The restaurant review feature uses hybrid inference to draft a review based on topics</em></div><div class="separator"><em><br></em></div>

<pre><code>// implementation("com.google.firebase:firebase-ai-logic")
// implementation("com.google.firebase:firebase-ai-ondevice:16.0.0-beta03")


// Initialize the model with hybrid routing configuration
val reviewModel = Firebase.ai.generativeModel(
    modelName = "gemini-3.1-flash-lite",
    onDeviceConfig = OnDeviceConfig(
        inferenceMode = InferenceMode.PREFER_ON_DEVICE
    )
)</code></pre>

<p>The Hybrid Inference API supports four distinct routing modes:</p>
<ul>
  <li><strong>PREFER_ON_DEVICE:</strong> Prioritizes local execution and falls back to cloud if Gemini Nano is unavailable.</li>
  <li><strong>PREFER_IN_CLOUD:</strong> Prioritizes cloud execution and falls back to on-device if the device goes offline.</li>
  <li><strong>ONLY_ON_DEVICE:</strong> Restricts execution strictly to the device.</li>
  <li><strong>ONLY_IN_CLOUD:</strong> Restricts execution strictly to the cloud.</li>
</ul>

<p>Once the review is generated, we copy it to the clipboard and use an intent to open Google Maps directly to the restaurant's review page, providing a seamless user experience:</p>

<pre><code>private fun copyAndOpenMapsReview(context: Context, reviewText: String, placeId: String) {
    val clipboard = context.getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
    val clip = ClipData.newPlainText("User Review", reviewText)
    clipboard.setPrimaryClip(clip)

    val uri = Uri.parse("https://search.google.com/local/writereview/mobile?placeid=$placeId")
    val intent = Intent(Intent.ACTION_VIEW, uri).apply {
        setPackage("com.google.android.apps.maps")
    }
    context.startActivity(intent)
}</code></pre>

<h2>Custom hybrid routing: Hotel support chat translation with simulated personas</h2>
<p>The <b>hotel support chat</b> was built to let users finalize logistics and check on hotel details. This feature uses system instructions to configure a localized receptionist assistant. By passing specific information—such as the preferred language and hotel information—in the instructions, we can set up a conversational persona representing a specific hotel.</p>

<pre><code>private val generativeModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        systemInstruction = content {
            text("""
              You are a helpful hotel receptionist at $hotelName only speaking $language. 
              Answer politely in $language. The bar closes at 10pm and breakfast is from 7am to 10am.
              There's someone at the desk 24/7. You can retrieve your luggage from the storage room 
              at the back of the lobby at any time.
              """)
        },
        modelName = "gemini-3-flash-preview"
    )</code></pre>

<p>Because receptionist responses are in the hotel's local language (for example, French for Hotel Le Meurice in Paris), we need to translate messages to the user’s preferred language. </p><div class="separator"><em><br><div class="separator"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikIB_NnUYK8GnEpI3foNLO2_AQ2lNZhoc9gFB-CjERDjMwrdQ2T45y6jzrJAafi4Jz7eF_SBkXG7csDwpajKctp5yo1hsBjIacIfK3aHvvQjCUu22qZBj7dLl5Q4aGFJRD4hwTlMMNgZD8sIuYpCrRjMmpa5ybXDzi9nkTMZoiJOEn8jLmqBsgTXcVTDY/s4112/translation_upscaled.png"><img border="0" data-original-height="2364" data-original-width="4112" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikIB_NnUYK8GnEpI3foNLO2_AQ2lNZhoc9gFB-CjERDjMwrdQ2T45y6jzrJAafi4Jz7eF_SBkXG7csDwpajKctp5yo1hsBjIacIfK3aHvvQjCUu22qZBj7dLl5Q4aGFJRD4hwTlMMNgZD8sIuYpCrRjMmpa5ybXDzi9nkTMZoiJOEn8jLmqBsgTXcVTDY/s1600/translation_upscaled.png"></a></div><div class="separator"><em>Hotel support chat messages are automatically translated to the user’s preferred language </em></div></em></div>

<p>While hybrid models can configure simple routing preferences, complex scenarios require custom routing logic. In Jetpacker, we implement a custom routing stack that takes into account:</p>
<ul>
  <li><strong>Language identification:</strong> Using the on-device <a href="https://developers.google.com/ml-kit/language/identification/android">ML Kit Language Identification API</a>, we can detect the incoming message language.</li>
  <li><strong>On-device translation (Gemini Nano):</strong> <a href="https://developers.google.com/ml-kit/genai/prompt/android">ML Kit’s Prompt API</a> lets us translate common language pairs directly on the device, saving bandwidth and cloud cost.</li>
  <li><strong>Cloud translation (Gemini 3 Flash):</strong> For more complex languages, we use Gemini Flash 3 to get a higher quality translation.</li>
</ul>

<pre><code>// implementation("com.google.android.gms:play-services-mlkit-language-id:17.0.0") 

// ML Kit for Language Identification (powered by Google Play Services)
private val languageIdentifier = LanguageIdentification.getClient()

// On-device translator model (prefer Gemini Nano) for translating common language pairs
private val hybridTranslationModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash",
        onDeviceConfig = OnDeviceConfig(mode = InferenceMode.PREFER_ON_DEVICE)
    )

// Cloud translator model for more complex language pairs
private val cloudTranslationModel = Firebase.ai(backend = GenerativeBackend.googleAI())
    .generativeModel(
        modelName = "gemini-3-flash"
    )</code></pre>

<p>When a message needs to be translated, we identify the source language and apply our custom routing logic, executing either on-device or cloud translation:</p>

<pre><code>fun translateMessage(message: SupportChatMessage) {
    viewModelScope.launch {
        // 1. Detect language using ML Kit Language Identification
        val sourceLang = try {
            Tasks.await(languageIdentifier.identifyLanguage(message.text))
        } catch (e: Exception) {
            "Undefined"
        }

        // 2. Custom routing: we've verified the translation quality for English and Korean with Gemini Nano, and will translate message on-device for those two languages
        val routeToCloud = sourceLang != "en" &amp;&amp; sourceLang != "kr"

        val prompt = "Translate the following text to $selectedLanguage. Just return the translated sentence: ${message.text}."

        val (translatedText, routePrefix) = if (routeToCloud) {
            val result = cloudTranslationModel.generateContent(prompt)
            result.text to "[Cloud]"
        } else {
            val result = hybridTranslationModel.generateContent(prompt)
            result.text to "[On-Device]"
        }

        if (translatedText != null) {
            _translations.update { current -&gt;
                current + (message.id to "$routePrefix: $translatedText")
            }
        }
    }
}</code></pre>

<p>In this example, the custom routing logic only takes into consideration the translation’s source and target language. However, based on your app’s use case, you can expand the routing logic to include other factors such as the on-device model version, network connectivity, battery status, and more.</p>

<h2>Securing the AI Pipelines: Firebase App Check</h2>
<p>Lastly, using AI in the cloud opens up possibilities of API key abuse or unauthorized billing. To secure API calls, we integrated <a href="https://firebase.google.com/docs/app-check"><b>Firebase App Check</b></a> using both Play Integrity (production) and the local Debug Provider (for local development or emulators).</p>

<p>In the <a href="https://github.com/android/ai-samples/blob/main/jetpacker/android/app/src/main/kotlin/com/example/jetpacker/JetPackerApplication.kt">JetPackerApplication.kt</a> file, we install the debug provider at startup and trigger anonymous authentication to establish a secure user session:</p>

<pre><code>//  implementation("com.google.firebase:firebase-appcheck-playintegrity") 
//  implementation("com.google.firebase:firebase-appcheck-debug")  
//  implementation("com.google.firebase:firebase-auth") 

override fun onCreate() {
    super.onCreate()
    Firebase.initialize(context = this)
    Firebase.appCheck.installAppCheckProviderFactory(
        DebugAppCheckProviderFactory.getInstance()
    )
    Firebase.auth.signInAnonymously()
}</code></pre>

<p>When building locally on an emulator, App Check prints a local token secret to logcat:</p>

<p>Enter this debug secret into the allow list in the Firebase Console: a8c2dd4c-xxxx-xxxx-xxxx-ef6c114ba27e</p>

<p>Once registered in the Firebase console, local requests are fully verified and authenticated by App Check, protecting our backend while letting us test the app locally.</p>

<h2>Conclusion</h2>
<p>By combining cloud model capabilities (grounding, system instructions) with on-device capabilities (hybrid routing, translation, security app checks), we created a travel app that is smart, secure, and available offline.</p>

<p>Check out the <a href="https://github.com/android/ai-samples/tree/main/jetpacker" target="_blank">full source code for Jetpacker on GitHub</a>, and explore the Firebase documentation to get started:</p>
<p><a href="https://firebase.google.com/docs/ai-logic/get-started">Firebase AI Logic Documentation</a><br><a href="https://firebase.google.com/docs/ai-logic/hybrid/android/get-started">Firebase Hybrid Inference API</a></p>

<h2>Learn more</h2>
<p>Check out the other parts of this blog post series:</p>
<p><b><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-introduction-jetpack.html">Part 1</a>:</b> Introduction of the app and a high-level overview.<br><b><a href="http://android-developers.googleblog.com/2026/07/android-on-device-inference.html">Part 2</a>: </b>On-device intelligence. Deep-dive into ML Kit’s GenAI APIs and Gemini Nano to build privacy-first features like itinerary summarization, receipt parsing, and local audio processing.<br><b><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-cloud-hybrid-inference.html">Part 3 (this post!):</a></b> Hybrid and cloud reasoning. Explore how to use Firebase AI Logic to ground LLM answers in real-world data like Google Maps and web context.<br><b><a href="http://android-developers.googleblog.com/2026/07/build-intelligent-android-apps-appfunctions.html">Part 4:</a> </b>System integration. Integrating with the Android intelligence system using AppFunctions. <br><b>Part 5 (coming soon):</b> In-app agentic workflows. Extend the app with an end-to-end booking assistant powered by A2UI and ADK.</p>

<p>Interested in more on Android Development? Follow Android Developers on <a href="https://www.youtube.com/@AndroidDevelopers">YouTube</a> or <a href="https://www.linkedin.com/showcase/androiddev/">LinkedIn</a>!</p>

<p>All code snippets in this blog post follow the following copyright notice:</p>
<pre><code>Copyright 2026 Google LLC.
SPDX-License-Identifier: Apache-2.0</code></pre>]]></content:encoded>
</item>
<item>
<title><![CDATA[‘Agent Kim Reactivated’ Episode 9 Recap: Kim and His Team Fight Their Way Out]]></title>
<description><![CDATA[Agent Kim Reactivated Episode 9 pushes Kim and his allies into another dangerous escape mission after his carefully prepared operation falls apart. With Min-ji’s safety still uncertain, Kim joins forces with Han-su, Jin-cheol, and Sang-a while Kang-chan prepares another cruel surprise.




Releas...]]></description>
<link>https://tsecurity.de/de/3693443/ios-mac-os/agent-kim-reactivated-episode-9-recap-kim-and-his-team-fight-their-way-out/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693443/ios-mac-os/agent-kim-reactivated-episode-9-recap-kim-and-his-team-fight-their-way-out/</guid>
<pubDate>Sat, 25 Jul 2026 10:05:45 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Agent Kim Reactivated Episode 9 pushes Kim and his allies into another dangerous escape mission after his carefully prepared operation falls apart. With Min-ji’s safety still uncertain, Kim joins forces with Han-su, Jin-cheol, and Sang-a while Kang-chan prepares another cruel surprise.




Release date: July 24, 2026



Streaming platform: Netflix



Total episodes: 10



Finale release date: July 25, 2026




The Korean drama follows an ordinary office worker who reveals his past as a highly trained black-ops agent after his daughter disappears. The series stars So Ji-sub as Manager Kim, alongside Choi Dae-hoon, Yoon Kyung-ho, Joo Sang-wook, Son Na-eun, and Seo Su-min.



Spoilers ahead for Agent Kim Reactivated Episode 9



Episode 9 begins with Kim’s latest operation failing to go according to plan. After being captured and tortured in the previous episode, Kim remains trapped between the National Special Missions Bureau, enemies from his past, and Kang-chan’s personal revenge campaign.



Kim refuses to surrender because reaching Min-ji remains his only priority. He once again relies on the skills he spent years hiding, although the episode makes it clear that he cannot complete this mission alone.



Han-su and Jin-cheol return to help their old friend, bringing their familiar mix of action and humour into the tense situation. Sang-a also becomes an important part of the escape plan. Together, the four characters attempt to break free before Kang-chan can carry out the next stage of his revenge.



Kang-chan reveals another plan



The biggest problem is that Kang-chan has already expected Kim to fight back. He keeps another secret weapon ready, forcing Kim and the other fathers to change their strategy while they are already under pressure.



Kang-chan’s actions continue the conflict that began with the bullying involving Min-ji and Hye-ri. What started as a dispute between their daughters has grown into a violent battle shaped by pride, power, and revenge.



The episode also brings the three fathers closer together. Han-su and Jin-cheol understand that Kim will risk his life for Min-ji, so they choose to remain beside him even when the chances of escaping become smaller.



Where is the story heading?



Episode 9 serves as the final setup before the conclusion. Kim has survived capture, reunited with Min-ji, and faced people connected to his hidden life, but Kang-chan still controls the final threat.



The remaining conflict now depends on whether Kim can protect his daughter without losing the friends who followed him into danger. The extended finale airs on July 25 at 9:45 p.m. KST, five minutes earlier than the show’s usual broadcast time.



What did you think about Kim, Han-su, Jin-cheol, and Sang-a’s escape mission in Agent Kim Reactivated Episode 9? Let us know what you expect from the finale in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[‘Sugar’ Season 2, Episode 7 Release Date and What to Expect]]></title>
<description><![CDATA[“Sugar” Season 2, Episode 7 will arrive on Apple TV on Friday, July 31, 2026. The upcoming chapter serves as the penultimate episode, bringing John Sugar closer to the truth behind his latest case while his conflict with Deputy Vega reaches a dangerous stage.



The neo-noir detective series retu...]]></description>
<link>https://tsecurity.de/de/3693442/ios-mac-os/sugar-season-2-episode-7-release-date-and-what-to-expect/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693442/ios-mac-os/sugar-season-2-episode-7-release-date-and-what-to-expect/</guid>
<pubDate>Sat, 25 Jul 2026 10:05:43 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[“Sugar” Season 2, Episode 7 will arrive on Apple TV on Friday, July 31, 2026. The upcoming chapter serves as the penultimate episode, bringing John Sugar closer to the truth behind his latest case while his conflict with Deputy Vega reaches a dangerous stage.



The neo-noir detective series returned for its second season on June 19, with Colin Farrell once again playing the mysterious private investigator. New episodes have followed every Friday, and the eight-episode season will conclude on August 7.




Release date: Friday, July 31, 2026



Streaming platform: Apple TV



Season: 2



Episode: 7



Genre: Crime, drama, mystery and neo-noir



Season finale: Friday, August 7, 2026




What is happening in ‘Sugar’ Season 2?



Spoilers ahead for Season 2, Episode 6.



Season 2 follows Sugar as he investigates another disappearance in Los Angeles while continuing his personal search for his missing sister, Djen. His new case involves the disappearance of a boxer’s brother, but the investigation has gradually exposed a much larger criminal operation involving drugs, false death records and housing fraud.



Episode 6, titled “Cautionary Tale,” explored Sugar’s past and his growing fear that life on Earth has changed him. A flashback involving Peg Rosenthal showed the emotional damage caused when members of his alien community become too attached to human desires.



Meanwhile, Sugar obtained evidence connected to Operation: Fire Sale and confronted the increasingly unstable Deputy Vega. He stopped himself from killing Vega, although the episode’s final bar encounter made it clear that their conflict remains unresolved.



What to expect from Episode 7



Episode 7 will likely push Sugar and Vega toward a direct confrontation. Vega’s threat against Ji Moon gives Sugar another reason to act, while the evidence surrounding Operation: Fire Sale can expose everyone involved in the scheme.



The episode should also bring Sugar’s new investigation closer to a resolution before the finale. However, his search for Djen and his unfinished business with Henry remain part of the larger story that began in Season 1.



The first season ended after Sugar rescued Olivia Siegel and discovered that Henry, another member of his alien group, had information about Djen’s disappearance. Sugar chose to remain on Earth after the other Polyglots prepared to leave, setting up his continuing search in Season 2.



“Sugar” Season 2, Episode 7 streams July 31 on Apple TV. What do you think Sugar will do when he faces Vega again? Let us know in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[Design System Governance Committee: 24 February 2026]]></title>
<description><![CDATA[Author: Mozilla Thunderbird - Bewertung: 6x - Views:160 In the February meeting, the Bolt Design System Committee aligns on initial setup and ownership for the Bolt Design System repo, began defining cross-platform icon naming conventions, plus works towards component exposure in the documentatio...]]></description>
<link>https://tsecurity.de/de/3693436/video/design-system-governance-committee-24-february-2026/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693436/video/design-system-governance-committee-24-february-2026/</guid>
<pubDate>Sat, 25 Jul 2026 10:05:10 +0200</pubDate>
<category>🎥 Video</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Mozilla Thunderbird - Bewertung: 6x - Views:160 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/1L2HisD3PeQ?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>In the February meeting, the Bolt Design System Committee aligns on initial setup and ownership for the Bolt Design System repo, began defining cross-platform icon naming conventions, plus works towards component exposure in the documentation site.<br />
<br />
Have any questions or want to join the conversation? Come find us in our Matrix room (https://matrix.to/#/#bolt-design-system:mozilla.org). New to Matrix? Find a Quick Start guide here: https://matrixdocs.github.io/docs/getting-started/quick-start<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure]]></title>
<description><![CDATA[Summary
Note: This joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, 2025, joint fact sheet Primary Mitigations to Reduce Cyber Threats to Operational Technology and European Cybercrime Centre’s (EC3) Operation Eas...]]></description>
<link>https://tsecurity.de/de/3693383/sicherheitsluecken/pro-russia-hacktivists-conduct-opportunistic-attacks-against-us-and-global-critical-infrastructure/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693383/sicherheitsluecken/pro-russia-hacktivists-conduct-opportunistic-attacks-against-us-and-global-critical-infrastructure/</guid>
<pubDate>Sat, 25 Jul 2026 09:15:46 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h2><strong>Summary</strong></h2>
<p><strong>Note:</strong> This joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, 2025, joint fact sheet <a href="https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology" title="Primary Mitigations to Reduce Cyber Threats to Operational Technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a> and European Cybercrime Centre’s (EC3) <a href="https://www.europol.europa.eu/media-press/newsroom/news/global-operation-targets-noname05716-pro-russian-cybercrime-network" target="_blank" title="Operation Eastwood" data-entity-type="external">Operation Eastwood</a>, in which CISA, Federal Bureau of Investigation (FBI), Department of Energy (DOE), Environmental Protection Agency (EPA), and EC3 shared information about cyber incidents affecting the operational technology (OT) and industrial control systems (ICS) of critical infrastructure entities in the United States and globally.</p>
<p>FBI, CISA, National Security Agency (NSA), and the following partners—hereafter referred to as “the authoring organizations”—are releasing this joint advisory on the targeting of critical infrastructure by pro-Russia hacktivists:</p>
<ul>
<li>U.S. Department of Energy (DOE)</li>
<li>U.S. Environmental Protection Agency (EPA)</li>
<li>U.S. Department of Defense Cyber Crime Center (DC3)</li>
<li>Europol European Cybercrime Centre (EC3)</li>
<li>EUROJUST – European Union Agency for Criminal Justice Cooperation</li>
<li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li>
<li>Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>Canadian Security Intelligence Service (CSIS)</li>
<li>Czech Republic Military Intelligence (VZ)</li>
<li>Czech Republic National Cyber and Information Security Agency (NÚKIB)</li>
<li>Czech Republic National Centre Against Terrorism, Extremism, and Cyber Crime (NCTEKK)</li>
<li>French National Cybercrime Unit – Gendarmerie Nationale (UNC)</li>
<li>French National Jurisdiction for the Fight Against Organized Crime (JUNALCO)</li>
<li>German Federal Office for Information Security (BSI)</li>
<li>Italian State Police (PS)</li>
<li>Latvian State Police (VP)</li>
<li>Lithuanian Criminal Police Bureau (LKPB)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>Romanian National Police (PR)</li>
<li>Spanish Civil Guard (GC)</li>
<li>Spanish National Police (CNP)</li>
<li>Swedish Polisen (SC3)</li>
<li>United Kingdom National Cyber Security Centre (NCSC-UK)</li>
</ul>
<p>The authoring organizations assess pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems. Pro-Russia hacktivist groups—Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16, and affiliated groups—are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage. Targeted sectors include <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">Water and Wastewater Systems</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/food-and-agriculture-sector" title="Food and Agriculture Sector">Food and Agriculture</a>, and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy Sector">Energy</a>.</p>
<p>The authoring organizations encourage critical infrastructure organizations to implement the recommendations in the <a href="https://www.cisa.gov/#Mitigations" title="Mitigations"><strong>Mitigations </strong></a>section of this advisory to reduce the likelihood and impact of pro-Russia hacktivist-related incidents. For additional information on Russian state-sponsored malicious cyber activity, see CISA’s <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia" title="Russia Threat Overview and Advisories">Russia Threat Overview and Advisories</a> webpage.</p>
<p>Download the PDF version of this report:</p>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2025-12/aa25-343a-pro-russia-hacktivists-conduct-attacks_0.pdf" class="c-file__link" target="_blank">Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure</a>
    <span class="c-file__size">(PDF,       1.53 MB
  )</span>
  </div>
</div>
<h2><strong>Background and Development of Pro-Russia Hacktivist Groups</strong></h2>
<p>Over the past several years, the authoring organizations have observed pro-Russia hacktivist groups conducting cyber operations against numerous organizations and critical infrastructure sectors worldwide. The escalation of the Russia-Ukraine conflict in 2022 significantly increased the number of these pro-Russia groups. Consisting of individuals who support Russia’s agenda but lack direct governmental ties, most of these groups target Ukrainian and allied infrastructure. However, among the increasing number of groups, some appear to have associations with the Russian state through direct or indirect support.</p>
<h3><strong>Cyber Army of Russia Reborn</strong></h3>
<p>The authoring organizations assess that the Russian General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455—tracked in the cybersecurity community under several names (see<strong> </strong><a href="https://www.cisa.gov/#AppB" title="Appendix B"><strong>Appendix B: Additional Designators Used for Cited Groups</strong></a>)—is likely responsible for supporting the creation of CARR —also known as “The People’s Cyber Army of Russia”—in late February or early March of 2022. Actors suspected to be from GRU unit 74455 likely funded the tools CARR threat actors used to conduct distributed denial-of-service (DDoS) attacks through at least September 2024.</p>
<p>In April 2022, the group began using a new Telegram channel featuring the name “CyberArmyofRussia_Reborn” to organize and plan group actions. The channel creators recruited actors to use CARR as an unattributable platform for conducting cyber activities beneath the level of an APT, aimed at deterring anti-Russia rhetoric. CARR threat actors presented themselves as a group of pro-Russia hacktivists supporting Russia’s stance on the Ukrainian conflict, and they soon began claiming responsibility for DDoS attacks against the U.S. and Europe for supporting Ukraine.</p>
<p>CARR documented these actions through embellished images and videos shared on their social media channels, promoting Russian ideology, disseminating talking points, and publicizing leaked information from hacks attributed to Russian state threat actors.</p>
<p>In late 2023, CARR expanded their operations to include attacks on industrial control systems (ICS), claiming an intrusion against a European wastewater treatment facility in October 2023. In November 2023, CARR targeted human-machine interface (HMI) devices, claiming intrusions at two U.S. dairy farms.</p>
<p>The authoring organizations assess that by late September 2024, CARR channel administrators became dissatisfied with the level of support and funding provided by the GRU. This dissatisfaction led CARR administrators and an administrator from another hacktivist group, NoName057(16), to create the Z-Pentest group, employing the same tactics, techniques, and procedures (TTPs) as CARR but separate from GRU involvement.</p>
<h3><strong>NoName057(16)</strong></h3>
<p>The authoring organizations assess that the Center for the Study and Network Monitoring of the Youth Environment (CISM), established on behalf of the Kremlin, created NoName057(16) as a covert project within the organization. Senior executives and employees within CISM developed and customized the NoName057(16) proprietary DDoS tool <code>DDoSia</code>, paid for the group’s network infrastructure, served as administrators on NoName057(16) Telegram channels, and selected DDoS targets.</p>
<p>Active since March 2022, NoName057(16) has conducted frequent DDoS attacks against government and private sector entities in North Atlantic Treaty Organization (NATO) member states and other European countries perceived as hostile to Russian geopolitical interests. The group operates primarily through Telegram channels and used GitHub, alongside various websites and repositories, to host <code>DDoSia</code> and share materials and TTPs with their followers. </p>
<p>In 2024, NoName057(16) began collaborating closely with other pro-Russia hacktivist groups, operating a joint chat with CARR by mid-2024. In July 2024, NoName057(16) jointly claimed responsibility with CARR for an alleged intrusion against OT assets in the U.S. The high degree of cooperation with CARR likely contributed to the formation of Z-Pentest, which is composed of actors and administrators from both teams, in September 2024.</p>
<h3><strong>Z-Pentest</strong></h3>
<p>Established in September 2024, Z-Pentest is composed of members from CARR and NoName057(16). The group specializes in OT intrusion operations targeting globally dispersed critical infrastructure entities. Additionally, the group uses “hack and leak” operations and defacement attacks to draw attention to their pro-Russia messaging. Unlike other pro-Russia hacktivist groups, Z-Pentest largely avoids DDoS activities, claiming OT intrusions as attempts to garner more attention from the media.</p>
<p>Shortly after Z-Pentest’s inception, the group announced alliances with CARR and NoName057(16), possibly to leverage the other groups’ subscribers to grow the new channel. In March 2025, Z-Pentest posted evidence claiming OT device intrusions to their channel using a NoName057(16) cyberattack campaign hashtag. Similarly, in April 2025, Z-Pentest shared a video purporting defacement of an HMI by changing system names to NoName057(16) and CARR references. Z-Pentest continues to create new alliances with other groups, like Sector16, to continue growing their subscriber base and incidentally propagate TTPs with new partners.</p>
<h3><strong>Sector16</strong></h3>
<p>Formed in January 2025, Sector16 is a novice pro-Russia hacktivist group that emerged through collaboration with Z-Pentest. Sector16 actively maintains an online presence, including a public Telegram channel where they share videos, statements, and claims of compromising U.S. energy infrastructure. These communications often align with pro-Russia narratives and reflect their self-proclaimed support for Russian geopolitical objectives.</p>
<p>Members of Sector16 may have received indirect support from the Russian government in exchange for conducting specific cyber operations that further Russian strategic goals. This aligns with broader Russian cyber strategies that involve leveraging non-state threat actors for certain cyber activities, adding a layer of deniability.</p>
<h2><strong>Technical Details</strong></h2>
<p><strong>Note:</strong> This advisory uses the MITRE ATT&amp;CK<sup>®</sup> <a href="https://attack.mitre.org/versions/v18/matrices/enterprise/" title="Matrix for Enterprise framework" data-entity-type="external">Matrix for Enterprise framework</a>, version 18. See the <a href="https://www.cisa.gov/#MITRE" title="MITRE ATT&amp;CK Tactics and Techniques"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a> section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&amp;CK tactics and techniques.</p>
<h3><strong>TTP Overview</strong></h3>
<p>Pro-Russia hacktivist groups employ easily disseminated and replicated TTPs across various entities, increasing the likelihood of widespread adoption and escalating the frequency of intrusions. These groups have limited capabilities, frequently misunderstanding the processes they aim to disrupt. Their apparent low level of technical knowledge results in haphazard attacks where actors intend to cause physical damage but cannot accurately anticipate actual impact. Despite these limitations, the authoring organizations have observed these groups willfully cause actual harm to vulnerable critical infrastructure.</p>
<p>Pro-Russia hacktivist groups use the TTPs in this Cybersecurity Advisory to target virtual network computing (VNC)-connected HMI devices. These groups are primarily seeking notoriety with their actions. While they have caused damage in some instances, they regularly make false or exaggerated claims about their attacks on critical infrastructure to garner more attention. They frequently misrepresent their capabilities and the impacts of their actions, portraying minor incursions as significant breaches, but such incursions can still lead to lost time and resources for operators remediating systems.</p>
<p>Additionally, pro-Russia hacktivists use an opportunistic targeting methodology. They leverage superficial criteria, such as victim availability and existing vulnerabilities, rather than focusing on strategically significant entities. Their lack of strategic focus can lead to a broad array of targets, ranging from water treatment facilities to oil well systems. Pro-Russia hacktivists have demonstrated a pattern of frequently taking advantage of the widespread availability of vulnerable VNC connections. While system owners typically use VNC connections for legitimate remote system access functions, threat actors can maliciously use these connections to broadly target numerous platforms and services. Consequently, these groups can indiscriminately compromise critical infrastructure entities, including those in the <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Sector">Water and Wastewater</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/food-and-agriculture-sector" title="Food and Agriculture Sector" data-entity-type="external">Food and Agriculture</a>, and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy Sector">Energy</a> Sectors.</p>
<p>Pro-Russia hacktivist groups have successfully targeted supervisory control and data acquisition (SCADA) networks using basic methods, and in some cases, performed simultaneous DDoS attacks against targeted networks to facilitate SCADA intrusions. As recently as April 2025, threat actors used the following unsophisticated TTPs to access networks and conduct SCADA intrusions:</p>
<ul>
<li>Scan for vulnerable devices on the internet [<a href="https://attack.mitre.org/versions/v18/techniques/T0883/" target="_blank" title="T0883" data-entity-type="external">T0883</a>] with open VNC ports [<a href="https://attack.mitre.org/versions/v18/techniques/T1595/002/" target="_blank" title="T1595.002" data-entity-type="external">T1595.002</a>].</li>
<li>Initiate temporary virtual private server (VPS) [<a href="https://attack.mitre.org/versions/v18/techniques/T1583/003/" target="_blank" title="T1583.003" data-entity-type="external">T1583.003</a>] to execute password brute force software.</li>
<li>Use VNC software to access hosts [<a href="https://attack.mitre.org/versions/v18/techniques/T1021/005/" target="_blank" title="T1021.005" data-entity-type="external">T1021.005</a>].</li>
<li>Confirm connection to the vulnerable device [<a href="https://attack.mitre.org/versions/v18/techniques/T0886/" target="_blank" title="T0886" data-entity-type="external">T0886</a>].</li>
<li>Brute force the password, if required [<a href="https://attack.mitre.org/versions/v18/techniques/T1110/003/" target="_blank" title="T1110.003" data-entity-type="external">T1110.003</a>].</li>
<li>Gain access to HMI devices [<a href="https://attack.mitre.org/versions/v18/techniques/T0883/" target="_blank" title="T0883" data-entity-type="external">T0883</a>], typically with default [<a href="https://attack.mitre.org/versions/v18/techniques/T0812/" target="_blank" title="T0812" data-entity-type="external">T0812</a>], weak, or no passwords [<a href="https://attack.mitre.org/versions/v18/techniques/T0859/" target="_blank" title="T0859" data-entity-type="external">T0859</a>].</li>
<li>Log the confirmed vulnerable device IP address, port, and password.</li>
<li>Using the HMI graphical interface [<a href="https://attack.mitre.org/versions/v18/techniques/T0823/" target="_blank" title="T0823" data-entity-type="external">T0823</a>], capture screen recordings or intermittent screenshots while conducting the following actions, intending to affect productivity and cause additional costs [<a href="https://attack.mitre.org/versions/v18/techniques/T0828/" target="_blank" title="T0828" data-entity-type="external">T0828</a>]:
<ul>
<li>Modify usernames/passwords [<a href="https://attack.mitre.org/versions/v18/techniques/T0892/" target="_blank" title="T0892" data-entity-type="external">T0892</a>];</li>
<li>Modify parameters [<a href="https://attack.mitre.org/versions/v18/techniques/T0836/" target="_blank" title="T0836" data-entity-type="external">T0836</a>];</li>
<li>Modify device name [<a href="https://attack.mitre.org/versions/v18/techniques/T0892/" target="_blank" title="T0892" data-entity-type="external">T0892</a>];</li>
<li>Modify instrument settings [<a href="https://attack.mitre.org/versions/v18/techniques/T0831/" target="_blank" title="T0831" data-entity-type="external">T0831</a>];</li>
<li>Disable alarms [<a href="https://attack.mitre.org/versions/v18/techniques/T0878/" target="_blank" title="T0878" data-entity-type="external">T0878</a>];</li>
<li>Create loss of view (a technique that mandates local hands-on operator intervention) [<a href="https://attack.mitre.org/versions/v18/techniques/T0829/" target="_blank" title="T0829" data-entity-type="external">T0829</a>]; and/or</li>
<li>Device restart or shutdown [<a href="https://attack.mitre.org/versions/v18/techniques/T0816/" target="_blank" title="T0816" data-entity-type="external">T0816</a>].</li>
</ul>
</li>
<li>Disconnect from the device, ending the VNC connection.</li>
<li>Research the compromised device company after the intrusion [<a href="https://attack.mitre.org/versions/v18/techniques/T1591/" target="_blank" title="T1591" data-entity-type="external">T1591</a>].</li>
</ul>
<h4><strong>Propagation</strong></h4>
<p>To reach a wider audience, pro-Russia hacktivist groups work together, amplify each other’s posts, create additional groups to amplify their own posts, and likely share TTPs. For example, Z-Pentest jointly claimed intrusion of a U.S. system with Sector16. Sector16 later began posting additional intrusions for which the group claimed sole responsibility. It is likely that these and similar groups will continue to iterate and share these methods to disrupt critical infrastructure organizations.</p>
<h4><strong>Reconnaissance and Initial Access</strong></h4>
<p>The threat actors’ intrusion methodology is relatively unsophisticated, inexpensive to execute, and easy to replicate. These pro-Russia hacktivist groups abuse popular internet-scraping tools, such as <code>Nmap</code> or <code>OPENVAS</code>, to search for visible VNC services and use brute force password spraying tools to access devices via known default or otherwise weak credentials. Threat actors typically search for these services on the default port <code>5900</code> or other nearby ports (<code>5901-5910</code>). Their goal is to gain remote access to HMI devices connected to live control networks.</p>
<p>Once threat actors obtain access, they manipulate available settings from the graphical user interface (GUI) on the HMI devices, such as arbitrary physical parameter and setpoint changes, or conduct defacement activities. Because pro-Russia hacktivist groups seem to lack sector-specific expertise or cyber-physical engineering knowledge, they currently cannot reliably estimate the true impact of their actions. Regardless of outcome, pro-Russia hacktivist groups often post images and screen recordings to their social media platforms, boasting the compromises and exaggerating impacts to garner attention from their peers and the media.</p>
<h4><strong>Impact</strong></h4>
<p>While pro-Russia hacktivist groups currently demonstrate limited ability to consistently cause significant impact, there is a risk that their continued attacks will result in further harm or grievous physical consequences. Attacks have not yet caused injury; however, the attacks against occupied factories and community facilities demonstrate a lack of consideration for human safety.</p>
<p>Victim organizations reported that the most common operational impact caused by these threat actors is a temporary loss of view, necessitating manual intervention to manage processes. However, any modifications to programmatic and systematic procedures can result in damage or disruption, including substantial labor costs from hiring a programmable logic controller programmer to restore operations, costs associated with operational downtime, and potential costs for network remediation.</p>
<h2><a class="ck-anchor"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a></h2>
<p>See <a href="https://www.cisa.gov/#Table1" title="Table 1"><strong>Table 1</strong></a> to <a href="https://www.cisa.gov/#Table10" title="Table 10"><strong>Table 10</strong></a> for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;CK framework, see CISA and MITRE ATT&amp;CK’s <a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;CK Mapping">Best Practices for MITRE ATT&amp;CK Mapping</a> and CISA’s <a href="https://github.com/cisagov/Decider/" title="Decider Tool">Decider Tool</a>.</p>
<p><a class="ck-anchor"></a></p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 1. Reconnaissance</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Gather Victim Organization Information</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1591/" target="_blank" title="T1591" data-entity-type="external">T1591</a></td>
<td>Threat actors use information available on the internet to determine what systems they believe they have compromised and post the information on their social media. This methodology frequently leads to the threat actors misidentifying their claimed victims.</td>
</tr>
<tr>
<td>Active Scanning: Vulnerability Scanning</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1595/002/" target="_blank" title="T1595.002" data-entity-type="external">T1595.002</a></td>
<td>Threat actors use open source tools to look for IP addresses in target countries with visible VNC services on common ports.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 2. Resource Development</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Acquire Infrastructure: Virtual Private Server</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1583/003/" target="_blank" title="T1583.003" data-entity-type="external">T1583.003</a></td>
<td>Threat actors use virtual infrastructure to obfuscate identifiers.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 3. Initial Access</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Internet Accessible Device</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0883/" target="_blank" title="T0883" data-entity-type="external">T0883</a></td>
<td>Threat actors gain access through less secure HMI devices exposed to the internet.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 4. Persistence</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Valid Accounts</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0859/" target="_blank" title="T0859" data-entity-type="external">T0859</a></td>
<td>Threat actors use password guessing tools to access legitimate accounts on the HMI devices.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 5. Credential Access</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Brute Force: Password Spraying</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1110/003/" target="_blank" title="T1110.003" data-entity-type="external">T1110.003</a></td>
<td>Threat actors use tools to rapidly guess common or simple passwords.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 6. Lateral Movement</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Default Credentials</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0812/" target="_blank" title="T0812" data-entity-type="external">T0812</a></td>
<td>Threat actors seek and build libraries of known default passwords for control devices to access legitimate user accounts.</td>
</tr>
<tr>
<td>Remote Services</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0886/" target="_blank" title="T0886" data-entity-type="external">T0886</a></td>
<td>Threat actors leverage VNC services to access system HMI devices.</td>
</tr>
<tr>
<td>Remote Services: VNC</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T1021/005/" target="_blank" title="T1021.005" data-entity-type="external">T1021.005</a></td>
<td>Threat actors hunt VNC-enabled devices visible on the internet and connect with remote viewer software.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 7. Execution</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Graphical User Interface</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0823/" target="_blank" title="T0823" data-entity-type="external">T0823</a></td>
<td>Threat actors interact with HMI devices via GUIs, attempting to modify control devices.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 8. Inhibit Response Function</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><strong>Technique Title</strong></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Device Restart/Shutdown</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0816/" target="_blank" title="T0816" data-entity-type="external">T0816</a></td>
<td>While threat actors claim to turn off HMIs, it is possible that operators (not the threat actors) turn the devices off during incident response.</td>
</tr>
<tr>
<td>Alarm Suppression</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0878/" target="_blank" title="T0878" data-entity-type="external">T0878</a></td>
<td>Threat actors use HMI interfaces to clear alarms caused by their activity and alarms already present on the system at the time of their intrusion.</td>
</tr>
<tr>
<td>Change Credential</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0892/" target="_blank" title="T0892" data-entity-type="external">T0892</a></td>
<td>Threat actors change the usernames and passwords of HMI devices in operator lockout attempts, usually resulting in a loss of view and operators switching to manual operations.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 9. Impair Process Control</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Modify Parameter</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0836/" target="_blank" title="T0836" data-entity-type="external">T0836</a></td>
<td>Threat actors attempt to change upper and lower limits of operational devices as available from the HMI.</td>
</tr>
<tr>
<td>Unauthorized Command Message</td>
<td><a href="https://attack.mitre.org/techniques/T0855/" target="_blank" title="T0855" data-entity-type="external">T0855</a></td>
<td>Threat actors attempt to send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, causing possible impact.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><em>Table 10. Impact</em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist"><a class="ck-anchor"><strong>Technique Title</strong></a></th>
<th role="columnheader"><strong>ID</strong></th>
<th role="columnheader"><strong>Use</strong></th>
</tr>
</thead>
<tbody>
<tr>
<td>Loss of Productivity and Revenue</td>
<td><a href="https://attack.mitre.org/versions/v18/techniques/T0828/" target="_blank" title="T0828" data-entity-type="external">T0828</a></td>
<td>Threat actors purposefully attempt to impact productivity and create additional costs for the affected entities.</td>
</tr>
<tr>
<td>Loss of View</td>
<td><a href="https://attack.mitre.org/versions/v15/techniques/T0829/" target="_blank" title="T0829" data-entity-type="external">T0829</a></td>
<td>Threat actors change credentials on HMI devices, preventing operators from modifying processes remotely. </td>
</tr>
<tr>
<td>Manipulation of Control</td>
<td><a href="https://attack.mitre.org/versions/v15/techniques/T0831/" target="_blank" title="T0831" data-entity-type="external">T0831</a></td>
<td>Threat actors change setpoints in processes, impacting the efficiency of operations for those specific processes.  </td>
</tr>
</tbody>
</table>
<h2><strong>Incident Response</strong></h2>
<p>If organizations find exposed systems with weak or default passwords, they should assume threat actors compromised the system and begin the following incident response protocols:</p>
<ol>
<li><strong>Determine which hosts were compromised and isolate them</strong> by quarantining or taking them offline.</li>
<li><strong>Initiate threat hunting activities to scope the intrusion</strong>. Collect and review artifacts, such as running processes/services, unusual authentications, and recent network connections.</li>
<li><strong>Reimage compromised hosts</strong>.</li>
<li><strong>Provision new account credentials</strong>.</li>
<li><strong>Report the compromise to CISA, FBI, and/or NSA</strong>. See the <a href="https://www.cisa.gov/#Contact" title="Contact Information"><strong>Contact Information</strong></a> section of this advisory.</li>
<li><strong>Harden the network to prevent additional malicious activity</strong>. See the <a href="https://www.cisa.gov/#Mitigations" title="Mitigations "><strong>Mitigations </strong></a>section of this advisory for guidance.</li>
</ol>
<h2><a class="ck-anchor"><strong>Mitigations</strong></a></h2>
<h3><strong>OT Asset Owners and Operators</strong></h3>
<p>The authoring organizations recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture based on the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s <a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="CPGs">CPGs webpage</a> for more information on the CPGs, including additional recommended baseline protections.</p>
<ul>
<li><strong>Reduce exposure of OT assets to the public-facing internet.</strong> When connected to the internet, OT devices are easy targets for malicious cyber threat actors. Many devices can be found by searching for open ports on public IP ranges with search engine tools to target victims with OT components [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#SecureInternetFacingDevices3S" title="CPG 3.S">CPG 3.S</a>].
<ul>
<li><strong>Asset owners should use attack surface management services </strong>and web-based search platforms to scan the internet. This mitigation can help identify if there are VNC systems exposed within the IP ranges they own, especially for connections set up by third parties.<br><strong>Note:</strong> For more information on attack surface management, see CISA’s <a href="https://www.cisa.gov/resources-tools/resources/exposure-reduction" title="Internet Exposure Reduction Guidance">Internet Exposure Reduction Guidance</a>, CISA’s <a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services">Cyber Hygiene Services</a> for U.S. critical infrastructure, and NSA’s <a href="https://www.nsa.gov/Portals/75/documents/resources/everyone/Attack%20Surface%20Management%20copy.pdf" target="_blank" title="Attack Surface Management" data-entity-type="external">Attack Surface Management</a> for the U.S. Defense Industrial Base.</li>
<li><strong>Implement network segmentation between IT and OT networks.</strong> Segmenting critical systems and introducing a demilitarized zone (DMZ) for passing control data to enterprise logistics reduces the potential impact of cyber threats and the risk of disruptions to essential OT operations [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementLogicalPhysicalNetworkSegmentation3I" title="CPG 3.I">CPG 3.I</a>].</li>
<li><strong>Consider implementing a firewall and/or virtual private network</strong> if exposure to the internet is necessary for controlling access to devices.
<ul>
<li>Consider disabling public exposure by default and implementing time-limited remote access to reduce the amount of time systems are exposed.</li>
<li>Restrict and monitor both inbound and outbound traffic at OT perimeter firewalls. Configure OT perimeter firewalls to enforce a default-deny policy for all traffic. Asset owners should explicitly permit authorized destinations and protocols based on operational requirements.</li>
<li>Implement strict egress filtering to prevent unauthorized data exfiltration or command-and-control callbacks.</li>
<li>Regularly audit firewall rulesets and monitor outbound traffic patterns for anomalies indicative of threat actor activity, such as beaconing or unexpected protocol usage.</li>
</ul>
</li>
</ul>
</li>
<li><strong>Adopt mature asset management processes</strong>, including mapping data flows and access points. Generating a complete picture of both OT and IT assets provides visibility to operators and management, allowing organizations to monitor and assess deviations for criticality [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ManageOrganizationalAssets2A" title="CPG 2.A">CPG 2.A</a>].
<ul>
<li><strong>Keep remote access services updated </strong>with the latest version available and ensure all systems and software are up to date with patches and necessary security updates.
<ul>
<li>Keep VNC systems updated with the latest version available.</li>
</ul>
</li>
<li><strong>Refer to the joint </strong><a href="https://www.cisa.gov/resources-tools/resources/foundations-ot-cybersecurity-asset-inventory-guidance-owners-and-operators" title="Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators"><strong>Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators</strong></a> to help with reducing cybersecurity risk by identifying which assets within their environment should be secured and protected.</li>
</ul>
</li>
<li><strong>Ensure OT assets use robust authentication procedures.</strong>
<ul>
<li>Many devices lack robust authentication and authorization. Devices with weak authentication are vulnerable targets to threat actors using credential theft techniques.</li>
<li>Implement MFA where possible. Where MFA is not feasible, use strong, unique passwords. Apply password standards for operator-accessible services on underlying OT assets, as well as network devices protecting those services. This is especially important for services that require internet accessibility [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ChangingDefaultPasswords3A" title="CPG 3.A">CPG 3.A</a>] [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#EstablishMinimumPasswordStrength3B" title="CPG 3.B">CPG 3.B</a>] [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#CreateUniqueCredentials3C" title="CPG 3.C">CPG 3.C</a>] [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementMultifactorAuthentication3F" title="CPG 3.F">CPG 3.F</a>].</li>
<li>Establish an allowlist that permits only authorized device IP addresses and/or media access control addresses. The allowlist can be refined to operator working hours to further obstruct malicious threat actor activity; organizations are encouraged to establish monitoring and alerting for access attempts not meeting these criteria [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MonitorUnsuccessfulAutomatedLoginAttempts3E" title="CPG 3.E">CPG 3.E</a>].</li>
<li>Disable any unused authentication methods, logic, or features, such as default authentication keys and default passwords. Block all unused high ephemeral ports and monitor for attempted connections using standard protocols on non-standard ports [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ProhibitConnectionofUnauthorizedDevices3R" title="CPG 3.R">CPG 3.R</a>].</li>
<li>Authenticate all access to field controllers before authorizing access to, or modification of, a device’s state, logic, program, or filesystems.</li>
</ul>
</li>
<li><strong>Enable control system security features </strong>that can separate and audit view and control functions. Limiting remotely accessible or default user accounts to “view-only” removes the potential for impact without exploiting a vulnerability [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#AdministratorsMaintainSeparateUserandPrivilegedAccounts3G" title="CPG 3.G">CPG 3.G</a>].</li>
<li><strong>Implement and practice business recovery/disaster recovery plans.</strong> Plans should also take into consideration redundancy, fail-safe mechanisms, islanding capabilities, backup restoration, and manual operation.
<ul>
<li>Include scenarios that necessitate switching to manual operations. Maintaining the capability of an organization to revert to manual controls to quickly restore operations is vital in the immediate aftermath of a cyber incident [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#IncidentPlanningandPreparedness6A" title="CPG 6.A">CPG 6.A</a>].</li>
<li>Create backups of the engineering logic, configurations, and firmware of HMIs to enable fast recovery. Organizations should routinely test backups and standby systems to ensure safe manual operations in the event of an incident [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MaintainSystemBackupsRestorationAbility3O" title="CPG 3.O">CPG 3.O</a>].</li>
</ul>
</li>
<li><strong>Collect and monitor the traffic of OT assets and networking devices.</strong> This includes unusual logins or unexpected protocols communicating over the internet, and functions of ICS management protocols that change an asset’s operating mode or modify programs.</li>
<li><strong>Review configurations for setpoint ranges or tag values </strong>to stay within safe ranges and establish alerting for deviations.</li>
<li><strong>Take a proactive approach in the procurement process</strong> by following the guidance outlined in the joint guide <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products</a>.</li>
</ul>
<h3>OT Device Manufacturers</h3>
<p>Although critical infrastructure organizations can take steps to mitigate risks, it is ultimately the responsibility of OT device manufacturers to build products that are secure by design. The authoring organizations urge device manufacturers to take ownership of the security outcomes of their customers in line with the joint guide <a href="https://www.cisa.gov/resources-tools/resources/secure-by-design" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software">Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software</a>.</p>
<ul>
<li><strong>Eliminate default credentials and require strong passwords.</strong> The use of default credentials is a top weakness threat actors exploit to gain access to systems.</li>
<li><strong>Mandate MFA for privileged users.</strong> Changes to engineering logic or configurations are safety-impacting events in critical infrastructure. MFA should be available for safety critical components at no additional cost.</li>
<li><strong>Practice secure by default principles. </strong>OT components were initially designed without public internet connectivity in mind. When internet connection becomes necessary, implementing additional security measures is essential to safeguard these systems. Manufacturers should recognize insecure states and promptly inform users so they can make informed risk decisions.
<ul>
<li><strong>Include logging at no additional charge.</strong> Change and access control logs allow operators to track safety-impacting events in their critical infrastructure. These logs should be available for no cost and use open standard logging formats.</li>
</ul>
</li>
<li><strong>Publish Software Bill of Materials (SBOMs).</strong> Vulnerabilities in underlying software libraries can affect a wide range of devices. Without an SBOM, it is nearly impossible for a critical infrastructure system owner to measure and mitigate the impact of a vulnerability on their existing systems. See CISA’s <a href="https://www.cisa.gov/sbom" title="Software Bill of Materials">SBOM webpage</a> for more information.</li>
</ul>
<p>Additionally, see CISA’s <a href="https://www.cisa.gov/resources-tools/resources/secure-design-alert-how-software-manufacturers-can-shield-web-management-interfaces-malicious-cyber" title="Secure by Design Alert">Secure by Design Alert</a> on how software manufacturers can shield web management interfaces from malicious cyber activity. By using secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.</p>
<p>For more information on secure by design, see CISA’s <a href="https://www.cisa.gov/securebydesign" title="Secure by Design">Secure by Design</a> webpage.</p>
<h2><strong>Validate Security Controls</strong></h2>
<p>In addition to applying mitigations, the authoring organizations recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&amp;CK Matrix for Enterprise framework in this advisory. The authoring organizations recommend testing your existing security controls inventory to assess how it performs against the ATT&amp;CK techniques described in this advisory.</p>
<p>To start:</p>
<ol>
<li>Select an ATT&amp;CK technique described in this advisory (see <a href="https://www.cisa.gov/#Table1" title="Table 1"><strong>Table 1</strong></a> to<strong> </strong><a href="https://www.cisa.gov/#Table10" title="Table 10"><strong>Table 10</strong></a>).</li>
<li>Align your security technologies against the technique.</li>
<li>Test your technologies against the technique.</li>
<li>Analyze your detection and prevention technologies’ performance.</li>
<li>Repeat the process for all security technologies to obtain a set of comprehensive performance data.</li>
<li>Tune your security program, including people, processes, and technologies, based on the data generated by this process.</li>
</ol>
<p>The authoring organizations recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&amp;CK techniques identified in this advisory.</p>
<h2><strong>Resources</strong></h2>
<p>Entities requiring additional support for implementing any of the mitigations in this advisory should contact their regional CISA Cybersecurity Advisor for assistance. Key resources organizations should reference include:</p>
<ul>
<li>CISA, EPA, NSA, FBI, ASD’s ACSC, Cyber Centre, BSI, NCSC-NL, and NCSC-NZ’s <a href="https://www.cisa.gov/resources-tools/resources/foundations-ot-cybersecurity-asset-inventory-guidance-owners-and-operators" title="Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators">Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators</a> offers best practices to assist organizations in identifying and prioritizing which assets should be secured and protected.</li>
<li>CISA, FBI, NSA, EPA, DOE, USDA, FDA, MS-ISAC, Cyber Centre, and NCSC-UK’s guidance on <a href="https://www.cisa.gov/resources-tools/resources/defending-ot-operations-against-ongoing-pro-russia-hacktivist-activity" title="Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity">Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity</a> that can help organizations protect OT systems from pro-Russia hacktivist activity.</li>
<li>NSA and CISA’s guidance on <a href="https://media.defense.gov/2022/Sep/22/2003083007/-1/-1/0/CSA_ICS_Know_the_Opponent_.PDF" target="_blank" title="Control System Defense: Know the Opponent" data-entity-type="external">Control System Defense: Know the Opponent</a> helps organizations defend OT and ICS assets against malicious cyber activity.</li>
<li>CISA and EPA’s resource page on <a href="https://www.cisa.gov/water" title="Water and Wastewater Cybersecurity">Water and Wastewater Cybersecurity</a> to help organizations reduce risks posed by malicious cyber actors targeting water and wastewater systems.
<ul>
<li>For additional guidance, see CISA, EPA, and FBI’s fact sheet on <a href="https://www.cisa.gov/resources-tools/resources/top-cyber-actions-securing-water-systems" title="Top Cyber Actions for Securing Water Systems">Top Cyber Actions for Securing Water Systems</a>.</li>
</ul>
</li>
<li>The Food and Ag-ISAC’s best practices on <a href="https://www.idfa.org/wordpress/wp-content/uploads/2023/07/Food-and-Ag-ISAC-Cybersecurity-Guide-2023_IDFA.pdf" target="_blank" title="Food and Ag Cybersecurity: A Guide for Small &amp; Medium Enterprises" data-entity-type="external">Food and Ag Cybersecurity: A Guide for Small &amp; Medium Enterprises</a> provides recommendations to help mitigate against cyber threats.</li>
<li>DOE and National Association of Regulatory Utility Commissioners <a href="https://www.naruc.org/core-sectors/critical-infrastructure-and-cybersecurity/cybersecurity-for-utility-regulators/cybersecurity-baselines/" target="_blank" title="Cybersecurity Baselines for Electric Distribution Systems and Distributed Energy (DER)" data-entity-type="external">Cybersecurity Baselines for Electric Distribution Systems and Distributed Energy (DER)</a> webpage provides resources for state public utility commissions and utilities, as well as DER operators and aggregators to help mitigate cybersecurity risks.</li>
</ul>
<p>Additional resources that apply to this advisory include:</p>
<ul>
<li>EPA’s <a href="https://www.epa.gov/cyberwater/epa-cybersecurity-water-sector" target="_blank" title="Cybersecurity for the Water Sector" data-entity-type="external">Cybersecurity for the Water Sector</a> resource page provides organizations with guidance on implementing basic cyber hygiene practices.</li>
<li>CISA’s <a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals">Cross-Sector Cybersecurity Performance Goals</a> enables critical infrastructure organizations to reduce the likelihood and impact of known risks and adversary techniques.</li>
<li>CISA’s <a href="https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-strong-passwords" title="Require Strong Passwords">Require Strong Passwords</a> webpage supports small and medium-sized businesses mitigating against malicious cyber activity that targets weak passwords.</li>
<li>CISA, NSA, FBI, EPA, TSA, and international partners’ guidance <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products</a>.</li>
<li>DOE’s guidance on <a href="https://www.energy.gov/ceser/cyber-informed-engineering" target="_blank" title="Cyber-Informed Engineering" data-entity-type="external">Cyber-Informed Engineering</a> recommends considering cyber-enabled risks during the conception, design, and development phases when manufacturing physical systems.</li>
<li>CISA’s <a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services">Cyber Hygiene Services</a> help enable critical infrastructure organizations to reduce their exposure to threats by taking a proactive approach to monitoring and mitigating attack vectors.</li>
<li>CISA, NSA, FBI, and international partners’ guidance on <a href="https://www.cisa.gov/resources-tools/resources/secure-by-design" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software">Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software</a> urges software manufacturers to provide customers with products that are safer and more secure.
<ul>
<li>See more information in these Secure by Design Alerts: <a href="https://www.cisa.gov/resources-tools/resources/secure-design-alert-how-manufacturers-can-protect-customers-eliminating-default-passwords" title="How Manufacturers Can Protect Customers by Eliminating Default Passwords">How Manufacturers Can Protect Customers by Eliminating Default Passwords</a> and <a href="https://www.cisa.gov/resources-tools/resources/secure-design-alert-how-software-manufacturers-can-shield-web-management-interfaces-malicious-cyber" title="How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity">How Software Manufacturers Can Shield Web Management Interfaces From Malicious Cyber Activity</a>.</li>
</ul>
</li>
</ul>
<h2><a class="ck-anchor"><strong>Contact Information</strong></a></h2>
<p><strong>U.S. organizations</strong> are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, FBI, and/or NSA:</p>
<ul>
<li>Contact CISA via CISA’s 24/7 Operations Center at <a href="mailto:contact@cisa.dhs.gov" title="contact@cisa.dhs.gov">contact@cisa.dhs.gov</a> or 1-844-Say-CISA (1-844-729-2472) or your local <a href="https://www.fbi.gov/contact-us/field-offices" target="_blank" title="FBI field office" data-entity-type="external">FBI field office</a>. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.</li>
<li>For NSA cybersecurity guidance inquiries, contact <a href="mailto:CybersecurityReports@nsa.gov" target="_blank" title="CybersecurityReports@nsa.gov">CybersecurityReports@nsa.gov</a>.</li>
</ul>
<p><strong>Australian organizations:</strong> Visit <a href="https://www.cyber.gov.au/" target="_blank" title="cyber.gov.au" data-entity-type="external">cyber.gov.au</a> or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.</p>
<p><strong>Canadian organizations:</strong> Report incidents by emailing Cyber Centre at <a href="mailto:contact@cyber.gc.ca" target="_blank" title="contact@cyber.gc.ca">contact@cyber.gc.ca</a>.</p>
<p><strong>New Zealand organizations:</strong> Report cyber security incidents to <a href="mailto:incidents@ncsc.govt.nz" target="_blank" title="incidents@ncsc.govt.nz">incidents@ncsc.govt.nz</a> or call 04 498 7654.</p>
<p><strong>United Kingdom organizations:</strong> Report a significant cyber security incident: <a href="https://report.ncsc.gov.uk/" target="_blank" title="report.ncsc.gov.uk" data-entity-type="external">report.ncsc.gov.uk</a> (monitored 24 hours) or, for urgent assistance, call 03000 200 973.</p>
<h2><strong>Disclaimer</strong></h2>
<p>The information in this report is being provided “as is” for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI and co-sealers.</p>
<h2><strong>Acknowledgements</strong></h2>
<p>Schneider Electric, Nozomi Networks, Eversource Energy, Electricity Information Sharing and Analysis Center, Chevron, BP, and Dragos contributed to this advisory.</p>
<h2><strong>Version History</strong></h2>
<p><strong>December 09, 2025:</strong> Initial version.</p>
<h2><strong>Appendix A: Targeting Methodologies for Pro-Russia Hacktivist Groups</strong></h2>
<p>For further information on targeting methodologies for pro-Russia hacktivist groups, see:</p>
<ul>
<li>CISA’s alert <a href="https://www.cisa.gov/news-events/alerts/2025/05/06/unsophisticated-cyber-actors-targeting-operational-technology" title="Unsophisticated Cyber Threat Actor(s) Targeting Operational Technology">Unsophisticated Cyber Threat Actor(s) Targeting Operational Technology</a>;</li>
<li>The joint fact sheet <a href="https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology" title="Primary Mitigations to Reduce Cyber Threats to Operational Technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a>; and</li>
<li>CISA’s <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia" title="Russia Cyber Threat">Russia Cyber Threat</a> webpage.</li>
</ul>
<h2><a class="ck-anchor"><strong>Appendix B: Additional Designators Used for Cited Groups</strong></a></h2>
<p>The cybersecurity industry and cyber actor groups often use various names to reference actor groups. While not exhaustive, the following are the most notable names used within the cybersecurity community to reference the groups in this advisory.</p>
<p><strong>Note:</strong> Cybersecurity organizations have different methods of tracking and attributing cyber actors, and this may not be a 1:1 correlation to the authoring organizations’ understanding for all activity related to these groupings.</p>
<ul>
<li>GRU military unit 74455
<ul>
<li>Sandworm Team</li>
<li>Voodoo Bear</li>
<li>Seashell Blizzard</li>
<li>APT44</li>
</ul>
</li>
<li>Cyber Army of Russia Reborn (CARR)
<ul>
<li>CyberArmy of Russia</li>
<li>Народная CyberАрмия (НКА)</li>
<li>People’s CyberArmy of Russia (PCA)</li>
<li>Russian CyberArmy Team (RCAT)</li>
</ul>
</li>
<li>NoName057(16)
<ul>
<li>NoName057(16) Spain</li>
<li>NoName057(16) Italy</li>
<li>NoName057(16) France</li>
</ul>
</li>
<li>Z-Pentest
<ul>
<li>Z-Pentest Beograd</li>
<li>Z-Pentest Alliance</li>
<li>Z-Alliance</li>
</ul>
</li>
</ul>]]></content:encoded>
</item>
<item>
<title><![CDATA[Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure]]></title>
<description><![CDATA[Advisory at a Glance



Title
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure


Original Publication
April 7, 2026


Last Update 
July 22, 2026


Executive Summary
The authoring agencies urgently warn U.S. organizations of ongoing Iranian-a...]]></description>
<link>https://tsecurity.de/de/3693379/sicherheitsluecken/iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693379/sicherheitsluecken/iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure/</guid>
<pubDate>Sat, 25 Jul 2026 09:12:34 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h2><strong>Advisory at a Glance</strong></h2>
<table>
<tbody>
<tr>
<th>Title</th>
<td>Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure</td>
</tr>
<tr>
<th>Original Publication</th>
<td><strong>April 7, 2026</strong></td>
</tr>
<tr>
<th>Last Update </th>
<td><strong>July 22, 2026</strong></td>
</tr>
<tr>
<th>Executive Summary</th>
<td>The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs). These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.</td>
</tr>
<tr>
<th>Last Update Description</th>
<td>This update adds new guidance on detecting malicious changes in reusable code modules exploited within Rockwell Automation PLC programs. It also expands scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practices for secure deployment.</td>
</tr>
<tr>
<th>Affected Products</th>
<td>Potentially all internet exposed PLCs, including Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and other branded/manufactured PLCs.</td>
</tr>
<tr>
<th>Key Actions</th>
<td>
<ul type="square">
<li>Install PLCs consistent with manufacturers' guidelines and security best practices.</li>
<li>Remove PLCs from direct internet exposure via secure gateway and firewall; work with IT/OT team members and/or integrators to perform this action.</li>
<li>Query available logs for the provided indicators of compromise (IOCs) and check available logs for suspicious traffic on the ports associated with OT devices, including <code>44818</code>, <code>2222</code>, <code>102</code>, and <code>502</code>, especially traffic originating from foreign hosting providers.</li>
<li>For Rockwell Automation devices, place the physical mode switch on the controller into run position. If you suspect your organization was targeted, including against other branded PLC devices, contact the authoring agencies and PLC manufacturer for guidance.</li>
</ul>
</td>
</tr>
<tr>
<th>Indicators of Compromise</th>
<td>
<p>For a downloadable copy of July 22, 2026<strong> </strong>IOCs, see:</p>
<ul>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.xml">AA26-097A STIX XML</a> (July 2026) (29 KB)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.json">AA26-097A STIX JSON</a> (July 2026) (30 KB)</li>
</ul>
<p>For a downloadable copy of historical April 7, 2026 IOCs, see:</p>
<ul>
<li><a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.xml" title="AA26-097A STIX XML">AA26-097A STIX XML</a> (36 KB)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.json" title="AA26-097A STIX JSON">AA26-097A STIX JSON</a> (12 KB)<br> </li>
</ul>
</td>
</tr>
<tr>
<th>Intended Audience</th>
<td>
<p><strong>Organizations:</strong> Critical Infrastructure</p>
<p><strong>Sectors: </strong><a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-services-facilities-sector" title="Government Services and Facilities">Government Services and Facilities</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">Water and Wastewater Systems</a> (WWS), and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy">Energy</a> </p>
<p><strong>Roles: </strong>Integrators, asset owners, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/defensive-cybersecurity" title="Defensive cybersecurity analysts">defensive cybersecurity analysts</a>, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/operational-technology-ot-cybersecurity-engineering" title="OT cybersecurity engineers">OT cybersecurity engineers</a>, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/cybersecurity-architecture" title="cybersecurity architects">cybersecurity architects</a>, <a href="https://niccs.cisa.gov/tools/nice-framework/work-role/secure-systems-development" title="secure systems developer">secure systems developer</a></p>
</td>
</tr>
</tbody>
</table>
<h2><strong>Introduction</strong></h2>
<p><strong>Note:</strong><em> This advisory was originally published on April 7, 2026, to provide tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) related to ongoing cyber exploitation of internet-connected operational technology (OT) devices by</em> <em>Iranian-affiliated advanced persistent threat (APT) actors. The authoring agencies updated this advisory on July 22, 2026, to add new guidance on detecting malicious changes in reusable code modules leveraged within Rockwell Automation PLC programs. It also expands the manufacturer scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded/manufactured PLCs, emphasizing the importance of restricting direct internet access and providing best practice resources for secure deployment.</em></p>
<p>The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), Department of Energy (DOE), United States Cyber Command – Cyber National Mission Force (CNMF), and Department of the Treasury (Treasury) (hereafter referred to as the “authoring agencies”) are urgently warning U.S. organizations of ongoing cyber exploitation of internet-connected OT devices—including PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs—across multiple U.S. critical infrastructure sectors. As a result of this activity, organizations from multiple U.S. critical infrastructure sectors experienced disruptions through malicious interactions with PLC project files<a href="https://www.cisa.gov/#Note1"><sup>1</sup></a> and the manipulation of data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. In a few cases, this activity caused operational disruption and financial loss.</p>
<p>The authoring agencies assess a group of Iranian-affiliated APT actors is conducting this activity to cause disruptive effects within the United States. The group targeted devices spanning multiple U.S. critical infrastructure sectors, including <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-services-facilities-sector" title="Government Services and Facilities">Government Services and Facilities</a> (to include local municipalities), <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">Water and Wastewater Systems</a> (WWS), and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy">Energy</a> Sectors. The authoring agencies previously reported on similar activity targeting PLCs by <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="CyberAv3ngers">CyberAv3ngers</a> (aka Shahid Kaveh Group)—a cyber threat actor affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC).</p>
<p>Due to the widespread use of these PLCs, and the potential for additional targeting of other branded OT devices across critical infrastructure, the authoring agencies recommend U.S. organizations urgently review the TTPs and IOCs in this advisory for indications of current or historical activity on their networks, and apply the recommendations listed in the <a href="https://www.cisa.gov/#Mitigations"><strong>Mitigations</strong></a> section of this advisory to reduce the risk of compromise.</p>
<p>If owners and operators discover an affected internet-accessible device in their environment, additional technical measures may be necessary to evaluate the risk of compromise. Please engage your cyber incident response plans and contact the authoring agencies and applicable vendors through existing support channels available to customers and integrators (see <a href="https://www.cisa.gov/#Contact"><strong>Contact Information</strong></a>) to receive support, mitigation, and investigation assistance.</p>
<p>For more information on Iranian malicious cyber activity, see CISA’s <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran" title="Iran Cyber Threat Overview and Advisories">Iran Threat Overview and Advisories</a> webpage and the FBI’s <a href="https://www.fbi.gov/investigate/counterintelligence/the-iran-threat" target="_blank" title="Iran Threat">Iran Threat</a> and Iran <a href="https://www.fbi.gov/investigate/cyber/cyber-threat-overview-iran" target="_blank" title="Iran Cyber Threat">Cyber Threat Overview</a> webpages.</p>
<p>Download the PDF version of this report:</p>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2026-07/aa26-097a-iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure_508c.pdf" class="c-file__link" target="_blank">Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure</a>
    <span class="c-file__size">(PDF,       1.09 MB
  )</span>
  </div>
</div>
<p><em><strong>(New, July 22, 2026)</strong></em> For a downloadable copy of July 22, 2026<strong> </strong>IOCs, see:</p>
<ul type="square">
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.xml">AA26-097A STIX XML</a> (XML, 29 KB)</li>
<li><a href="https://www.cisa.gov/sites/default/files/2026-07/AA26-097A.stix_.json">AA26-097A STIX JSON</a> (JSON, 30 KB)</li>
</ul>
<p>For a downloadable copy of historical April 7, 2026 IOCs, see:</p>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.xml" class="c-file__link" target="_blank">AA26-097A.stix_.xml</a>
    <span class="c-file__size">(XML,       35.97 KB
  )</span>
  </div>
</div>





<div class="c-file">
    <div class="c-file__download">
    <a href="https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.json" class="c-file__link" target="_blank">AA26-097A.stix_.json</a>
    <span class="c-file__size">(JSON,       11.87 KB
  )</span>
  </div>
</div>
<h2><strong>Background Information</strong></h2>
<h3><strong>Similar Historical Activity Targeting Programmable Logic Controllers</strong></h3>
<p>During a similar campaign beginning in November 2023, the IRGC CEC-affiliated cyber threat actors known as "CyberAv3ngers” targeted U.S.-based PLCs and HMIs, causing disruptive effects. Private industry and open sources also refer to this group as Hydro Kitten, Storm-0784, APT Iran, Bauxite, Mr. Soul, Soldiers of Solomon, UNC5691, and the Shahid Kaveh Group. These attacks compromised at least 75 devices, targeting U.S.-based Unitronics PLC devices with an HMI used across multiple critical infrastructure sectors, including the WWS. APT actors developed and deployed custom ladder logic code to these devices, replacing the valid ladder logic with malicious code that continues to be observed to date.</p>
<p>For more information on this group’s activity, see the joint Cybersecurity Advisory <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities">IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities</a>.</p>
<h3><strong>Ongoing Threat Actor Activity Against U.S.-Based Programmable Logic Controllers</strong></h3>
<p>The FBI observed Iranian-affiliated APT actors targeting internet-exposed PLCs with the intent to cause disruptions—including maliciously interacting with project files, and manipulating data displayed on HMI and SCADA displays—to U.S. critical infrastructure organizations. Iranian-affiliated APT targeting campaigns against U.S. critical infrastructure have recently escalated, likely in response to hostilities between Iran, and the United States and Israel.</p>
<p><em><strong>(New, July 22, 2026) </strong></em>At one U.S. victim, the FBI observed the APT actors download a malicious project file to a targeted PLC using configuration software. Analysis indicated the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters in the victim’s environment.</p>
<p>Since at least March 2026, the authoring agencies identified (through engagements with victim organizations) an Iranian-affiliated APT group disrupted the function of PLCs. Organizations across several U.S. critical infrastructure sectors (including <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/government-services-facilities-sector" title="Government Services and Facilities">Government Services and Facilities</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems">WWS</a>, and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy">Energy</a> Sectors) deployed these PLCs within a wide variety of industrial automation processes. Some of the victims experienced operational disruption and financial loss.</p>
<h2><strong>Technical Details</strong></h2>
<p><strong>Note:</strong> This advisory uses the <a href="https://attack.mitre.org/versions/v19/matrices/enterprise/" target="_blank" title="MITRE ATTACK Matrix for Enterprise">MITRE ATT&amp;CK<sup>®</sup> Matrix for Enterprise</a> framework, version 19. See the <a href="https://www.cisa.gov/#MITRE"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a> section of this advisory for tables of the threat actors’ activity mapped to MITRE ATT&amp;CK tactics and techniques.</p>
<h3><strong>Initial Access</strong></h3>
<p><em><strong>(Updated, July 22, 2026)</strong></em> The authoring agencies observed Iranian-affiliated APT actors using several foreign-based IP addresses to access internet-facing PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other manufactured PLCs [<a href="https://attack.mitre.org/versions/v19/techniques/T0883/" target="_blank" title="T0883">T0883</a>]. The actors used leased, third-party hosted infrastructure and manufacturers’ PLC programming software to connect to misconfigured victim PLCs. Inbound malicious traffic has been observed targeting PLC devices on the following ports: <code>44818</code>, <code>2222</code>, <code>102</code>, and <code>502</code>, as well as targeting modems on port <code>22</code>. Targeted devices include:</p>
<ul type="square">
<li><strong>Rockwell Automation:</strong> CompactLogix and Micro850 PLCs</li>
<li><strong>Schneider Electric:</strong> BMX P34/Modicon M340 PLCs</li>
<li><strong>Siemens:</strong> S7-1200 series PLCs</li>
</ul>
<h3><strong>Command and Control</strong></h3>
<p><em><strong>(Updated, July 22, 2026)</strong></em> The targeting of ports [<a href="https://attack.mitre.org/versions/v19/techniques/T0885/" target="_blank" title="T0885">T0885</a>] associated with other OT vendors’ protocols suggests these actors are opportunistically targeting devices manufactured by companies other than Rockwell Automation/Allen-Bradley, including Schneider Electric and Siemens. In one reported instance, the actors utilized Dropbear Secure Shell (SSH) software on victim modems to enable them to gain remote access through port <code>22</code> [<a href="https://attack.mitre.org/versions/v19/techniques/T1219/" target="_blank" title="T1219">T1219</a>].</p>
<h3><strong>Exfiltration</strong></h3>
<p><em><strong>(New, July 22, 2026) </strong></em>The authoring agencies observed Iranian-affiliated APT actors using configuration software—such as Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ Totally Integrated Automation (TIA) Portal—on leased, third-party hosted infrastructure to exfiltrate device project files from PLC devices to threat-actor-controlled infrastructure [<a href="https://attack.mitre.org/versions/v19/techniques/T1041/" target="_blank" title="T1041">T1041</a>].</p>
<h3><strong>Impact</strong></h3>
<p><em><strong>(Updated, July 22, 2026)</strong></em> After the actors extracted device project files, the FBI and CISA identified the modification and deletion of project file logic, to include Add-On Instructions (AOIs) and data manipulation on HMI and SCADA displays [<a href="https://attack.mitre.org/versions/v19/techniques/T1565/" target="_blank" title="T1565">T1565</a>]. Additionally, the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies.</p>
<p><strong>Note:</strong> An AOI is analogous to a “Function Block” or “User Defined Function Block” used in other PLC vendor programs.</p>
<h2><strong>Indicators of Compromise</strong></h2>
<p>See <a href="https://www.cisa.gov/#Table1"><strong>Table 1</strong></a><strong> </strong>and <a href="https://www.cisa.gov/#Table2"><strong>Table 2</strong></a> for recent IP addresses used by the Iranian-affiliated APT actors to communicate with PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens in the United States.</p>
<p><strong>Disclaimer:</strong> The FBI observed the threat actors using the IP addresses listed below in the specified time frames. This data is being provided for customers to query against logs for indications of historical targeting by the Iranian-affiliated APT actors. The authoring agencies recommend organizations investigate or vet these IP addresses prior to taking action, such as blocking.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 1. Indicators of Compromise <em><strong>(New, July 22, 2026)</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Indicator</th>
<th role="columnheader">Beginning of Actor Association</th>
<th role="columnheader">End of Actor Association</th>
</tr>
</thead>
<tbody>
<tr>
<td>185.82.73[.]175</td>
<td>September 2025</td>
<td>February 2026</td>
</tr>
<tr>
<td>141.11.164[.]153</td>
<td>January 2026</td>
<td>June 2026</td>
</tr>
<tr>
<td>175.110.121[.]42</td>
<td>February 2026</td>
<td>March 2026</td>
</tr>
<tr>
<td>175.110.121[.]39</td>
<td>February 2026</td>
<td>March 2026</td>
</tr>
<tr>
<td>175.110.121[.]41</td>
<td>February 2026</td>
<td>March 2026</td>
</tr>
<tr>
<td>175.110.121[.]107</td>
<td>February 2026</td>
<td>February 2026</td>
</tr>
<tr>
<td>192.142.54[.]79</td>
<td>May 2026</td>
<td>June 2026</td>
</tr>
<tr>
<td>84.200.205[.]165</td>
<td>May 2026</td>
<td>June 2026</td>
</tr>
<tr>
<td>185.225.17[.]225</td>
<td>June 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>79.133.46[.]209</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>88.80.150[.]199</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>88.80.150[.]200</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
<tr>
<td>88.80.150[.]202</td>
<td>July 2026</td>
<td>July 2026</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 2. Indicators of Compromise </caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Indicator</th>
<th role="columnheader">Beginning of Actor Association</th>
<th role="columnheader">End of Actor Association</th>
</tr>
</thead>
<tbody>
<tr>
<td>185.82.73[.]162</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]164</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]165</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]167</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]168</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]170</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>185.82.73[.]171</td>
<td>January 2025</td>
<td>March 2026</td>
</tr>
<tr>
<td>135.136.1[.]133</td>
<td>March 2026</td>
<td>March 2026</td>
</tr>
</tbody>
</table>
<h2><a class="ck-anchor"></a><a class="ck-anchor"><strong>MITRE ATT&amp;CK Tactics and Techniques</strong></a></h2>
<p>See <a href="https://www.cisa.gov/#Table3"><strong>Table 3</strong></a> to <a href="https://www.cisa.gov/#Table6"><strong>Table 6</strong></a><strong> </strong>for all referenced threat actor tactics and techniques in this advisory. The authoring agencies recommend organizations review historical TTPs for similar Iranian-affiliated cyber actor activity in <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities">IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities</a>. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;CK framework, see CISA and MITRE ATT&amp;CK’s <a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;CK Mapping">Best Practices for MITRE ATT&amp;CK Mapping</a> and CISA’s <a href="https://github.com/cisagov/Decider/" title="Decider Tool">Decider Tool</a>.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 3. Initial Access</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Internet Accessible Device</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T0883/" target="_blank" title="T0833">T0883</a></td>
<td>The actors accessed and interacted with publicly exposed, internet-accessible PLCs that lacked sufficient network and/or hardening security controls.</td>
</tr>
</tbody>
</table>
<p> </p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 4. Command and Control</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Commonly Used Port</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T0885/" target="_blank" title="T0885">T0885</a></td>
<td>The actors leveraged commonly used OT ports to communicate with PLCs.</td>
</tr>
<tr>
<td>Remote Access Tools </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1219/" target="_blank" title="T1219">T1219</a></td>
<td>The actors deployed Dropbear SSH software on victim modems to enable them to gain remote access through port <code>22</code>.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 5. Exfiltration <em><strong>(New, July 22, 2026)</strong></em></caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exfiltration Over C2 Channel</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1041/" target="_blank" title="T1041">T1041</a></td>
<td>The actors used remote, third-party hosted infrastructure as a C2 channel to transfer device project files out of victim environments.</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption><a class="ck-anchor"></a>Table 6. Impact</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">Technique Title</th>
<th role="columnheader">ID</th>
<th role="columnheader">Use</th>
</tr>
</thead>
<tbody>
<tr>
<td>Data Manipulation</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1565/" target="_blank" title="T1565">T1565</a></td>
<td>The actors maliciously interacted with project files, including modifying and deleting project file logic, and altered data displayed on HMI and SCADA displays.</td>
</tr>
</tbody>
</table>
<h2><a class="ck-anchor"><strong>Mitigations</strong></a></h2>
<p>The authoring agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the <a href="https://www.cisa.gov/cpg" title="Cross-Sector Cybersecurity Performance Goals (CPGs)">Cross-Sector Cybersecurity Performance Goals (CPGs)</a> developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s <a href="https://www.cisa.gov/cpg" title="CPGs webpage">CPGs webpage</a> for more information on the CPGs, including additional recommended baseline protections.</p>
<h3><strong>Network Defenders</strong></h3>
<p>The cyber threat actors accessed PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric, Siemens, and potentially other branded/manufactured PLCs to cause disruptions to victim systems. To safeguard against this threat and threats to other types of PLCs, the authoring agencies urge organizations to consider the following mitigations.</p>
<p><em><strong>(Updated, July 22, 2026)</strong></em> In addition to contacting the authoring agencies, organizations and integrators operating PLCs from the manufacturers mentioned in this advisory should review the previously issued guidance to strengthen the security of their OT deployments:</p>
<ul type="square">
<li><strong>Rockwell Automation:</strong> Contact the Rockwell Automation Product Security Incident Response Team (PSIRT) at <a href="mailto:PSIRT@rockwellautomation.com">PSIRT@rockwellautomation.com</a> for questions regarding this guidance, or to report cyber incidents related to Rockwell Automation products.<br>
<ul type="circle">
<li>Refer to Rockwell Automation Security Advisory <a href="https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1771.html" target="_blank" title="SD1771">SD1771</a> for recommended PLC hardening measures and configuration guidance.</li>
</ul>
</li>
<li><strong>Schneider Electric:</strong> Contact the Schneider Electric Corporate Product Cyber Emergency Response Team (CPCERT) at <a href="mailto:cpcert@se.com">cpcert@se.com</a> for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.<br>
<ul type="circle">
<li>Refer to Schneider Electric’s <a href="https://download.se.com/files?p_File_Name=Cybersecurity_Best+Practices_EN.pdf&amp;p_Doc_Ref=7EN52-0390&amp;p_enDocType=White+Paper" target="_blank" title="Recommended Cybersecurity Best Practices">Recommended Cybersecurity Best Practices</a> and <a href="https://download.se.com/files?p_Doc_Ref=EIO0000001999&amp;p_enDocType=User+guide&amp;p_File_Name=EIO0000001999-13_Modicon_Controller_Platform_Cybersecurity_Guide_EN.pdf" target="_blank" title="Cybersecurity User Guide for Modicon Controller Platform">Cybersecurity User Guide for Modicon Controller Platform</a> for guidance on securing and configuring PLCs.</li>
</ul>
</li>
<li><strong>Siemens:</strong> Contact Siemens ProductCERT at <a href="mailto:productcert@siemens.com">productcert@siemens.com</a> for questions regarding this guidance, or to report cyber incidents and vulnerabilities related to Siemens products.<br>
<ul type="circle">
<li>Refer to <a href="https://cert-portal.siemens.com/productcert/html/ssb-104599.html" target="_blank" title="Siemens Security Bulletin 104599">Siemens Security Bulletin 104599</a> for a list of security measures to harden PLCs and in-depth configuration guides.</li>
<li>Siemens users should review the <a href="https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf" target="_blank" title="Cybersecurity for Industry Operational Guidelines">Cybersecurity for Industry Operational Guidelines</a> and implement defense-in-depth controls within their automation systems.</li>
</ul>
</li>
</ul>
<p><strong>Immediate steps to prevent the attack:</strong></p>
<ul type="square">
<li><strong>Disconnect the PLC from the public-facing internet</strong> [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#SecureInternetFacingDevices3S" title="CPG 3.S">CPG 3.S</a>]. Follow the joint guidance <a href="https://www.ncsc.gov.uk/collection/operational-technology/secure-connectivity" target="_blank" title="Secure Connectivity Principles for OT">Secure connectivity principles for OT</a> to safely allow remote access. Specifically, “remove inbound port exposure,” so the OT system is never directly exposed to the internet or external networks, and to ensure all access is mediated, monitored, and controlled. Do this through a secure gateway (jump host) that brokers the connection.<br>
<ul type="circle">
<li>Ensure cellular modems, used for remote field connectivity and access, are secured with strong authentication and updated.</li>
<li>Enable logs for connected modems and regularly review for suspicious activity to detect intrusions and improve incident response speed.</li>
<li><em><strong>(New, July 22, 2026) </strong></em>To mitigate unauthorized access to OT via cellular modems, organizations should consider implementing isolated architectures, such as private Access Point Name (APN), 5G Public Network Integrated Non-Public Network (PNI-NPN), cellular Software-Defined Wide Area Network (SD-WAN), Zero Trust Network Access (ZTNA), or a site-to-site virtual private network (VPN).</li>
</ul>
</li>
<li><em><strong>(New, July 22, 2026) </strong></em><strong>Strictly control network access to PLC devices.</strong><br>
<ul type="circle">
<li>Configure firewall rules or access control list (ACL) security features on PLCs or programmable controllers to allow only authorized communications between expected control system devices. Block access from unauthorized or threat actor-controlled IP addresses, such as those associated with hosting providers.</li>
</ul>
</li>
<li><strong>For controllers with a physical mode switch, place the physical mode switch into run position to prevent remote modification. </strong>Devices should only be in the program or remote position when updating or downloading software online and immediately switched back to the run position when complete. (See Rockwell Automation’s<a href="https://www.cisa.gov/#Note2"><sup>2</sup></a><sup> </sup><a href="https://literature.rockwellautomation.com/idc/groups/literature/documents/rm/secure-rm001_-en-p.pdf" target="_blank" title="System Security Design Guidelines">System Security Design Guidelines</a> for manufacturer’s instructions.)<br>
<ul type="circle">
<li><em><strong>(New, July 22, 2026)</strong> </em>Prior to switching the device to run mode, review and validate project files, as changing modes will lock in the current project file downloaded to the device.</li>
</ul>
</li>
<li><strong>For devices that allow software key switching, </strong>enable programming protection in PLC configuration software (S7 TIA Portal) to limit who can modify PLCs remotely. (See Siemens’ <a href="https://assets.new.siemens.com/siemens/assets/api/uuid:c9a2de6e-6bd0-4c32-bba0-f64cac44fcc9/industrial-security-operational-guidelines-en.pdf" target="_blank" title="Cybersecurity for Industry Operational Guidelines">Cybersecurity for Industry Operational Guidelines</a> for the manufacturer’s instructions.)</li>
</ul>
<p><strong>Follow-up steps to strengthen security posture:</strong></p>
<ul type="square">
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Review project files running on PLCs for unauthorized changes.</strong> Use vendor-provided integrity checking tools and visually compare the running program to known good logic. Ensure reusable logic and input/output configurations are valid. For Rockwell Automation PLCs listed in the <a href="https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1771.html" target="_blank" title="Customer Guidance to Disconnect Devices from the Internet">Customer Guidance to Disconnect Devices from the Internet</a>, check the AOIs for any anomalous modifications.<br>
<ul type="circle">
<li>If restoring from backups, verify the backup does not contain malicious logic before deployment.</li>
<li>Review logs and configurations on all connected devices, including modems, HMIs, and workstations, to assess potential lateral movement by threat actors. If it appears the actors connected to additional devices, reimage these devices to remove any potential malicious changes or access tools.</li>
</ul>
</li>
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Ensure device passwords are changed from their default </strong>and are configured to use complex, unique combinations of letters, numbers, and symbols that are not easily guessable. Implementing robust password practices remains a critical security measure that can help prevent unauthorized access and strengthen the overall security posture of OT devices.</li>
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Take defensive measures to minimize the risk of exploitation. </strong>Conduct comprehensive impact analysis and risk assessments prior to deploying defensive measures.</li>
<li><strong>Create and test strong backups of the logic and configurations of PLCs</strong>. Store backup files offline and secure the physical removal media to enable fast recovery.</li>
<li><strong>Implement multifactor authentication</strong> <strong>(MFA)</strong> [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementMultifactorAuthentication3F" title="CPG 3.F">CPG 3.F</a>] for access to the OT network from an external network.</li>
<li>If remote access is required, <strong>implement a network proxy, gateway, firewall, and/or VPN in front of the PLC to control network access</strong>.<br>
<ul type="circle">
<li>A VPN or gateway device can enable MFA for remote access even if the PLC does not support MFA. Implement security rules on these higher-level network security mechanisms to prevent the type of repeated and sustained login attempts seen during a brute force attack. When possible, implement a device control list for workstations sending messages or connecting to OT components.</li>
<li>Use the device control list to monitor for logon activity for unexpected or unusual access to devices from the internet.</li>
</ul>
</li>
<li><strong>Keep PLC devices updated with the latest software patches issued by the manufacturer.</strong> Use established downtime windows to install patches. <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities">Known Exploited Vulnerabilities</a> may need to be prioritized outside a downtime window.</li>
<li><strong>Configure external and internal firewalls to block traffic using common ports </strong>associated with network protocols that are unnecessary for the particular network segment.</li>
<li><strong>Disable any unused authentication methods, logic, or features, </strong>such as default authentication keys and passwords, as well as unused or needed services such as Teletype Network (Telnet), File Transfer Protocol (FTP), Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), and web services.</li>
<li><strong>Monitor asset management systems for device configuration changes</strong>, which can be used to understand expected parameter settings.</li>
<li><strong>Monitor the content of network traffic</strong> for the following:<br>
<ul type="circle">
<li>Unusual logins to internet-connected devices or unexpected protocols to/from the internet. </li>
<li>Functions of industrial control systems management protocols that change an asset’s operating mode or modify programs.</li>
</ul>
</li>
<li><em><strong>(New, July 22, 2026)</strong> </em><strong>Ensure service providers are informed of active threats targeting internet-connected PLC devices. </strong>Owners and operators should communicate directly with service providers to address risks, especially when remote monitoring or maintenance is involved. Some service providers may rely on internet connectivity essential to monitor and maintain OT/ICS operations but may not be fully aware of active threats.</li>
</ul>
<p>In addition, the authoring agencies recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques, as well as reduce the impact and risk of compromise by cyber threat actors:</p>
<ul type="square">
<li><strong>Reduce risk exposure</strong>. CISA offers a range of services at no cost, including scanning and testing, to help organizations reduce exposure to threats via mitigating attack vectors. CISA’s <a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services">Cyber Hygiene Services</a> can help provide additional review of organizations’ internet-accessible assets. </li>
</ul>
<h3><strong>Device Manufacturers</strong></h3>
<p><strong>Note:</strong> The following guidance is general in nature and not specific to any OT vendor. Some of the features, settings, and practices may already be offered by certain vendors. The inclusion of this guidance should not be interpreted as an assertion that vendors referenced do not offer such security features. Also, this advisory is not highlighting a new vulnerability in the identified products, but instead discusses opportunistic targeting. Device manufacturers can make opportunistic attacks more difficult at scale by encouraging more secure behavior by default and in operations, as discussed below. </p>
<p>Although critical infrastructure organizations using PLC devices can take steps to mitigate the risks, it is ultimately the responsibility of the device manufacturer to build products secured by design and default. The authoring agencies urge device manufacturers to take ownership of their customers’ security outcomes by following the principles in the joint guide <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products</a>, primarily:</p>
<ul>
<li>Change the manufacturers’ default settings to prevent exposing administrative interfaces to the internet.</li>
<li>Do not charge additional fees for basic security features needed to operate the product securely.</li>
<li>Support MFA, including via phishing-resistant methods.</li>
</ul>
<p>By using secure by design tactics, software manufacturers can make product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing tiered security software and logs, monitoring, and making routine updates.</p>
<p>For more information on common misconfigurations and guidance on reducing their prevalence, see joint advisory <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a" title="NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations">NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations</a>. For more information on secure by design, see CISA’s <a href="https://www.cisa.gov/securebydesign" title="Secure by Design">Secure by Design</a> webpage and joint guide.</p>
<h2><strong>Validate Security Controls</strong></h2>
<p>In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&amp;CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&amp;CK techniques described in this advisory.</p>
<p>To get started:</p>
<ol>
<li>Select an ATT&amp;CK technique described in this advisory (see<strong> </strong><a href="https://www.cisa.gov/#Table3"><strong>Table 3</strong></a> to <a href="https://www.cisa.gov/#Table6"><strong>Table 6</strong></a>).</li>
<li>Align your security technologies against the technique.</li>
<li>Test your technologies against the technique.</li>
<li>Analyze your detection and prevention technologies’ performance.</li>
<li>Repeat the process for all security technologies to obtain a set of comprehensive performance data.</li>
<li>Tune your security program, including people, processes, and technologies, based on the data generated by this process.</li>
</ol>
<p>The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the ATT&amp;CK techniques identified in this advisory.</p>
<h2><strong>Resources</strong></h2>
<ul type="square">
<li>Authoring Agencies: <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a" title="IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities">IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities</a></li>
<li>CISA: <a href="https://www.cisa.gov/resources-tools/resources/bulletproof-defense-mitigating-risks-bulletproof-hosting-providers" title="Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers">Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers</a></li>
<li>EPA: <a href="https://www.epa.gov/cyberwater/epa-cybersecurity-water-sector" target="_blank" title="Cybersecurity for the Water Sector">Cybersecurity for the Water Sector</a></li>
<li>CISA: <a href="https://www.cisa.gov/water" title="Water and Wastewater Cybersecurity">Water and Wastewater Cybersecurity</a></li>
<li>CISA: <a href="https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems" title="Exploitation of Unitronics PLCs used in Water and Wastewater Systems">Exploitation of Unitronics PLCs used in Water and Wastewater Systems</a></li>
<li>CISA: <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran" title="Iran Cyber Threat Overview and Advisories">Iran Threat Overview and Advisories</a></li>
<li>FBI: <a href="https://www.fbi.gov/investigate/counterintelligence/the-iran-threat" target="_blank" title="The Iran Threat">The Iran Threat</a> and <a href="https://www.fbi.gov/investigate/cyber/cyber-threat-overview-iran" target="_blank" title="Cyber Threat Overview: Iran">Cyber Threat Overview: Iran</a></li>
<li>CISA, MITRE: <a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;CK Mapping">Best Practices for MITRE ATT&amp;CK Mapping</a></li>
<li>CISA: <a href="https://github.com/cisagov/Decider/" title="Decider Tool">Decider Tool</a></li>
<li>CISA: <a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0" title="Cross-Sector Cybersecurity Performance Goals 2.0">Cross-Sector Cybersecurity Performance Goals 2.0</a></li>
<li>CISA: <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/cyber-hygiene-services" title="No-Cost Cybersecurity Services and Tools">No-Cost Cybersecurity Services and Tools</a></li>
<li>CISA: <a href="https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting" title="Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products">Secure by Demand: Priority Considerations for OT Owners and Operators when Selecting Digital Products</a></li>
<li>NSA, CISA: <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a" title="NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations">NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations</a></li>
<li>CISA: <a href="https://www.cisa.gov/securebydesign" title="Secure by Design">Secure by Design</a></li>
<li>FBI, CISA: <a href="https://www.ic3.gov/CSA/2025/250506.pdf" target="_blank" title="Primary Mitigations to Reduce Cyber Threats to Operational Technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a></li>
<li>United Kingdom National Cyber Security Centre: <a href="https://www.ic3.gov/CSA/2026/260114.pdf" target="_blank" title="Secure Connectivity Principles for Operational Technology (OT)">Secure connectivity principles for operational technology</a></li>
</ul>
<h2><a class="ck-anchor"><strong>Contact Information</strong></a></h2>
<p>U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA, the FBI, and/or NSA:</p>
<ul type="square">
<li>Contact CISA via CISA’s 24/7 Operations Center at <a href="mailto:contact@cisa.dhs.gov">contact@cisa.dhs.gov</a> or 1-844-Say-CISA (1-844-729-2472). File a claim with FBI’s <a href="https://ic3.gov/" target="_blank" title="Internet Crime Complaint Center (IC3)">Internet Crime Complaint Center (IC3)</a> or contact your local <a href="https://www.fbi.gov/contact-us/field-offices" target="_blank" title="FBI field office">FBI field office</a>. When available, please include the following information regarding the incident: 
<ul>
<li>Date, time, and location of the incident;</li>
<li>Type of activity;</li>
<li>Number of people affected;</li>
<li>Type of equipment used for the activity; and</li>
<li>Name of the submitting company or organization, and a designated point of contact.</li>
</ul>
</li>
<li>For NSA cybersecurity guidance inquiries, contact <a href="mailto:CybersecurityReports@nsa.gov" title="CybersecurityReports@nsa.gov">CybersecurityReports@nsa.gov</a>.</li>
<li>Entities required to report incidents to DOE should follow established reporting requirements, as appropriate. For other energy sector inquiries, contact <a href="mailto:EnergySRMA@hq.doe.gov" title="EnergySRMA@hq.doe.gov">EnergySRMA@hq.doe.gov</a>.</li>
<li>Contact the Rockwell Automation PSIRT for questions regarding their guidance or for reporting cyber incidents related to Rockwell Automation products at <a href="mailto:PSIRT@rockwellautomation.com" title="PSIRT@rockwellautomation.com">PSIRT@rockwellautomation.com</a>.</li>
<li>Contact the Schneider Electric CPCERT at <a href="mailto:cpcert@se.com">cpcert@se.com</a> for questions regarding this guidance, or to report cyber incidents related to Schneider Electric products.</li>
<li>Contact Siemens ProductCERT for up-to-date information about the security of Siemens products or to report cybersecurity vulnerabilities at <a href="mailto:productcert@siemens.com">productcert@siemens.com</a>. For support with increasing the security of installed Siemens PLCs, contact Siemens Industrial Cybersecurity Services at <a href="mailto:services.automation@siemens.com">services.automation@siemens.com</a>. See <a href="https://www.siemens.com/en-us/content/cert-services/" target="_blank" title="Siemens ProductCERT and Siemens CERT">Siemens ProductCERT and Siemens CERT</a> for more information.</li>
</ul>
<h2><strong>Disclaimer</strong></h2>
<p>The information in this report is being provided “as is” for informational purposes only. CISA and the authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and the authoring agencies.</p>
<h2><strong>Version History</strong></h2>
<p><strong>April 7, 2026</strong>: Initial version.</p>
<p><strong>July 22, 2026</strong>: Update includes new guidance on detecting malicious activity, expanded scope of observed targeting, and best practices for secure PLCs deployment.</p>
<h2><strong>Notes</strong></h2>
<p><a class="ck-anchor"></a><sup>1</sup>Project file refers to the software file that contains ladder logic and configuration settings. On Rockwell Automation devices, it is referred to as an .ACD file.</p>
<p><a class="ck-anchor"></a><sup>2 </sup>See <a href="https://literature.rockwellautomation.com/idc/groups/literature/documents/um/1769-um021_-en-p.pdf" target="_blank" title="CompactLogix 5370 Controllers">CompactLogix 5370 Controllers</a> (Chapter 5: “Select the Operating Mode of the Controller”) for more information on functions available for the switch.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting]]></title>
<description><![CDATA[Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors
Executive summary
Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compr...]]></description>
<link>https://tsecurity.de/de/3693346/sicherheitsluecken/improve-router-hygiene-to-protect-against-russian-state-sponsored-targeting/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693346/sicherheitsluecken/improve-router-hygiene-to-protect-against-russian-state-sponsored-targeting/</guid>
<pubDate>Sat, 25 Jul 2026 08:51:21 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors</p>
<h2><strong>Executive summary</strong></h2>
<p>Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks. This joint Cybersecurity Advisory (CSA) builds on FBI’s <a href="https://www.ic3.gov/PSA/2025/PSA250820" target="_blank">Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure</a> Public Service Announcement of the decade-plus FSB Center 16 cyber activity by providing additional tactics, techniques, and procedures (TTPs) to enable defenders to more fully understand and counter the threat. [<a href="https://www.cisa.gov/#Work1">1</a>] </p>
<p>This CSA is being released by the following authoring and co-sealing agencies: </p>
<ul type="square">
<li>United States National Security Agency (NSA)</li>
<li>United States Cybersecurity and Infrastructure Security Agency (CISA)</li>
<li>United States Federal Bureau of Investigation (FBI)</li>
<li>United States Department of Defense Cyber Crime Center (DC3)</li>
<li>Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)</li>
<li>Communications Security Establishment Canada’s (CSE’s) Canadian Centre for Cyber Security (Cyber Centre)</li>
<li>New Zealand National Cyber Security Centre (NCSC-NZ)</li>
<li>United Kingdom National Cyber Security Centre (NCSC-UK)</li>
<li>Czech Republic National Cyber and Information Security Agency (NÚKIB)<a href="https://www.cisa.gov/#Foot1"><sup>1</sup></a> </li>
<li>Danish Defence Intelligence Service (DDIS)<a href="https://www.cisa.gov/#Foot2"><sup>2 </sup></a></li>
<li>Estonian Foreign Intelligence Service (EFIS)<a href="https://www.cisa.gov/#Foot3"><sup>3</sup></a> </li>
<li>Estonian Information System Authority (RIA)<a href="https://www.cisa.gov/#Foot4"><sup>4</sup></a></li>
<li>Finnish Defence Intelligence (FDI)<a href="https://www.cisa.gov/#Foot5"><sup>5</sup></a></li>
<li>Finnish Security and Intelligence Service (SUPO)<a href="https://www.cisa.gov/#Foot6"><sup>6</sup></a></li>
<li>French National Cybersecurity Agency (ANSSI)<a href="https://www.cisa.gov/#Foot7"><sup>7</sup></a></li>
<li>Italian External Intelligence and Security Agency (AISE)<a href="https://www.cisa.gov/#Foot8"><sup>8 </sup></a></li>
<li>Italian Internal Intelligence and Security Agency (AISI)<a href="https://www.cisa.gov/#Foot9"><sup>9</sup></a></li>
<li>The Military Counterintelligence Service of Poland (SKW)<a href="https://www.cisa.gov/#Foot10"><sup>10 </sup></a></li>
<li>Sweden National Cyber Security Centre (NCSC-SE)<a href="https://www.cisa.gov/#Foot11"><sup>11 </sup></a></li>
</ul>
<p>The authoring and co-sealing agencies strongly urge device owners and network defenders to take mitigation and remediation actions against Russian government-sponsored exploitation of vulnerable routers.</p>



<figure class="c-figure c-figure--image" role="group">
  
  <div class="c-figure__media">    <img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2026-07/Figure%201%20FSB%20Center%2016%20activity%20and%20recommended%20mitigation%20actions.png?itok=oYxdyna4" width="1024" height="576" alt="Adversary Techniques and corresponding Mitigation Actions as described in the Technical details and Mitigation actions sections.">



</div>
      <figcaption class="c-figure__caption">Figure 1: FSB Center 16 activity and recommended mitigation actions</figcaption>
  </figure>
<p>Download the PDF version of this report:</p>
<ul>
<li><a href="https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/0/CSA_IMPROVE_ROUTER_HYGIENE.PDF" target="_blank">Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting</a> (PDF, 816KB)</li>
</ul>
<h2><strong>Cybersecurity industry tracking </strong></h2>
<p>The cybersecurity industry provides overlapping cyber threat intelligence, indicators of compromise (IOCs), and mitigation recommendations related to this activity. Although not all encompassing, the following list contains the most notable threat group names commonly used within the cybersecurity community related to this activity: </p>
<ul type="disc">
<li>Berserk Bear </li>
<li>Energetic Bear</li>
<li>Crouching Yeti </li>
<li>Dragonfly</li>
<li>Ghost Blizzard</li>
<li>Static Tundra</li>
</ul>
<p>Note: Cybersecurity companies have different methods of tracking and attributing cyber actors, and this list may not provide a 1:1 correlation to the authoring agencies’ understanding for all activity related to these groupings.</p>
<h2><strong>Targeting details</strong></h2>
<p>Critical infrastructure sectors most at risk from the Russian Federal Security Service (FSB) Center 16 cyber actors’ targeting include:</p>
<ul type="disc">
<li>Communications,</li>
<li>Defense Industrial Base,</li>
<li>Energy,</li>
<li>Financial Services,</li>
<li>Government Services and Facilities, especially organizations at the state and local level, and</li>
<li>Healthcare and Public Health.</li>
</ul>
<h2><strong>Technical details</strong></h2>
<p><strong>Note: </strong>This advisory uses the <a href="https://attack.mitre.org/versions/v19/matrices/enterprise/" target="_blank">MITRE ATT&amp;CK® Matrix for Enterprise</a><a href="https://www.cisa.gov/#Foot12"><sup>12</sup></a> framework, version 19. See <a href="https://www.cisa.gov/#AppA"><strong>Appendix A</strong></a> for tables of the activity mapped to MITRE ATT&amp;CK tactics and techniques. This advisory also uses MITRE DEFEND<sup>TM</sup> version 1.4.0.</p>
<p>The Russian FSB Center 16 cyber actors primarily use scanning to identify poorly configured networking devices, primarily routers, for exploitation. The actors scan for Internet IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default community strings for authentication [<a href="https://attack.mitre.org/versions/v19/techniques/T1595/001/" target="_blank">T1595.001</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1595/002/" target="_blank">T1595.002</a>]. These scans, run via proxies, consist of SNMP Set-Requests from a spoofed IP address [<a href="https://attack.mitre.org/versions/v19/techniques/T1027/" target="_blank">T1027</a>] containing Object Identifiers (OIDs) that instruct the SNMP agent on poorly configured networking devices to [<a href="https://attack.mitre.org/versions/v19/techniques/T1569/" target="_blank">T1569</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1602/001/" target="_blank">T1602.001</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a>]:</p>
<ul type="disc">
<li>Copy its configuration to a file, often called “config.bkp” or “output.txt” [<a href="https://attack.mitre.org/versions/v19/techniques/T1003/" target="_blank">T1003</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1602/002/" target="_blank">T1602.002</a>].</li>
<li>Transfer the file, typically using Trivial File Transfer Protocol (TFTP), to an actor-controlled leased virtual private server (VPS) or compromised FTP server [<a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank">T1583.003</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1071/" target="_blank">T1071</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1048/" target="_blank">T1048</a>].</li>
</ul>
<p>While SNMP scanning is the primary method the actors use to discover and exploit poorly configured networking devices, they occasionally exploit common vulnerabilities and exposures (CVEs) in Cisco devices, Cisco’s Smart Install (SMI) functionality, and web portals to manage network devices. The actors previously exploited at least the following CVEs [<a href="https://attack.mitre.org/versions/v19/techniques/T1584/008/" target="_blank">T1584.008</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1588/005/" target="_blank">T1588.005</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1190/" target="_blank">T1190</a>, <a href="https://attack.mitre.org/versions/v19/techniques/T1068/" target="_blank">T1068</a>]: </p>
<ul type="disc">
<li><a href="https://www.cve.org/CVERecord?id=CVE-2018-0171" target="_blank">CVE-2018-0171</a></li>
<li><a href="https://www.cve.org/CVERecord?id=CVE-2008-4128" target="_blank">CVE-2008-4128</a><a href="https://www.cisa.gov/#Foot13"><sup>13</sup></a></li>
</ul>
<p>Many of these TTPs overlap with activity by other malicious cyber actors, such as <a href="https://media.defense.gov/2025/Aug/22/2003786665/-1/-1/0/CSA_COUNTERING_CHINA_STATE_ACTORS_COMPROMISE_OF_NETWORKS.PDF" target="_blank">Salt Typhoon</a>. Even though this CSA focuses on Russian FSB Center 16 cyber activity, the mitigations below should detect and counter these and similar TTPs used by other actors.</p>
<h2><strong>Mitigation actions</strong></h2>
<p>The authoring agencies highly recommend network defenders implement the following mitigations to harden networks against this exploitation:</p>
<ul>
<li>Disable Cisco Smart Install on all devices [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a>]. [<a href="https://www.cisa.gov/#Work2">2</a>]</li>
<li>Use SNMPv3 with “authPriv” configured to the most modern encryption standard that is supported by the device instead of SNMPv1 or SNMPv2 [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a>]. [<a href="https://www.cisa.gov/#Work3">3</a>]
<ul>
<li>Disable SNMPv1 and SNMPv2. These are legacy protocols and should no longer be needed on current devices. If they are necessary, change all community strings from defaults and only allow read-only community strings rather than read-write access.</li>
<li>SNMPv3 adds strong authentication and data encryption that are unavailable in SNMPv1 and v2. SNMPv3 replaces clear text shared passwords, known as community strings, with more securely encoded parameters, and authenticates and encrypts data [<a href="https://d3fend.mitre.org/technique/d3f:MessageAuthentication" target="_blank">D3-MAN</a>, <a href="https://d3fend.mitre.org/technique/d3f:MessageEncryption" target="_blank">D3-MENCR</a>].</li>
</ul>
</li>
<li>Use strong, unique passwords for local accounts on network devices and configure credentials to be stored securely to prevent reuse of compromised passwords [<a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank">D3-CH</a>].
<ul>
<li>Cisco devices protect passwords in the configuration file using different hashing types. Use hashing type 8 for user credentials. Avoid using hashing type 0, 4, and 7 as they are insecure or store passwords in plaintext in the configuration file. [<a href="https://www.cisa.gov/#Work4">4</a>]</li>
<li>Monitor for unusual credentials that do not conform to standard organizational naming conventions [<a href="https://d3fend.mitre.org/technique/d3f:PlatformMonitoring" target="_blank">D3-PM</a>]. </li>
<li> Monitor for and alert on logins using local accounts. Local accounts should only be used in emergency situations when accounts supported by centralized authentication servers are unavailable. Centralized authentication to network devices should support multi-factor authentication where feasible. [<a href="https://www.cisa.gov/#Work3">3</a>]</li>
</ul>
</li>
<li>Monitor and restrict access to SNMP OIDs using a Management Information Base (MIB) allow list [<a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a>]. [<a href="https://www.cisa.gov/#Work5">5</a>] Reference the vendor-specific MIB for the network devices and monitor OIDs for indications of reconnaissance or misconfiguration in logs or intrusion detection systems (IDS). IDS rules should be written for inbound SNMP Set-Requests that contain OIDs targeting sensitive device data [<a href="https://d3fend.mitre.org/technique/d3f:PlatformMonitoring" target="_blank">D3-PM</a>].<br>
<ul type="square">
<li>Example OIDs include:
<ul>
<li>1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy)</li>
<li>1.3.6.1.4.1.9.9.96.1.1.1.1.5 (Config Copy Server Address, value for this OID is where the configuration file is being sent to) </li>
</ul>
</li>
</ul>
</li>
<li>Restrict management protocols [<a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficFiltering" target="_blank">D3-NTF</a>].
<ul>
<li>Use Access Control Lists (ACLs) to only allow management protocols, such as SNMP, from management devices, preferably on an out-of-band network. [<a href="https://www.cisa.gov/#Work3">3</a>]</li>
<li>On edge firewalls and devices deny all external communications on the following ports unless mission critical, with strict monitoring if blocking is not feasible:
<ul>
<li>User Datagram Protocol (UDP) port 69 (TFTP) </li>
<li>Transmission Control Protocol (TCP) port 4786 (SMI)</li>
<li>UDP ports 161 and 162 (SNMP)</li>
<li>TCP/UDP ports 10161 and 10162 (SNMPv3)</li>
</ul>
</li>
</ul>
</li>
<li>Update network device software and firmware images, especially to patch known vulnerabilities, and upgrade end-of-life devices to supported ones. <br>
<ul type="square">
<li>Use an attack surface management service to identify and secure Internet-facing systems with weak configurations and known vulnerabilities [<a href="https://d3fend.mitre.org/technique/d3f:NetworkVulnerabilityAssessment" target="_blank">D3-NVA</a>].
<ul>
<li>U.S.-based federal, state, local, tribal, and territorial governments and U.S. critical infrastructure organiztions should consider signing up for CISA’s no-cost <a href="https://www.cisa.gov/cyber-hygiene-services">Cyber Hygiene services</a>.</li>
<li>U.S. Defense Industrial Base organizations should consider signing up for <a href="https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/DIB-Cybersecurity-Services/" target="_blank">NSA’s DIB Cybersecurity Services</a>.</li>
</ul>
</li>
</ul>
</li>
</ul>
<h2><strong>Resources</strong></h2>
<p><strong>United States:</strong></p>
<ul type="disc">
<li><a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia">Russia Threat Overview and Advisories</a></li>
<li><a href="https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF" target="_blank">Network Infrastructure Security Guide</a></li>
</ul>
<p><strong>Canada:</strong></p>
<ul type="disc">
<li><a href="https://www.cyber.gc.ca/en/guidance/routers-cyber-security-best-practices-itsap80019" target="_blank">Routers cyber security best practices (ITSAP.80.019)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/security-considerations-edge-devices-itsm80101" target="_blank">Security considerations for edge devices (ITSM.80.101)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/guidance-securely-configuring-network-protocols-itsp40062" target="_blank">Guidance on securely configuring network protocols (ITSP.40.062)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/baseline-security-requirements-network-security-zones-version-20-itsp80022" target="_blank">Baseline security requirements for network security zones (ITSP.80.022)</a></li>
<li><a href="https://www.cyber.gc.ca/en/guidance/top-10-it-security-actions-protect-internet-connected-networks-and-information-itsm10089" target="_blank">Top 10 IT security actions to protect Internet-connected networks and information (ITSM.10.089)</a></li>
</ul>
<h2><strong>Works cited</strong></h2>
<p>[<a class="ck-anchor">1</a>] FBI. Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure. Alert Number: I-082025-PSA. 2025. <a href="https://www.ic3.gov/PSA/2025/PSA250820" target="_blank">https://www.ic3.gov/PSA/2025/PSA250820</a></p>
<p>[<a class="ck-anchor">2</a>] NSA. Cisco Smart Install Protocol Misuse. 2017. <a href="https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF" target="_blank">https://media.defense.gov/2019/Jul/16/2002157833/-1/-1/0/CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF</a></p>
<p>[<a class="ck-anchor">3</a>] NSA. Network Infrastructure Security Guide. 2023. <a href="https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF" target="_blank">https://media.defense.gov/2022/Jun/15/2003018261/-1/-1/0/CTR_NSA_NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20220615.PDF</a></p>
<p>[<a class="ck-anchor">4</a>] NSA. Cybersecurity Information Sheet Cisco Password Types: Best Practices. 2022. <a href="https://media.defense.gov/2022/Feb/17/2002940795/-1/-1/0/CSI_CISCO_PASSWORD_TYPES_BEST_PRACTICES_20220217.PDF" target="_blank">https://media.defense.gov/2022/Feb/17/2002940795/-1/-1/0/CSI_CISCO_PASSWORD_TYPES_BEST_PRACTICES_20220217.PDF</a></p>
<p>[<a class="ck-anchor">5</a>] NSA. Cybersecurity Information Sheet: Reducing the Risk of Simple Network Management Protocol (SNMP) Abuse. 2026. <a href="https://media.defense.gov/2026/Jul/09/2003959459/-1/-1/0/CSI_REDUCING_RISK_OF_SNMP_ABUSE.PDF" target="_blank">https://media.defense.gov/2026/Jul/09/2003959459/-1/-1/0/CSI_REDUCING_RISK_OF_SNMP_ABUSE.PDF</a></p>
<h2><strong>Footnotes</strong></h2>
<p><a class="ck-anchor"><sup>1</sup></a><sup>  </sup>Národní úřad pro kybernetickou a informační bezpečnost</p>
<p><a class="ck-anchor"><sup>2 </sup></a> Forsvarets Efterretningstjeneste</p>
<p><a class="ck-anchor"><sup>3</sup></a> Välisluureamet</p>
<p><a class="ck-anchor"><sup>4</sup></a> Riigi Infosüsteem Amet</p>
<p><a class="ck-anchor"><sup>5</sup></a> Sotilastiedustelu</p>
<p><a class="ck-anchor"><sup>6</sup></a> Suojelupoliisi</p>
<p><a class="ck-anchor"><sup>7</sup></a> Agence nationale de la sécurité des systèmes d’information</p>
<p><a class="ck-anchor"><sup>8</sup></a> Agenzia Informazioni e Sicurezza Esterna</p>
<p><a class="ck-anchor"><sup>9</sup></a> Agenzia Informazioni e Sicurezza Interna</p>
<p><a class="ck-anchor"><sup>10</sup></a> Służba Kontrwywiadu Wojskowego</p>
<p><a class="ck-anchor"><sup>11</sup></a> Nationellt Cybersäkerhetscenter</p>
<p><a class="ck-anchor"><sup>12</sup></a><sup> </sup>MITRE and ATT&amp;CK are registered trademarks of The MITRE Corporation. MITRE DEFEND is a trademark of the MITRE Corporation.</p>
<p><a class="ck-anchor"><sup>13</sup></a> <a href="https://www.cve.org/CVERecord?id=CVE-2008-4128" target="_blank">CVE-2008-4128</a> only affects end-of-life Cisco devices.</p>
<h2><strong>Disclaimer of Endorsement</strong></h2>
<p>The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.</p>
<h2><strong>Purpose</strong></h2>
<p>This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.</p>
<h2><strong>Contact</strong></h2>
<p><strong>United States organizations</strong></p>
<ul>
<li><strong>National Security Agency (NSA)</strong>
<ul>
<li>Cybersecurity Report Feedback: <a href="mailto:CybersecurityReports@nsa.gov">CybersecurityReports@nsa.gov</a> </li>
<li>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DIB_Defense@cyber.nsa.gov">DIB_Defense@cyber.nsa.gov</a> </li>
<li>Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, <a href="mailto:MediaRelations@nsa.gov">MediaRelations@nsa.gov</a></li>
</ul>
</li>
<li><strong>Cybersecurity and Infrastructure Security Agency (CISA)</strong> and<strong> Federal Bureau of Investigation (FBI)</strong>
<ul>
<li> U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA via the agency’s <a href="https://myservices.cisa.gov/irf" title="Incident Reporting System">Incident Reporting System</a>, its 24/7 Operations Center (<a href="mailto:report@cisa.gov">report@cisa.gov</a> or 888-282-0870), or your <a href="https://www.fbi.gov/contact-us/field-offices" target="_blank">local FBI field office</a>. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment user for the activity; the name of the submitting company or organization; and a designated point of contact. </li>
</ul>
</li>
<li><strong>United States Department of Defense Cyber Crime Center (DC3)  </strong>
<ul>
<li>Defense Industrial Base Inquiries and Cybersecurity Services: <a href="mailto:DC3.DCISE@us.af.mil">DC3.DCISE@us.af.mil</a> </li>
<li>Defense Industrial Base mandatory cyber incident reporting as required by 10 U.S. Code Sections 391 and 393 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 is submitted at <a href="https://dibnet.dod.mil/" target="_blank" title="https://dibnet.dod.mil/">https://dibnet.dod.mil</a>.</li>
<li> Media Inquiries / Press Desk: <a href="mailto:DC3.Information@us.af.mil">DC3.Information@us.af.mil</a></li>
</ul>
</li>
</ul>
<p><strong>Australian organizations</strong></p>
<ul>
<li><strong>Australian Signals Directorate</strong>
<ul>
<li>Visit <a href="https://www.cyber.gov.au/about-us/about-asd-acsc/contact-us#no-back" target="_blank">cyber.gov.au</a> or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.</li>
</ul>
</li>
</ul>
<p><strong>Canadian organizations</strong></p>
<ul type="disc">
<li>The Canadian Centre for Cyber Security (Cyber Centre), part of the Communications Security Establishment, encourages Canadian organizations to report cyber incidents and to strengthen the security of their networking devices. 
<ul>
<li>Report an incident or suspicious activity to the Cyber Centre by email at <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a>, online via the reporting tool <a href="https://www.cyber.gc.ca/en/incident-management" target="_blank">Report a cyber incident - Canadian Centre for Cyber Security</a> or by phone at 1-833-CYBER-88 (1-833-292-3788).</li>
</ul>
</li>
</ul>
<p><strong>New Zealand organizations</strong></p>
<ul type="disc">
<li>New Zealand National Cyber Security Centre (NCSC-NZ): <a href="mailto:info@ncsc.govt.nz">info@ncsc.govt.nz</a></li>
</ul>
<p><strong>United Kingdom organizations</strong></p>
<ul>
<li>Report significant cyber security incidents to <a href="https://ncsc.gov.uk/report-an-incident" target="_blank">ncsc.gov.uk/report-an-incident</a> (monitored 24/7)</li>
</ul>
<p><strong>Estonia organizations</strong></p>
<ul>
<li>Estonian Foreign Intelligence Service (EFIS): <a href="mailto:info@valisluureamet.ee">info@valisluureamet.ee</a></li>
</ul>
<p><strong>Finnish organizations</strong></p>
<ul>
<li>Finnish Security and Intelligence Service: <a href="https://supo.fi/en/contact" target="_blank">supo.fi/en/contact</a></li>
</ul>
<p><strong>French organizations</strong></p>
<ul type="disc">
<li>French organizations are encouraged to report suspicious activity or incident related information found in this advisory by contacting ANSSI/CERT-FR at: <a href="mailto:cert-fr@ssi.gouv.fr">cert-fr@ssi.gouv.fr</a> or by phone at: 3218 or +33 9 70 83 32 18.</li>
</ul>
<p><strong>Italian Organizations</strong></p>
<ul>
<li>Italian External Intelligence and Security Agency (AISE): 
<ul>
<li>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank">https://www.sicurezzanazionale.gov.it/</a> </li>
</ul>
</li>
<li>Italian Internal Intelligence and Security Agency (AISI): 
<ul>
<li>Visit <a href="https://www.sicurezzanazionale.gov.it/" target="_blank">https://www.sicurezzanazionale.gov.it/</a> </li>
</ul>
</li>
</ul>
<h2><a class="ck-anchor"><strong>Appendix A: MITRE ATT&amp;CK tactics and techniques</strong></a></h2>
<p>See <a href="https://www.cisa.gov/#Table1"><strong>Table 1</strong></a> through <a href="https://www.cisa.gov/#Table10"><strong>Table 10</strong></a> for all the threat actor tactics and techniques referenced in this advisory.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 1: Reconnaissance</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><a class="ck-anchor"></a><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Active Scanning: Scanning IP Blocks</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1595/001/" target="_blank">T1595.001</a></td>
<td>Scan range of IP addresses</td>
</tr>
<tr>
<td>Active Scanning: Vulnerability Scanning</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1595/002/" target="_blank">T1595.002</a></td>
<td>Scan victims for vulnerabilities that can be used during targeting</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 2: Resource Development</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Acquire Infrastructure: Virtual Private Servers </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1583/003/" target="_blank">T1583.003</a> </td>
<td>Leverage VPS as infrastructure </td>
</tr>
<tr>
<td>Compromise Infrastructure: Network Devices </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1584/008/" target="_blank">T1584.008</a> </td>
<td>Compromise intermediate routers </td>
</tr>
<tr>
<td>Obtain Capabilities: Exploits </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1588/005/" target="_blank">T1588.005</a> </td>
<td>Use publicly available code to exploit vulnerable devices </td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 3: Initial Access</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exploit Public-Facing Application </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1190/" target="_blank">T1190</a> </td>
<td>Exploit publicly known CVEs </td>
</tr>
<tr>
<td>Proxy</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a></td>
<td>Use a connection proxy to direct network traffic </td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 4: Execution</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>System Services</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1569/" target="_blank">T1569</a></td>
<td>Executing commands via SNMP</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 5: Privilege Escalation</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exploitation for Privilege Escalation</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1068/" target="_blank">T1068</a></td>
<td>Exploit publicly known CVEs for escalated privileges</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 6: Stealth</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Obfuscated Files or Information</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1027/" target="_blank">T1027</a></td>
<td>Obfuscate source IP addresses in system logs, as actions may be recorded as originating from local IP addresses</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 7: Credential Access</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>OS Credential Dumping</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1003/" target="_blank">T1003</a></td>
<td>Collect router configuration with weak Cisco Type 7 passwords and Type 0</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 8: Collection</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Data from Configuration Repository: SNMP (MIB Dump) </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1602/001/" target="_blank">T1602.001</a> </td>
<td>Target MIB to collect network information via SNMP </td>
</tr>
<tr>
<td>Data from Configuration Repository: Network Device Configuration Dump</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1602/002/" target="_blank">T1602.002</a></td>
<td>Acquire credentials by collecting network device configurations</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 9: Command and Control</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Proxy </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1090/" target="_blank">T1090</a> </td>
<td>Use VPS for C2 </td>
</tr>
<tr>
<td>Application Layer Protocol </td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1071/" target="_blank">T1071</a> </td>
<td>Open and expose a variety of different services, including TFTP and FTP</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 10: Exfiltration</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><a class="ck-anchor"></a><strong>Technique Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Use</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Exfiltration Over Alternative Protocol</td>
<td><a href="https://attack.mitre.org/versions/v19/techniques/T1048/" target="_blank">T1048</a></td>
<td>Exfiltrating over a different protocol than that of the existing command and control channel. </td>
</tr>
</tbody>
</table>
<h2><strong>Appendix B: MITRE D3FEND countermeasures</strong></h2>
<p>See <a href="https://www.cisa.gov/#Table11"><strong>Table 11</strong></a> for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.</p>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<caption>Table 11: MITRE D3FEND Countermeasures</caption>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">
<p class="text-align-center"><a class="ck-anchor"></a><strong>Countermeasure Title</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>ID</strong></p>
</th>
<th role="columnheader">
<p class="text-align-center"><strong>Description</strong></p>
</th>
</tr>
</thead>
<tbody>
<tr>
<td>Application Configuration Hardening</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:ApplicationConfigurationHardening" target="_blank">D3-ACH</a></td>
<td>
<ul type="disc">
<li>Use SNMPv3 and disable SNMPv1 and SNMPv2. </li>
<li>Use SNMP allowlisting to restrict access to OIDs and MIBs. </li>
<li>Disable Cisco Smart Install.</li>
</ul>
</td>
</tr>
<tr>
<td>Message Authentication</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:MessageAuthentication" target="_blank">D3-MAN</a></td>
<td>
<ul>
<li>Use SNMPv3 with strong authentication.</li>
</ul>
</td>
</tr>
<tr>
<td>Message Encryption</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:MessageEncryption" target="_blank">D3-MENCR</a></td>
<td>
<ul>
<li>Use SNMPv3 to encrypt payloads.</li>
</ul>
</td>
</tr>
<tr>
<td>Credential Hardening</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:CredentialHardening" target="_blank">D3-CH</a></td>
<td>
<ul>
<li>Use strong, unique passwords and store them securely.</li>
</ul>
</td>
</tr>
<tr>
<td>Platform Monitoring</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:PlatformMonitoring" target="_blank">D3-PM</a></td>
<td>
<ul type="disc">
<li>Monitor for unusual credentials. </li>
<li>Monitor SNMP Set-Requests for OIDs targeting sensitive device data.</li>
</ul>
</td>
</tr>
<tr>
<td>Network Traffic Filtering</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficFiltering" target="_blank">D3-NTF</a></td>
<td>
<ul type="disc">
<li>Use ACLs to only allow management protocols from management devices. </li>
<li>Block TFTP, SMI, and SNMP at edge firewalls.</li>
</ul>
</td>
</tr>
<tr>
<td>Network Vulnerability Assessment</td>
<td><a href="https://d3fend.mitre.org/technique/d3f:NetworkVulnerabilityAssessment" target="_blank">D3-NVA</a></td>
<td>
<ul>
<li>Use an attack surface management service.</li>
</ul>
</td>
</tr>
</tbody>
</table>]]></content:encoded>
</item>
<item>
<title><![CDATA[Matrix Live S12E13 – A Federated Data Marketplace]]></title>
<description><![CDATA[Author: Matrixdotorg - Bewertung: 14x - Views:370 Liberbyte is building a federated data platform over Matrix.

🌐 https://www.liberbyte.com

This Week in Matrix: https://matrix.org/twim

Find Matrix.org on the internet:
🐘 https://mastodon.matrix.org/@matrix
🤝 https://www.linkedin.com/company/matr...]]></description>
<link>https://tsecurity.de/de/3693332/videos/matrix-live-s12e13-a-federated-data-marketplace/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693332/videos/matrix-live-s12e13-a-federated-data-marketplace/</guid>
<pubDate>Sat, 25 Jul 2026 08:42:10 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Matrixdotorg - Bewertung: 14x - Views:370 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/szCfpnMKdow?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>Liberbyte is building a federated data platform over Matrix.<br />
<br />
🌐 https://www.liberbyte.com<br />
<br />
This Week in Matrix: https://matrix.org/twim<br />
<br />
Find Matrix.org on the internet:<br />
🐘 https://mastodon.matrix.org/@matrix<br />
🤝 https://www.linkedin.com/company/matrix-org<br />
🦋 https://bsky.app/profile/matrix.org<br />
[m] Office of the Matrix Foundation https://matrix.to/#/%23foundation-office:matrix.org<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Firefox Nightly: Backup for a Rainy Day – These Weeks in Firefox: Issue 202]]></title>
<description><![CDATA[Highlights

The profile backup mechanism has been enabled by default for all desktop platforms in Nightly, as well as Beta! The current plan is to have this ride out to Firefox 151 for Windows, macOS and Linux on May 18th!

This feature, when enabled, will create a copy of your profile data in th...]]></description>
<link>https://tsecurity.de/de/3693295/tools/firefox-nightly-backup-for-a-rainy-day-these-weeks-in-firefox-issue-202/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693295/tools/firefox-nightly-backup-for-a-rainy-day-these-weeks-in-firefox-issue-202/</guid>
<pubDate>Sat, 25 Jul 2026 08:37:35 +0200</pubDate>
<category>💾  Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h3>Highlights</h3>
<ul>
<li>The profile backup mechanism has been enabled by default for all desktop platforms in Nightly, as well as Beta! The current plan is to have this ride out to Firefox 151 for Windows, macOS and Linux on May 18th!
<ul>
<li>This feature, when enabled, will create a copy of your profile data in the background and store it in a single file on your file system that you can restore from.</li>
<li>You will be able to manage this feature in Settings under Sync (for now)
<ul>
<li><a href="https://blog.nightly.mozilla.org/files/2026/06/image6.png"><img alt="Firefox settings page showing the Backup feature in dark mode. Backup is enabled, with details of the most recent backup and a “Backup now” button. The page displays the backup file name and a backup location folder path, along with “Choose…” and “Show in folder” buttons. A “Sensitive data” section includes an option to back up passwords and payment methods with encryption, and a disabled “Change password” button." class="aligncenter size-full wp-image-2074" height="517" src="https://blog.nightly.mozilla.org/files/2026/06/image6.png" width="657"></a></li>
</ul>
</li>
<li><a href="https://support.mozilla.org/kb/firefox-backup">You can read more about the feature here</a></li>
</ul>
</li>
<li>As followups to the recent addition to the WebExtension tabs API to <a href="https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Working_with_the_Tabs_API#working_with_tab_split_views">support the new SplitView tabs feature</a>, tabs.group() and tabs.ungroup() have been fixed to work correctly with split view tabs, and fixed split views being prepended instead of appended to tab groups when adopted into a new window –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029099"> Bug 2029099</a> /<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029534"> Bug 2029534</a></li>
<li>Adaptive autofill has been enabled on Nightly.
<ul>
<li>Previously, autofill only completed domains (e.g. typing red autofilled<a href="http://reddit.com/"> reddit.com</a>). Now it can also complete full URLs for pages you visit often (e.g. red →<a href="http://reddit.com/r/firefox"> reddit.com/r/firefox</a>), learning from what you actually click in the address bar. If a suggestion isn’t helpful, you can now dismiss it so autofill learns what not to show you too.
<ul>
<li>If you run into issues or have feedback, <a href="https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&amp;component=Address+Bar">you can file a bug here</a>!</li>
</ul>
</li>
</ul>
</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=293943">Markus Stange [:mstange]</a> implemented dynamic toolbar on top in RDM (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1978145">#1978145</a>), but also implemented some static skeleton UI so it’s closer to what we actually have in Firefox for Android
<ul>
<li>dynamic toolbar is behind a pref: devtools.responsive.dynamicToolbar.enabled</li>
<li>it can be put on top by setting devtools.responsive.dynamicToolbar.onTop, otherwise it’s at the bottom</li>
<li><a href="https://blog.nightly.mozilla.org/files/2026/06/image1.png"><img alt="Firefox Responsive Design Mode on Desktop displaying the Mozilla homepage in a mobile viewport. The toolbar at the top shows a simulated Android device (including the dynamic toolbar) with a viewport size of 376 × 464 pixels and a device pixel ratio of 3. The page content is shown in French, featuring the Mozilla logo, a “Menu” link, a “Pause animation” button, and the headline “Bienvenue chez Mozilla” with accompanying text about trusted technology and digital rights." class="aligncenter size-full wp-image-2069" height="1113" src="https://blog.nightly.mozilla.org/files/2026/06/image1.png" width="882"></a></li>
</ul>
</li>
</ul>
<h3>Friends of the Firefox team</h3>
<h3><a href="https://bugzilla.mozilla.org/buglist.cgi?title=Resolved%20bugs%20(excluding%20employees)&amp;quicksearch=958957%2C1876109%2C1997388%2C2000797%2C1950995%2C1986020%2C2018272%2C2018276%2C2021681%2C2027969%2C2022115%2C1999012%2C2016058%2C2026585%2C2023913%2C2028167%2C2028293%2C2028927%2C1998002%2C2011343%2C1997925%2C2026574%2C2029398%2C2029684%2C1948019%2C2008756%2C2022601%2C2026032%2C2030428%2C1968244%2C1975391%2C944228%2C1962904%2C1977741%2C1997346%2C2027867%2C2030631%2C1807516%2C2030998%2C2030999%2C2015491%2C2028153%2C2028628%2C1978290%2C2008128%2C2024033%2C1883497%2C1984679%2C2030069%2C2031162%2C2031598%2C2012399%2C2031116%2C2031128%2C2031931%2C2031961%2C2033173%2C2032997%2C1919387%2C1947679%2C2027915%2C2032196%2C2019561%2C2024187%2C1392125%2C1993844%2C2027060%2C1983408%2C2034178%2C1873954%2C1875083%2C2008119%2C2008197%2C1628669%2C2031599%2C2033820">Resolved bugs (excluding employees)</a></h3>
<p><a href="https://github.com/niklasbaumgardner/NewContributorScraper">Script to find new contributors from bug list</a></p>
<h4>Volunteers that fixed more than one bug</h4>
<ul>
<li>Amin Amir</li>
<li>aoia7rz7l</li>
<li>Chukwuka Rosemary</li>
<li>DrSeed</li>
<li>Frédéric Wang Nélar</li>
<li>japandi</li>
<li>John Iweh</li>
<li>jonathancabera</li>
<li>Josh Aas</li>
<li>Keji Bakare</li>
<li>kofoworola shonuyi</li>
<li>konyhéa</li>
<li>liz</li>
<li>Mathew Hodson</li>
<li>Okhuomon Ajayi</li>
<li>Oluwatobi</li>
<li>ROSHAAN</li>
<li>Sam Johnson</li>
</ul>
<h4>New contributors (🌟 = first patch)</h4>
<ul>
<li> Anthony Mclamb:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027915"> Disable the legacy Edge migrator</a></li>
<li> Amin Amir
<ul>
<li>🌟<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031599">Fix browsingContext.sys.mjs to assign to #contextCreatedHandled instead of contextCreatedHandled</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033820">Fix missing WITHOUT ROWID SQLite performance optimization in SERPCategorization.sys.mjs</a></li>
<li>🌟 Amine Zroual:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1392125"> Omitted maxResults property not handled correctly in getRecentlyClosed</a></li>
</ul>
</li>
<li>any1here:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031162"> install_sig_alt_stack incorrectly checks mmap’s return value</a></li>
<li>🌟 Armin Ulrich:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031598"> Fix MessageHandlerRegistry.sys.mjs calling getExistingMessageHandler with an unused second argument</a></li>
<li>japandi
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1628669">Cannot remove amazon.com from top sites list</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1977741">The height of the pinned tabs area should be responsive to the number of pins</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1986020">Use cenum for nsIHelperAppLauncherDialog reason constants to enable better typescript annotations</a></li>
</ul>
</li>
<li>Nathan Johnson [:narjoDev]:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1950995"> Remove browser.display.use_system_colors pref</a></li>
<li>DrSeed
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1962904">Firefox shows vertical tabs in new windows despite “Hide tabs and sidebar” setting</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1968244">The “Expand sidebar on hover” option is not kept after the vertical tabs are disabled and enabled again</a></li>
</ul>
</li>
<li>Keji Bakare:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2008756">Split view’s focus-outline is clipped on the right side of left tab</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031116">White space on the right side of left panel in split view</a></li>
</ul>
</li>
<li>🌟 gotyaoi:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1807516"> Reload toolbar button is active on about:newtab</a></li>
<li>Itoro James:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2015491"> [A11y][Keyboard Navigation]Cancelling a note via Keyboard Navigation still saves it</a></li>
<li>John Iweh:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1997925"> The notification dot is not displayed if the tab is in a Split View</a></li>
<li>🌟 John Iweh:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027867"> sidebar-shown attribute remains when sidebar.revamp is false</a></li>
<li>🌟 jonathancabera:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2012399">The Move tab to Split View option is also displayed for the tabs that are within the Split View</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2016058">A Note with long text (1003 characters) is saved by pressing ENTER even if the “Save” button is disabled</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026032">Tab group guide line becomes disconnected under certain conditions related to split views in vertical tab mode</a></li>
</ul>
</li>
<li>Aloys:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2000797"> Remove logic that forces distribution language packs to be reinstalled when upgrading from Firefoxes older than 67</a></li>
<li>liz:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1875083">Create test to ensure maxRenderCountEstimate is never being set to Infinity in virtual-list component in Fx View</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2008119">Button accessible name does not convey its function: missing topic context (Settings dialog &gt; Topics dialog &gt; buttons Following/Unfollow/Blocked/Unblock)</a></li>
</ul>
</li>
<li>Mary cathline:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2022115"> Tab Group Label does not respect touch density in vertical tab bar</a></li>
<li>🌟 Brandon Lucier:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030631"> Popups opened with window.open give window type normal instead of popup</a></li>
<li>karan68:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1997388"> [dialog] New Shortcut dialog needs a label/accessible name</a></li>
<li>🌟 Vector:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2008128"> Button does not programmatically indicate that it opens a dialog (Recent activity section &gt; story card &gt; ••• disclosure &gt; Delete from History button)</a></li>
<li>🌟 Osoble:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1876109"> Update font size and weight for synced tabs device name headers in Firefox View</a></li>
<li>konyhéa:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1873954">Add test for sync admin disabled to browser_syncedtabs_errors_firefoxview.js</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1883497">Check all second paramaters for TestUtils.waitForCondition in Fx View test files</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030069">Recently Closed Tabs, Tabs from Other Devices, and History pages should have Cmd / Ctrl + Click on a link open the link in the new background tab.</a></li>
</ul>
</li>
<li>Noble Chinonso: <a href="http://sidebartreeview.js/">#shouldHandleEvent in SidebarTreeView.js compares event.keyCode to string values, causing Home/End keys to never be handled</a></li>
<li>Pranjali Srivastava:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=944228"> Add a test to verify that the space above tabs is consistent across PB, LWT and sizemode (where appropriate)</a></li>
<li>Okhuomon Ajayi:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2018272">More spacing is needed between the tab note icon and the close icon on the tab</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2019561">The tabs in vertical mode collapsed state are positioned differently in Split View</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027060">Keep vertical split view tabs stacked vertically even when the sidebar is expanded when expand on hover is enabled</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029684">Vertical split view tabs can be too big or small when tabs are overflowing</a></li>
</ul>
</li>
<li>🌟 Rishan:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030428"> Fix duplicated arrow function in browser_history_sidebar.js</a></li>
<li>Chukwuka Rosemary:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1948019">“Forget About This Site” context menu option missing from Firefox View history</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026574">Long strings are not displayed properly on the about:opentabs page search filed</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028153">Add test for Forget This Site option in Fxview history context menu.</a></li>
</ul>
</li>
<li>ROSHAAN:
<ul>
<li>🌟<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2018276">Tab note background colour is incorrect for default light theme</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1997346"> [win/linux] The splitter between content areas does not match Figma spec</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028927">Fix typo in OpenInTabsUtils.confirmOpenInTabs()</a></li>
</ul>
</li>
<li>Sameeksha:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2008197"> Disclosure button expanded/collapsed state not programmatically defined (Customize button)</a></li>
<li>kofoworola shonuyi:
<ul>
<li>🌟<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1999012">Actually hide or remove sidebar-shown attribute when in fullscreen.</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028293">Add a test for checking sidebar-shown attribute in fullscreen mode</a></li>
</ul>
</li>
<li>🌟 Sayd Mateen:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2021681"> Page URL is displayed as tab name when page’s contains about:reader?&lt;/a&gt;&lt;/p&gt; &lt;p&gt;</a></li>
</ul>
<ul>
<li>Oluwatobi:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1975391">Unable to delete selected history entries from sidebar</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1993844">Incorrect Sidebar button state/tooltip hover text</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2023913">The city name heading level doesn’t follow the correct heading level order</a></li>
</ul>
</li>
<li>Nishchay [:nish]:<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031961"> Unable to add tabs to old closed tab groups (tabGroupState.splitViews is undefined)</a></li>
</ul>
<p> </p>
<h3>Project Updates</h3>
<h4>Add-ons / Web Extensions</h4>
<h5>Addon Manager &amp; about:addons</h5>
<ul>
<li>In preparation for the Project Nova restyling of the about:addons page, we have refactored about:addons into separate per-component ES modules, splitting the monolithic aboutaddons.js and aboutaddons.html into 16 dedicated component files under components/ (with no behavior or UI changes) –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032014"> Bug 2032014</a>
<ul>
<li>NOTE: if you have working on patches with changes to about:addons internals it is very likely you’ll need to rebase and solve merge conflicts hit on top of this refactoring, the internals are still largely the same as before but don’t hesitate to reach out to the Addons team if you have doubts / questions or need help to figure out how to adapt your patch of top of these changes</li>
</ul>
</li>
</ul>
<h5>WebExtensions Framework</h5>
<ul>
<li>Fixed exportFunction to preserve the constructibility of the wrapped function instead of unconditionally making all exported functions implicitly as constructors –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033173"> Bug 2033173</a>
<ul>
<li>Thanks to Gregory Pappas for contributing this improvement to the Content Scripts’ Xray Wrappers helpers!</li>
</ul>
</li>
<li>Fixed a Firefox 151 regression where extension content scripts accessing location.ancestorOrigins caused subsequent page script reads of the same property to fail with “Permission denied”, breaking sites like Gmail –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034329"> Bug 2034329</a>
<ul>
<li>Thanks to Simon Farre for promptly investigating and fixing this recent regression!</li>
</ul>
</li>
</ul>
<h5>WebExtension APIs</h5>
<ul>
<li>Updated sessions.getRecentlyClosed() to remove the hardcoded cap when maxResults is omitted –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1392125"> Bug 1392125</a>
<ul>
<li>Shoutout to Amine Zroual for contributing this enhancement to the sessions WebExtensions API!</li>
</ul>
</li>
</ul>
<h4>DevTools</h4>
<ul>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=750915">Artem Manushenkov</a> fixed an issue where autosuggestion popup was removing overridden indicators from properties in the Inspector (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1983408">#1983408</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=446257">Andrea Marchesini [:baku]</a> fix DevTools cookie header serialization for long cookies, which could lead to cookies not being visible in Netmonitor (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031299">#2031299</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=559949">Julian Descottes [:jdescottes]</a> fixed a toolbox crash that was happening we couldn’t find a localization file (e.g. when using a language pack on Nightly) (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028930">#2028930</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=557153">Nicolas Chevobbe [:nchevobbe]</a> improved @container tooltip so it show the value of variables used in style()(<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030239">#2030239</a>), has enough contrast in dark mode (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033782">#2033782</a>) and contains a link to select the container (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031688">#2031688</a>)
<ul>
<li><a href="https://blog.nightly.mozilla.org/files/2026/06/image3.png"><img alt='Firefox Developer Tools showing a CSS @container style() rule in the Rules panel. A popover for a element displays container properties including "container-name: hello section-container", "container-type: inline-size", and the custom property "--w: 100px", while indicating that --secondary and --plouf are not set. Below, the container query uses nested var() fallbacks, and a CSS declaration previews the resolved value for background-color.' class="aligncenter size-full wp-image-2071" height="532" src="https://blog.nightly.mozilla.org/files/2026/06/image3.png" width="1038"></a></li>
</ul>
</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=656417">Hubert Boma Manilla (:bomsy)</a> is making good progress on migrating the Console to CodeMirror 6 (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032758">#2032758</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026569">#2026569</a>)</li>
</ul>
<h4>Fluent</h4>
<ul>
<li>We’re now at over 72% of our strings being Fluent! Got a component still using .properties? Convert when you can!</li>
<li><a href="https://blog.nightly.mozilla.org/files/2026/06/image5.png"><img alt="Stacked area chart titled “Are We Fluent Yet?” showing the number and type of localization strings available in Firefox from 2018 to 2026. The chart tracks Fluent strings (green), Properties strings (blue), DTD strings (pink), and a small number of INI strings. Over time, Fluent strings steadily increase while DTD and Properties strings decline. A tooltip at April 26, 2026 shows 10,372 Fluent strings, 3,997 Properties strings, and no remaining DTD or INC strings, illustrating Firefox’s ongoing migration to the Fluent localization system." class="aligncenter size-full wp-image-2073" height="924" src="https://blog.nightly.mozilla.org/files/2026/06/image5.png" width="1509"></a></li>
</ul>
<h4>Migration Improvements</h4>
<ul>
<li>Thanks to dao for <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035009">fixing a recent alignment issue in the migration wizard dropdown</a></li>
<li>Thanks to volunteer contributor Anthony Mclamb for his patch that <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027915">disables the legacy EdgeHTML Edge migrator</a>! Once that finishes rolling out, presuming no surprises, we’ll go ahead and remove the migrator entirely.</li>
</ul>
<h4>New Tab Page</h4>
<ul>
<li>Nova for New Tab has ridden the trains to Beta! It will be enabled by default, globally, when Firefox 151 goes out to release on May 19th
<ul>
<li>It’s possible that we’ll do a train-hop coupled with an experiment to enable HNT Nova for a few clients a bit earlier.</li>
</ul>
</li>
<li>Maxx Crawford<a href="https://bugzil.la/2032213"> enabled Nova designs for New Tab</a>, rolling out the updated layout, widgets, and customization panel behind HNT Nova flags.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2033165"> fixed the Nova content feed to render the intended four‑column layout</a> by correcting CSS grid breakpoints.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2033264"> resolved a first‑load failure in the Weather widget</a> by fixing init order and fetch timing, eliminating the “Oops” error.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2031707"> synchronized the Weather toggle between about:preferences#home and the panel</a> via the shared showWeather pref to prevent desync.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2021460"> updated Nova grid focus order</a> to align tab flow with visual order for keyboard users.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2034620"> fixed critical UI issues in Lists and Timer widgets</a> covering overflow, controls, and layout stability.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2032462"> guarded document.dir access in Nova render paths</a> to avoid startup cache worker errors and improve startup stability.</li>
<li>Rolf<a href="https://bugzil.la/2031568"> added a new normalization method for the inferred interest vector</a> to stabilize topic relevance across sessions.</li>
<li>Rolf<a href="https://bugzil.la/2031569"> prevented unnecessary content refreshes during Pocket New Tab experiments</a>, reducing jank and bandwidth.</li>
<li>Sameeksha<a href="https://bugzil.la/2008197"> defined the Customize button’s expanded/collapsed state programmatically</a> using aria-expanded for better a11y.</li>
<li>liz<a href="https://bugzil.la/2008119"> clarified follow/unfollow/blocked button names with topic context</a> so screen readers announce clear actions.</li>
<li>Vector<a href="https://bugzil.la/2008128"> marked the Delete from History control as opening a dialog</a> via aria-haspopup=dialog for assistive tech.</li>
<li>Scott Downe<a href="https://bugzil.la/2034145"> fixed a regression that flipped the Wallpapers pref off</a>, restoring user selections.</li>
<li>Irene Ni<a href="https://bugzil.la/2033927"> corrected privacy link color and focus styles</a> for contrast and keyboard visibility.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2030873"> added a wallpaper toggle reset in the Nova customization panel</a> so users can quickly restore default wallpapers without extra steps.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2031669"> fixed the Customize pencil button to match the Nova spec</a>, aligning placement and iconography for visual consistency.</li>
<li>Dre<a href="https://bugzil.la/2032607"> updated the ‘Fresh new’ wallpapers copy</a> to a clearer, localized message for better comprehension.</li>
<li>Irene Ni<a href="https://bugzil.la/2033927"> fixed Nova privacy link color and focus styles</a> to meet contrast and focus ring guidelines, improving accessibility on New Tab.</li>
<li>Irene Ni<a href="https://bugzil.la/2034098"> adjusted Sponsored tile character limits</a> to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.</li>
<li>Scott Downe<a href="https://bugzil.la/2034145"> fixed a regression that flipped the Wallpapers user pref to false</a>, restoring wallpapers for affected users and preventing unintended disablement.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2034688"> hooked the wallpaper check into the new toggle logic</a> so the Customization Panel accurately reflects wallpaper availability and state.</li>
<li>Irene Ni<a href="https://bugzil.la/2034912"> landed Nova UI updates for the Daily Briefing 3-pack card</a>, improving spacing, type scale, and tap targets.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2030873"> added a wallpaper toggle reset in the Nova customization panel</a> so users can quickly restore default wallpapers without extra steps.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2031669"> fixed the Customize pencil button to match the Nova spec</a>, aligning placement and iconography for visual consistency.</li>
<li>Dre<a href="https://bugzil.la/2032607"> updated the ‘Fresh new’ wallpapers copy</a> to a clearer, localized message for better comprehension.</li>
<li>Irene Ni<a href="https://bugzil.la/2033927"> fixed Nova privacy link color and focus styles</a> to meet contrast and focus ring guidelines, improving accessibility on New Tab.</li>
<li>Irene Ni<a href="https://bugzil.la/2034098"> adjusted Sponsored tile character limits</a> to prevent truncation/overflow, yielding cleaner titles across grid and wide tiles.</li>
<li>Scott Downe<a href="https://bugzil.la/2034145"> fixed a regression that flipped the Wallpapers user pref to false</a>, restoring wallpapers for affected users and preventing unintended disablement.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2034688"> hooked the wallpaper check into the new toggle logic</a> so the Customization Panel accurately reflects wallpaper availability and state.</li>
<li>Irene Ni<a href="https://bugzil.la/2034912"> landed Nova UI updates for the Daily Briefing 3-pack card</a>, improving spacing, type scale, and tap targets.</li>
</ul>
<h4>Search and Urlbar</h4>
<ul>
<li>Marco has fixed a<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034743"> couple</a> of<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1989632"> issues</a> with the places databases to try and improve stability. This should help with avoiding users losing bookmarks or favicons.</li>
<li>Work continues on the new separate search bar to improve the functionality, e.g.<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033231"> allowing middle click</a> to perform a search in a new tab,<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032991"> avoiding performing a</a> search when adding a search engine.</li>
<li>Work also continues on the new Nova layouts.</li>
</ul>
<h4>Smart Window</h4>
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032122">uplifted 10 bugs</a> to 150.0.1 dot release addressing initial user feedback from diary study and <a href="https://connect.mozilla.org/">Connect</a>
<ul>
<li>jump to bottom of conversation <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028692">2028692</a></li>
<li>stop streaming button <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029204">2029204</a></li>
<li>back/forward navigation from assistant <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029229">2029229</a></li>
<li>dark mode for various chips <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2024499">2024499</a></li>
</ul>
</li>
<li>search engine switching from smart bar <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2021973">2021973</a></li>
<li>Nova styling within smart window <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026794">2026794</a></li>
</ul>
<h4>Storybook/Reusable Components/Acorn Design System</h4>
<ul>
<li>Dustin converted moz-breadcrumb-group variables into JSON design tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029181">Bug 2029181 – Convert moz-breadcrumb-group variables into JSON design tokens</a></li>
<li>Dustin converted moz-box-* variables into JSON design tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029180">Bug 2029180 – Convert moz-box-* variables into JSON design tokens</a></li>
<li>Dustin converted moz-promo variables to JSON design tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029190">Bug 2029190 – Convert moz-promo variables into JSON design tokens</a></li>
<li>Dustin converted moz-reorderable-list variables to JSON design tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029191">Bug 2029191 – Convert moz-reorderable-list variables into JSON design tokens</a></li>
<li>Dustin converted moz-visual-picker variables to JSON design tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029193">Bug 2029193 – Convert moz-visual-picker-item variables into JSON design tokens</a></li>
<li>Dustin updated browser-shared.css so it passes use-design-tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2022985">Bug 2022985 – Update browser-shared.css so it passes use-design-tokens</a></li>
<li>Dustin updated popup.css so it passes use-design-tokens <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2022979">Bug 2022979 – Update popup.css so it passes use-design-tokens</a></li>
<li>Jon added opacity tokens and added opacity to use-design-tokens stylelint rule  <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1955325">Bug 1955325 – Create opacity tokens</a></li>
<li>Jon converted toolbar design tokens to JSON <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2017970">Bug 2017970 – Convert toolbar design tokens to json</a></li>
<li>Anna fixed moz-select with panel-list drop-down size inconsistency <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032365">Bug 2032365 – Applications Action drop-down menus sometimes have a different size when opened</a></li>
<li>Anna fixed issue with the disabled state of moz-radio component <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027123">Bug 2027123 – moz-radio disabled state cannot be changed while the moz-radio-group is disabled</a></li>
<li>Anna updated moz-button and moz-box-button components to prevent label corruption when accesskeys are present and the label changes.   <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2022326">Bug 2022326 – moz-button with accesskey label becomes corrupted when l10nId updates dynamically</a></li>
</ul>
<h4>UX Fundamentals</h4>
<ul>
<li>The error pages shown when a server sends back an invalid response header or an unsupported content encoding now display accurate, context-specific messages. The invalid response header page also gained a helpful list of next steps. – <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027209">2027209</a></li>
<li>In progress: The error page illustrations are being replaced with new artwork, and the system now supports per-illustration size configuration, giving each image the ability to define its own appropriate dimensions. – <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031837">2031837</a></li>
</ul>
<h4>Settings Redesign</h4>
<ul>
<li>Tim converted settings related to Accessibility page to config-based pane <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1968116">Bug 1968116 – Convert settings related to Accessibility page to config-based settings</a></li>
<li>Benjamin converted Privacy &amp; Security page to the config-based pane <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1968112">Bug 1968112 – Convert settings related to Privacy &amp; Security page to config-based settings</a></li>
<li>Finn integrated Firefox Labs page into setting-pane config <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2021047">Bug 2021047 – Integrate Firefox Labs page into setting-pane config</a></li>
<li>Anna converted Firefox Updates section to config-based prefs <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1990961">Bug 1990961 – Convert Firefox Updates section to config-based prefs</a></li>
<li>Mark Kennedy added moz-promo, that is welcoming users to the redesigned settings <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2015093">Bug 2015093 – Add a moz-promo to welcome users to the redesign</a>
<ul>
<li><a href="https://blog.nightly.mozilla.org/files/2026/06/image4.png"><img alt="The Firefox settings page in dark mode showing a notification banner that reads, “Same settings, new look!” The message further explains that the page has been reorganized to make settings easier to scan and explore, while keeping all existing settings unchanged. A “Got it” button appears below the message. The “AI Controls” section is visible underneath the banner." class="aligncenter size-full wp-image-2072" height="559" src="https://blog.nightly.mozilla.org/files/2026/06/image4.png" width="1431"></a></li>
</ul>
</li>
<li>Anna added possibility to search for actions in the redesigned “Applications” section <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2020370">Bug 2020370 – It’s no longer possible to search for actions in the new “Applications” section</a></li>
<li>Anna fixed the Settings navbar layout breakage</li>
</ul>]]></content:encoded>
</item>
<item>
<title><![CDATA[Firefox Nightly: More Kit, More Control – These Weeks in Firefox: Issue 203]]></title>
<description><![CDATA[Highlights

James enabled adaptive autofill in Nightly for testing, which we believe should provide better results in the URL bar when doing autocomplete!
Jack updated the illustrations shown on some of our error pages to match the latest approved designs, giving users more polished artwork when ...]]></description>
<link>https://tsecurity.de/de/3693294/tools/firefox-nightly-more-kit-more-control-these-weeks-in-firefox-issue-203/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693294/tools/firefox-nightly-more-kit-more-control-these-weeks-in-firefox-issue-203/</guid>
<pubDate>Sat, 25 Jul 2026 08:37:32 +0200</pubDate>
<category>💾  Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h3>Highlights</h3>
<ul>
<li>James <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032547">enabled adaptive autofill in Nightly</a> for testing, which we believe should provide better results in the URL bar when doing autocomplete!</li>
<li>Jack <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031837">updated the illustrations shown on some of our error pages</a> to match the latest approved designs, giving users more polished artwork when the browser encounters connection or security errors!</li>
</ul>
<p><img alt="Internet connection error page with an adorable Kit illustration" class="aligncenter wp-image-2080 size-full" height="652" src="https://blog.nightly.mozilla.org/files/2026/06/image2-1.png" width="1584"></p>
<ul>
<li>Controls for the Memories feature <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032998">can now be set during Smart Window onboarding</a></li>
</ul>
<p><img alt='Two radio button controls for the Smart Window Memories feature, including "Chats in Smart Window" and "Browsing across Firefox"' class="aligncenter wp-image-2078 size-full" height="546" src="https://blog.nightly.mozilla.org/files/2026/06/image4-1-e1780509799577.png" width="500"></p>
<p> </p>
<ul>
<li>We’ve disabled the CSS filter implicitly applied to WebExtension pageAction SVG icons across all release channels starting in Firefox 152, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2016509">completing the deprecation</a>
<ul>
<li><b>NOTE:</b> The blog post published at<a href="https://blog.mozilla.org/addons/2026/04/23/webextensions-api-changes-firefox-149-152/"> WebExtensions API changes in Firefox 149-152</a> provides to extensions developers more details about this deprecation and links to the related MDN docs.</li>
</ul>
</li>
</ul>
<h3>Friends of the Firefox team</h3>
<h4><a href="https://bugzilla.mozilla.org/buglist.cgi?title=Resolved%20bugs%20(excluding%20employees)&amp;quicksearch=2031599%2C2033820%2C2034178%2C1930213%2C2035355%2C1611643%2C2020302%2C2026007%2C2031015%2C2035252%2C2036528%2C411384%2C2033780%2C2036199%2C1812100%2C1898257%2C2030070%2C2030072">Resolved bugs (excluding employees)</a></h4>
<p><a href="https://github.com/niklasbaumgardner/NewContributorScraper">Script to find new contributors from bug list</a></p>
<h4>Volunteers that fixed more than one bug</h4>
<ul>
<li>Amin Amir</li>
<li>Pranjali Srivastava</li>
<li>Sam Johnson</li>
</ul>
<h4>New contributors (🌟 = first patch)</h4>
<ul>
<li> 🌟:23rd: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1812100">Regression: The new swipe-to-navigation indicator stucks for a moment, when deciding not to navigate the other page</a></li>
<li>🌟Akeem Omosanya: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035252">Remove commented-out code in SearchService.sys.mjs</a></li>
<li>Amin Amir:
<ul>
<li>🌟<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031599">Fix browsingContext.sys.mjs to assign to #contextCreatedHandled instead of contextCreatedHandled</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033820">Fix missing WITHOUT ROWID SQLite performance optimization in SERPCategorization.sys.mjs</a></li>
</ul>
</li>
<li>🌟Sahaj: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031015">Suggest the default target language for translation after changing the detected source language</a></li>
<li>🌟JIANG Zhirui: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036199">Breakpad build failed on Windows using VS2026 due to removal of stdext</a></li>
<li> John Iweh: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030072">Add “Open in New Tab” and “Open in New Container Tab” options to the context menu for Tabs from Other Devices</a></li>
<li>Jak: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030070">Bookmarks and History – should respect the “When you open a link, image or media in a new tab, switch to it immediately” setting</a></li>
<li>🌟Andy [:rgbcmy]: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1611643">Autoplayed next video should also be PIP</a></li>
<li> konyhéa: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1930213">“Escape” key should collapse the expanded on hover sidebar launcher even if hover is still active.</a></li>
<li> Pranjali Srivastava:
<ul>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1898257">Remove icon property from sidebar extensions</a></li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026007">Show language-agnostic SelectTranslations context menu item when the source and target languages are the same</a></li>
</ul>
</li>
</ul>
<h3>Project Updates</h3>
<h4>Add-ons / Web Extensions</h4>
<h5>Addon Manager &amp; about:addons</h5>
<ul>
<li>Fixed long-standing regression on the autocomplete and datalist popups for extension inline options pages on about:addons (introduced in Firefox 68 by<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1532724"> Bug 1532724</a>, fix shipping in Firefox 152) –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1595158"> Bug 1595158</a></li>
</ul>
<h5>WebExtensions Framework</h5>
<ul>
<li>Fixed access to web-accessible resources declared with &lt;all_urls&gt; from sandboxed documents (null-principal URLs), restoring extension redirects from the context-menu search flow, starting in Firefox 152 –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033905"> Bug 2033905</a></li>
</ul>
<h5>WebExtension APIs</h5>
<ul>
<li>Added exhaustive test coverage for tabs.move() against additional edge cases related to split-view tabs –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029092"> Bug 2029092</a></li>
</ul>
<h4>DevTools</h4>
<ul>
<li>Andreas Farre improved the Session History tab in the Application panel (still behind devtools.application.sessionHistory.enabled)
<ul>
<li>added support for remote debugging (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2014064">#2014064</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2016121">#2016121</a>)</li>
<li>made sure that calls to History.replaceState are reflected in the UI (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037359">#2037359</a>)</li>
</ul>
</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=559949">Julian Descottes [:jdescottes]</a> fixed the most frequent DevTools crash we were observing in Telemetry, adding a guard against IDBTransaction errors when retrieving breakpoints in the Debugger (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030260">#2030260</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=557153">Nicolas Chevobbe [:nchevobbe]</a> fixed the image preview tooltip for relative URLs images in constructed stylesheet (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035503">#2035503</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=559949">Julian Descottes [:jdescottes]</a> reduced the overhead we had because of network requests monitoring by only decoding response content when the user actually want to see the response (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026228">#2026228</a>)</li>
</ul>
<h4>WebDriver</h4>
<ul>
<li>Amin Amir cleaned up an <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031599">incorrect variable assignment</a> in our browsingContext module.</li>
<li>Logan Rosen <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036603">updated stale references and broken links</a> in our documentation about Marionette.</li>
<li>Sameem improved the Marionette and WebDriver BiDi <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2020302">screenshot commands to enforce maximum allowed dimensions</a>.</li>
<li>Leo McArdle fixed <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030964">the regression in the “log.entryAdded” event, which lacked an error message in the “text” field for the messages of type “error”</a>.</li>
<li>Henrik Skupin fixed an issue in Marionette where <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033769">WebDriver:Navigate and WebDriver:Refresh did not handle errors</a> when the underlying navigation failed.</li>
<li>Henrik Skupin <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1839953">improved geckodriver to detect an early Firefox exit during startup on Android</a>, avoiding up to 60 seconds of unnecessary connection attempts.</li>
<li>Henrik Skupin updated the <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028933">geckodriver CI build job to produce a universal macOS binary</a> supporting both x64 and aarch64.</li>
</ul>
<h4>Lint, Docs and Workflow</h4>
<ul>
<li>Sylvestre <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2023411">ported some linters</a> (e.g. file-whitespace, test-manifest-toml, license, file-perm, rejected-words &amp; more) to Rust to help improve the runtime of the code review bot.</li>
<li>Dale has been working on migration to moz-src for <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034040">customkeys</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035086">dom/quota</a> and <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035295">odom/geolocation</a>
<ul>
<li><a href="https://arewemozsrcyet.com/">https://arewemozsrcyet.com/</a></li>
</ul>
</li>
</ul>
<h4>New Tab Page</h4>
<ul>
<li>We did our first region-specific trainhop on May 11th (just 15% of the US), and turned on HNT Nova (and sometimes Widgets) for those clients to get some advance-data of its behaviour in the wild! A note that HNT Nova gets turned on for everybody when Firefox 151 ships on May 19th.
<ul>
<li>We’ll be launching a similar experiment in the DE, probably on May 12th, also at 15% population.</li>
</ul>
</li>
<li>Most of the team is heads down building out a sports-tracking widget, attempting to get that ready in time to be generally available for the upcoming World Cup event.</li>
<li>Dre landed a new world clock widget, which is currently off by default, but pretty snazzy!</li>
</ul>
<p><img alt="World clock widget in New Tab featuring different time zones for YTO, BER, SYD, and LAX." class="aligncenter wp-image-2079 size-full" height="162" src="https://blog.nightly.mozilla.org/files/2026/06/image3-1.png" width="346"></p>
<h4>Search and Urlbar</h4>
<ul>
<li>Nova (URL Bar Design Refresh)
<ul>
<li>Drew and Daisuke continued their work on <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2015612">Nova styling for the Address bar</a> (input and view).</li>
</ul>
</li>
<li>Search and Suggest
<ul>
<li>Drew finalized two bugs for World Cup and sports suggestions, which were landed and uplifted: one to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035322">update the localization string for scheduled games</a> and another to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034350">show both teams’ icons in suggestions</a>. Drew also landed and uplifted a fix for <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035353">rich search suggestion icons being forced into a square aspect ratio</a>.</li>
<li>Standard8 updated Ecosia favicons to the latest branding, including QA testing and publishing.</li>
</ul>
</li>
<li>Settings Redesign (SRD)
<ul>
<li>Stephanie landed a test to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2021512">ensure search suggestion settings are hidden when quicksuggest is disabled</a>, as well as a patch to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031341">resolve TypeScript issues</a> in search.mjs, and is adding test coverage to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2007397">confirm removed search engines are not displayed in the default engines dropdown</a>.</li>
</ul>
</li>
<li>General URL Bar and Component Updates
<ul>
<li>Daisuke landed implementation of the <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1893083">context menu on URL bar results</a>, and a fix to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2020177">show the loading URL in the URL bar when starting up with a homepage</a>.
<ul>
<li>Marco is working on several tasks, including a <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1756564">PDF download / focus stealing issue</a> and <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1924124">allowing arrays to be bound in Sqlite.sys.mjs</a>. Marco also worked on fixes related to Places, such as <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034743">avoiding replacing the favicons database if it is not corrupt</a>.</li>
</ul>
</li>
<li>Standard8 finalized the <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028423">URL bar test manifest split</a>. Standard8 also <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2016401">upgraded us to TypeScript 6</a>.</li>
<li>Moritz landed a fix for URL bar abandonment telemetry being recorded when clicking an engine in the unified search button popup (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032973">Bug 2032973</a>), which was also uplifted. Moritz also <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2034507">simplified search mode switcher item activation in tests</a>, and made it so that <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036030">the unified search button popup closes when installing an open search engine</a>.</li>
</ul>
</li>
</ul>
<h4>Smart Window</h4>
<ul>
<li>natural language starting with tab close/undo <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035343">2035343</a> with expandable action log <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031508">2031508</a></li>
</ul>
<p><img alt="Tab close and undo actions in Smart Window accompanied by an expandable log of actions taken" class="aligncenter wp-image-2077 size-full" height="256" src="https://blog.nightly.mozilla.org/files/2026/06/image1-1.png" width="220"></p>
<ul>
<li>assistant rendering feedback up/down <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2032994">2032994</a> and markdown table <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027029">2027029</a></li>
<li>nova styling blur <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2027877">2027877</a> and suggestions <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2026823">2026823</a></li>
<li>accessibility screen reader <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2028676">2028676</a> and keyboard focus <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037565">2037565</a></li>
<li>optimize conversation starters extra requests <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030005">2030005</a> and caching <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033430">2033430</a></li>
</ul>
<h4>Storybook/Reusable Components/Acorn Design System</h4>
<ul>
<li>Nova token updates occasionally, focused on SRD</li>
</ul>
<h4>UX Fundamentals</h4>
<ul>
<li>Added support for the “SEC_ERROR_CA_CERT_INVALID” certificate error to the Felt Privacy error pages. – <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035942">2035942</a></li>
</ul>
<h4>Settings Redesign</h4>
<ul>
<li>Settings redesign is being tested and will hopefully go out in Firefox 152!</li>
</ul>
<ul>
<li>
</ul>]]></content:encoded>
</item>
<item>
<title><![CDATA[Firefox Nightly: Giving You More Control – These Weeks in Firefox: Issue 204]]></title>
<description><![CDATA[Highlights

Maxx Crawford added a pref to hide the New Tab logo so users can opt out of branding without altering page layout or resorting to CSS overrides.
Harshit enabled video overlay detection in Nightly 153, allowing you to use the context menu to control videos on more pages! We plan on let...]]></description>
<link>https://tsecurity.de/de/3693293/tools/firefox-nightly-giving-you-more-control-these-weeks-in-firefox-issue-204/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693293/tools/firefox-nightly-giving-you-more-control-these-weeks-in-firefox-issue-204/</guid>
<pubDate>Sat, 25 Jul 2026 08:37:31 +0200</pubDate>
<category>💾  Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h3>Highlights</h3>
<ul>
<li>Maxx Crawford <a href="https://bugzil.la/2041708">added a pref to hide the New Tab logo </a>so users can opt out of branding without altering page layout or resorting to CSS overrides.</li>
<li>Harshit <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2041819">enabled video overlay detection</a> in Nightly 153, allowing you to use the context menu to control videos on more pages! We plan on letting this ride out in Firefox 153.
<ul>
<li><a href="https://www.instagram.com/p/DXH8Rd6EcWo/">You can try it out on this Instagram reel</a> in Nightly</li>
</ul>
</li>
</ul>
<p><img alt="Firefox context menu video controls like Pause, Unmute, Speed and Loop." class="aligncenter size-full wp-image-2081" height="431" src="https://blog.nightly.mozilla.org/files/2026/06/image2-2.png" width="480"></p>
<ul>
<li>A note to WebExtension authors – as part of a <a href="https://blog.mozilla.org/addons/2026/04/23/webextensions-api-changes-firefox-149-152/">planned deprecation announced last month</a>, executeScript and insertCSS are now restricted from moz-extension pages starting in Firefox 152 –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2015559"> Bug 2015559</a></li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=557153">Nicolas Chevobbe [:nchevobbe]</a> added support and debugging for modern attr()(which is <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2038939">enabled on Nightly</a>) (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2014751">#2014751</a>)</li>
</ul>
<p><img alt="Tooltip in Firefox DevTools for mismatched syntax with attr()" class="aligncenter size-full wp-image-2082" height="164" src="https://blog.nightly.mozilla.org/files/2026/06/image1-2.png" width="872"></p>
<h3>Friends of the Firefox team</h3>
<h4><a href="https://bugzilla.mozilla.org/buglist.cgi?title=Resolved%20bugs%20(excluding%20employees)&amp;quicksearch=1717176%2C2031328%2C2038948%2C2011485%2C1455294%2C2035084%2C2039455%2C2036767%2C2039878%2C2013176%2C2022414%2C2036237%2C2036578%2C2041612%2C1262773&amp;list_id=17986996">Resolved bugs (excluding employees)</a></h4>
<p><a href="https://github.com/niklasbaumgardner/NewContributorScraper">Script to find new contributors from bug list</a></p>
<h4>Volunteers that fixed more than one bug</h4>
<ul>
<li>Sam Johnson</li>
<li>Sebastian Zartner [:sebo]</li>
</ul>
<h4>New contributors (🌟 = first patch)</h4>
<ul>
<li>Immaculate Atim: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2022414">Switch to using an array instead of an object string for browser.backup.enabled_on.profiles</a></li>
<li>liz: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2011485">Screenshots overlay visible on both splitview browsers</a></li>
<li>🌟 Rahman Mahmutović [:r_m]: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1717176">Can’t change content in box model in inspector for box-sizing:border-box elements</a></li>
<li>Takeru Mitsumori: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2038948">Fix typo in ID name about-translations-swap-langauges-icon in about-translations.html</a></li>
<li>🌟 Freya Arbjerg [:freyacodes]: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036767">Blackboxed columns are ignored</a></li>
<li> tom.passarelli: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2031328">tab-preview-panel emits unpaired popupshown/popuphidden events, breaking sidebar autohide</a></li>
</ul>
<h3>Project Updates</h3>
<h4>Add-ons / Web Extensions</h4>
<h5>Addon Manager &amp; about:addons</h5>
<ul>
<li>As part of the work for the Project Nova about:addons page restyling, the about:addons sidebar has been migrated to the moz-page-nav and moz-page-nav-button reusable components, improving accessibility and visual consistency with the Firefox Desktop about:settings page –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1881767"> Bug 1881767</a></li>
</ul>
<h5>WebExtensions Framework</h5>
<ul>
<li>Implemented WebExtensions negative permissions infrastructure, providing the foundations for enterprise policy “blocked host permissions” features –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1745823"> Bug 1745823</a></li>
<li>Restricted host permission changes for MV3 extensions force-installed via enterprise policy (matching similar behaviors provided by Chrome enterprise policy behaviors) –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1904054"> Bug 1904054</a>
<ul>
<li>Thanks to Mike Kaply for the implementation of this enterprise policy enforcement feature.</li>
</ul>
</li>
</ul>
<h5>WebExtension APIs</h5>
<ul>
<li>Fixed handling of &lt;all_urls&gt; as an API permission in Manifest V3, ensuring the permission is correctly initialized on extension install –<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1758306"> Bug 1758306</a></li>
</ul>
<h4>DevTools</h4>
<ul>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=789324">Rahman Mahmutović [:r_m]</a> made it possible to edit width/height in the box model section of the Layout panel (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1717176">#1717176</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=446518">Sebastian Zartner [:sebo]</a> improved toggling tools driving in-page highlighters (e.g. the Measuring) (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1262773">#1262773</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=446518">Sebastian Zartner [:sebo]</a> added a setting to control visibility of HTML comments in the markup view (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1455294">#1455294</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=789044">Freya Arbjerg [:freyacodes]</a> fixed an issue in script blackboxing (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036767">#2036767</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=283262">Alexandre Poirot [:ochameau]</a> replaced custom preference to log RDP messages with MOZ_LOG (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1622857">#1622857</a>)</li>
<li><a href="https://bugzilla.mozilla.org/user_profile?user_id=283262">Alexandre Poirot [:ochameau]</a> fixed retrieval of garbage collected script text content (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1758454">#1758454</a>)</li>
</ul>
<h4>WebDriver</h4>
<ul>
<li>Sameem updated the “Take Element Screenshot” command from WebDriver Classic to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2013176">crop screenshots of elements which exceed the viewport</a>. This aligns with the specification and avoids errors when attempting to capture huge elements.</li>
<li>Alexandra Borovova updated the events for new top-level browsing contexts: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1930594">we will not send anymore “browsingContext.domContentLoaded” and “browsingContext.load” events for them, instead the “browsingContext.contextCreated” event will be sent when a tab is ready to be used</a>. This is required to align with the expected per-spec behavior.</li>
<li>Henrik Skupin landed a patch <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1430064">allowing geckodriver to gracefully shut down Firefox</a> when geckodriver itself is terminated.</li>
<li>Hiroyuki Ikezoe <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2040252">disabled Firefox’s “scroll axis lock” feature</a> so WebDriver actions for wheel input devices can scroll in arbitrary directions when using pan gestures.</li>
</ul>
<h4>Lint, Docs and Workflow</h4>
<ul>
<li>Added a rule to <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1790711">prevent new uses of Preferences.sys.mjs</a>.</li>
<li>The browser environment globals within ESLint have <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1793814">now been updated</a>. These include Sanitizer, VideoFrame and a few other new ones.</li>
<li>Temporal, and some other definitions have been <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1999036">added to TypeScript</a>.</li>
</ul>
<h4>New Tab Page</h4>
<ul>
<li>Much has happened in the last 2 weeks! <a href="https://bugzilla.mozilla.org/buglist.cgi?bug_status=RESOLVED%2CVERIFIED%2CCLOSED&amp;resolution=FIXED&amp;chfieldfrom=2026-05-12T14%3A40%3A16.019Z&amp;chfieldto=Now&amp;bug_id=2015530%2C2024720%2C2028377%2C2028534%2C2033592%2C2035176%2C2036902%2C2037143%2C2037301%2C2037541%2C2037646%2C2037947%2C2038048%2C2038392%2C2038790%2C2038823%2C2038881%2C2038981%2C2038984%2C2039103%2C2039107%2C2039333%2C2039346%2C2039358%2C2039477%2C2039587%2C2039752%2C2039765%2C2039770%2C2039775%2C2039956%2C2039963%2C2040027%2C2040033%2C2040254%2C2040269%2C2040370%2C2040376%2C2040480%2C2040481%2C2040503%2C2040552%2C2040645%2C2040674%2C2040677%2C2041033%2C2041163%2C2041196%2C2041204%2C2041205%2C2041207%2C2041244%2C2041532%2C2041651%2C2041682%2C2041708%2C2041711%2C2041730%2C2041757%2C2041765%2C2041814%2C2042054&amp;product=Firefox&amp;component=New+Tab+Page">Here’s a full bug list</a>, and here are some highlights.</li>
<li>Dre fixed the List widget that was creating a new list too eagerly on the New Tab Page (<a href="https://bugzil.la/2033592">2033592</a>) — prevents accidental list creation and improves the Lists UI reliability.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2035176"> fixed Weather widget small card layout issues with opt-in location options and an error message displayed</a>, resolving card overflow and removing the spurious opt-in error so users see a compact Weather card and correct location prompts on New Tab.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2037301"> added key dates state to the Sports widget</a>, enabling the Sports card to surface event deadlines/key-date highlights on New Tab so sports users see timely date info.</li>
<li>Scott Downe<a href="https://bugzil.la/2037541"> added a manage widgets option to the New Tab nova widgets context menu</a>, giving users a direct context-menu entry to open the widget management flow from any widget with Nova enabled.</li>
<li>Scott Downe added a reusable Newtab widget base component to centralize lifecycle, focus/keyboard handling, DOM templates, and telemetry hooks, reducing duplication and making widget behavior more consistent; see<a href="https://bugzil.la/2037947"> Newtab widget base component</a>.</li>
<li>Dre converted per-widget expansion handling to a shared widget expansion handler to unify expand/collapse state management and prevent widgets from incorrectly retaining or losing expanded state; see<a href="https://bugzil.la/2038048"> Convert widget expansion handling to shared widget expansion</a>.</li>
<li>Nina Pypchenko [:nina-py]<a href="https://bugzil.la/2038881"> updated the Sports widget to populate the “follow teams” state from the /teams endpoint</a>, so follow/unfollow toggles now reflect server-side subscriptions and reduce incorrect follow states.</li>
<li>Scott Downe<a href="https://bugzil.la/2038981"> moved widget menu items</a> within New Tab widgets to standardize menu ordering and action grouping, so users find Add/Remove/Configure entries in expected positions across platforms.</li>
<li>Dre<a href="https://bugzil.la/2039346"> fixed a World Clock city search bug </a>for the word clocks widget, restoring expected search filtering/matching so city lookups return correct results.</li>
<li>Scott Downe fixed an issue where the New Tab small weather widget size change didn’t always apply by correcting the widget size update path (JS/CSS layout interactions), improving consistent rendering for small-tile weather across responsive breakpoints and platforms; see<a href="https://bugzil.la/2040033"> Newtab small weather widget size change doesn’t always work</a>.</li>
<li>Nina Pypchenko [:nina-py]<a href="https://bugzil.la/2040269"> added a group stage section to match highlights</a> in the sports widget on New Tab so users now see stage-aware grouping and stage labels on match highlight cards, making tournament context (group vs knockout) visible while browsing highlights.</li>
<li>Dre<a href="https://bugzil.la/2040376"> fixed the small world clock widget not expanding to large while editing clocks</a> so users can enter edit mode and expand the widget as expected; the change wires the edit-mode resize handler to update widget size/class during edits.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2040480"> added WCW OMC message strings</a> so World Cup widget messaging flows on New Tab now display the correct copy (localized where available) instead of falling back to missing-text behavior.</li>
<li>Reem Hamoui<a href="https://bugzil.la/2040552"> added a “View all” button and a list view for the results tab at medium widget size</a> so Sports widget users on medium New Tab tiles can expand results and scroll full lists without resizing the widget.</li>
<li>Maxx Crawford<a href="https://bugzil.la/2040674"> added WCW “Watch Live” stream strings to the Sports widget strings bundle</a> so the widget can surface a localized “Watch Live” CTA for applicable events.</li>
<li>Dre<a href="https://bugzil.la/2040677"> restored VoiceOver reachability for Edit/Remove in World Clock on macOS</a> so macOS VoiceOver users can now focus and activate clock Edit/Remove controls thanks to accessibility role/label and focus-order fixes.</li>
<li>Maxx Crawford removed the persistent browser logo when all new-tab features (Top Sites, widgets, content feed) are disabled by adding a conditional render guard in the New Tab component, preventing an orphaned logo (<a href="https://bugzil.la/2041033">2041033</a>).</li>
<li>Mike Conley added New Tab jest tests to the node tests Tier 1 CI job<a href="https://bugzil.la/2041757"> Run newtab jest tests as part of node tests Tier 1 job</a> to catch regressions earlier in CI</li>
<li>Irene Ni shipped multiple visual fixes for the Sports widget<a href="https://bugzil.la/2041765"> Sports widget – various visual fixes</a> (spacing, truncation, icon alignment, clipping) to improve readability and layout on constrained viewports.</li>
</ul>
<h4>Picture-in-Picture</h4>
<ul>
<li>kpatenio <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2041113">adjusted our YouTube site specific wrapper so that the URL bar toggle appears more reliably</a>, especially when selecting videos from the YouTube search page.</li>
<li>Thanks to Sylvestre for patching <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037420">some</a> <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2042141">bugs</a> to prevent some spurious console errors!</li>
<li>Niklas <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2013735">fixed captions on autopip videos failing to sync with the origin videos</a>.</li>
</ul>
<h4>Performance Tools (aka <a href="https://profiler.firefox.com/">Firefox Profiler</a>)</h4>
<ul>
<li>Firefox Profiler now has a CLI! We also added a profiler-analysis skill to the Firefox codebase. Once you capture a performance profile, you can ask Claude or an AI to analyze it by providing a link or local path. You can use it to analyze a performance regression or debug an issue if you have a profile at hand.
<ul>
<li><a href="https://www.npmjs.com/package/@firefox-devtools/profiler-cli">https://www.npmjs.com/package/@firefox-devtools/profiler-cli</a></li>
<li>You can install it with npm install -g @firefox-devtools/profiler-cli@latest</li>
</ul>
</li>
</ul>
<h4>Search and Urlbar</h4>
<h6>Nova UI refresh</h6>
<ul>
<li>Drew and Daisuke continued working on reorganizing styles and updating the urlbar for Nova.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2019154">2019154</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2019152">2019152</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2041501">2041501</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2040532">2040532</a></li>
</ul>
<h6>Suggest</h6>
<ul>
<li>Drew landed several Suggest improvements: realtime suggestions colors, sports suggestions received World Cup tweaks, and online Suggest via OHTTP was enabled for eligible users in Firefox 153.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2040561">2040561</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2039753">2039753</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035614">2035614</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2038843">2038843</a></li>
</ul>
<h6>Adaptive autofill</h6>
<ul>
<li>James fixed soft-block counting to track autofill dismisses, rather than consecutive backspaces on the same autofill, and added telemetry to measure URLs reintegration after blocking.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2040819">2040819</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037177">2037177</a></li>
</ul>
<h6>Quick actions</h6>
<ul>
<li>Dharma created a new Firefox Labs quick action, fixed the Update action button, and re-enabled ScotchBonnet in some tests that were not updated yet.</li>
<li>Caleb added Calculator support for certain unicode operators.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2023169">2023169</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1928635">1928635</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1923383">1923383</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033861">2033861</a></li>
</ul>
<h6>Multi Context Address Bar</h6>
<ul>
<li>Moritz continued refactoring the urlbar code: converted some of the js modules to not be system modules, fixed dynamic results templates, incorrect reuse of result rows, and keyboard shortcuts on the unified search button panel.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2039297">2039297</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2036095">2036095</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2039844">2039844</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037933">2037933</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2030050">2030050</a></li>
</ul>
<h6><i>Other</i></h6>
<ul>
<li>Marco, Drew and Daisuke fixed several intermittent test failures.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2038510">2038510</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2023908">2023908</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2011584">2011584</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1938142">1938142</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1971091">1971091</a></li>
</ul>
<h5>Search</h5>
<ul>
<li>Mark removed old WebExtension-based search engines from the source tree, removed loading of search add-ons from <i>resource://search-extensions/</i>.</li>
<li>Caleb fixed multiple documentation issues and added a test covering searches from a private window.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1904613">1904613</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035878">2035878</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2037942">2037942</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2033545">2033545</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2005724">2005724</a></li>
</ul>
<h5>Places</h5>
<ul>
<li>Marco removed some unnecessary database transactions, fixed the bookmarks panel folder dropdown on Windows, and resolved several intermittent test failures.</li>
<li>Thanks to Sam Johnson who fixed the bookmark edit panel showing “mobile” instead of “Mobile Bookmarks”.</li>
<li><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2039534">2039534</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1505800">1505800</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2008829">2008829</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2029541">2029541</a>, <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=2035084">2035084</a></li>
</ul>
<ul>
<li>
</ul>]]></content:encoded>
</item>
<item>
<title><![CDATA[Hacks.Mozilla.Org: PACT: Anonymous Credentials for the Web]]></title>
<description><![CDATA[This is the technical companion to our update on Distilled, “Keeping the web open and private in the bot era.” Here we take a deeper look at the problem space, the design we’re proposing, and the problems still left to solve. 
Bots (and privacy-preserving browsers) not welcome 
Browse a news site...]]></description>
<link>https://tsecurity.de/de/3693291/tools/hacksmozillaorg-pact-anonymous-credentials-for-the-web/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693291/tools/hacksmozillaorg-pact-anonymous-credentials-for-the-web/</guid>
<pubDate>Sat, 25 Jul 2026 08:37:27 +0200</pubDate>
<category>💾  Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p class="c43"><em><span class="c11 c1">This is the technical companion to our update on Distilled, </span><span class="c11 c1 c17"><a class="c5" href="https://blog.mozilla.org/en/privacy-security/keeping-the-web-open-and-private-in-the-bot-era/">“Keeping the web open and private in the bot era.”</a></span><span class="c11 c1"> Here we take a deeper look at the problem space, the design we’re proposing, and the problems still left to </span><span class="c1 c11">solve</span></em><span class="c13 c11 c1"><em>.</em> </span></p>
<h3 class="c24"><span class="c2 c1">Bots (and privacy-preserving browsers) not welcome </span></h3>
<p class="c40"><span class="c0">Browse a news site in a private window. Shop at a major retailer with a VPN. Visit a video streaming platform with anti-fingerprinting defenses tuned up. You’ll see the same responses: registration walls, block pages, and endless CAPTCHAs. The message is clear: </span><span class="c13 c11 c1">if we think you might be a bot, you’re not welcome</span><span class="c0">. </span></p>
<p class="c53"><span class="c0">Websites have valid reasons for wanting to block bots. Bots enable volumetric abuse</span><span class="c1">, abuse that wouldn’t otherwise be feasible if they had to be carried out by humans</span><span class="c0">. </span><span class="c0"> For example</span><span class="c1">: SEO comment spam, credential stuffing and DDoSing</span><span class="c0">.</span><span class="c0"> Consequently many sites employ dedicated anti-abuse tooling which aims to keep the bots out whilst minimizing friction for human visitors. </span></p>
<p class="c21"><span class="c0">Unfortunately, that tooling is increasingly failing at both tasks. Browser privacy protections are </span><span class="c3 c1"><a class="c5" href="https://blog.mozilla.org/en/firefox/fingerprinting-protections/">dismantling</a></span><span class="c0"> the passive signals that anti-abuse systems depended on to identify and distinguish </span><span class="c0">visitors</span><span class="c0">. Meanwhile advances in generative AI have rendered CAPTCHAs ineffective: bots now solve them </span><span class="c3 c1"><a class="c5" href="https://www.usenix.org/system/files/usenixsecurity23-searles.pdf">faster and more reliably</a></span><span class="c0"> than </span><span class="c0">humans</span><span class="c0">. </span></p>
<p class="c33"><span class="c0">Many sites are switching to more invasive mechanisms and now ask visitors to disclose </span><span class="c1">identifying information</span><span class="c0">,</span><span class="c0"> e.g. an email address, a federated login or </span><span class="c1">disabling their VPN</span><span class="c0">. This means greater friction for users, since providing these details on a first visit takes time. It also compromises their privacy, since these details enable the same kinds of cross-site tracking that browser privacy protections were intended to mitigate. </span></p>
<p class="c38"><span class="c0">This </span><span class="c1">leaves</span><span class="c0"> users </span><span class="c1">with a</span><span class="c0"> dilemma. The more effectively they protect their privacy, the harder it is for websites to distinguish them from bots and the worse the treatment they receive. Website operators are also suffering. The additional friction they inflict upon well-behaved visitors harms their site, but many are willing to pay the costs if it mitigates volumetric abuse. </span></p>
<p class="c44"><span class="c1">Browser-based AI agents make this tension more acute. Sites may want to allow agents which are acting on behalf of individual users while blocking agents engaged in volumetric abuse. However, with no effective mechanisms to distinguish the two, websites are opting to block </span><span class="c17 c1"><a class="c5" href="https://dl.acm.org/doi/epdf/10.1145/3730567.3732913">both</a></span><span class="c0">. That hurts users, who should be free to choose the user agent they use to access the web; it hurts new browsers and agents, which struggle to interoperate; and it hurts sites, which lose legitimate visitors.</span></p>
<p class="c30"><span class="c0">The consequence is that the web gets worse for everyone. Users get more friction or less privacy or both. Website operators see more volumetric abuse and the friction they add drives away users </span><span class="c1">who</span><span class="c0"> would otherwise want to consume their content or services. New user</span><span class="c1"> </span><span class="c0">agents struggle to access the same content as conventional browsers. </span></p>
<h3 class="c12"><span class="c20 c1">The</span><span class="c20 c1"> Costs of </span><span class="c2 c1">Convenient</span><span class="c2 c1"> Solutions</span></h3>
<p class="c9"><span class="c0">Some large ecosystem players have put forward solutions that leverage their control of the dominant operating systems and their deep integration with consumer hardware. These rely on device attestation: identifiers and privileged code baked into devices at the hardware level, which let manufacturers prove what software is running on a user’s device. Exposing this functionality to the web means attesting to sites that the user is running approved software with trusted hardware and therefore isn’t a bot. There have been two substantive proposals.</span></p>
<p class="c9"><span class="c0">Google’s Web Environment Integrity, <a href="https://www.theregister.com/software/2023/11/02/google-abandons-web-environment-integrity-api-proposal/335969">abandoned in 2023</a>, was the blunt version. It attested to the user agent itself, as well as the operating system and device in use. Users would have lost control in two ways: once to the attester, which would decide which operating systems and devices could be blessed, and again to the website, which would decide which software to accept. If sites had adopted allow-lists of approved user agents, building a new browser would have become virtually impossible, and sites could have withdrawn access from any user agent they chose.</span></p>
<p class="c9"><span class="c0">Apple’s Private Access Tokens, <a href="https://developer.apple.com/news/?id=huqjyh7k">deployed</a> across their ecosystem in 2022, have more subtle issues. Built on the Privacy Pass protocol standardized at the IETF, they get a lot right: a user receives a renewed, limited batch of one-time tokens that can be presented to websites without linking their visits together. This provides privacy for users and has shown rate limits to be an effective tool for sites – both points we’ll return to later in this post.</span></p>
<p class="c9"><span class="c1">However, Private Access Tokens rely on device attestation, requiring that the hardware manufacturer be in overall control of the user’s device. Presenting a PAT tells a website you are locked into Apple’s rules for what counts as acceptable software. </span><span class="c1">Due to PAT’s technical design</span><sup class="c1"><a href="https://hacks.mozilla.org/?p=48374#:~:text=PAT%20requires">[1]</a></sup><span class="c1">, there’s no way to open the system to other sources of scarcity without compromising the system’s privacy properties, meaning that if more widely deployed, access to the web would</span><span class="c1"> become tied to having bought expensive hardware from a small, hard to change set of vendors</span><span class="c1">. </span></p>
<p class="c9"><span class="c1">Both approaches are ultimately hostile to users and to the openness of the web. Both are premised on parts of a user’s device that sit within the manufacturer’s control and beyond the user’s own. Were they widely deployed, the web would become just another walled garden with centralized gatekeepers controlling acceptable hardware, operating systems and software. As convenient as these solutions are for the players who already dominate the ecosystem, we think there’s a better path.</span></p>
<h3 class="c24"><span class="c2 c1">A Better Path Forward </span></h3>
<p class="c24"><span class="c1">Bots’ harms arise from their ability to operate beyond human scale. For sites to prevent volumetric abuse they</span><span class="c0"> don’t actually need to know </span><span class="c1">the user’s</span><span class="c0"> identity or </span><span class="c1">receive cryptographic</span><span class="c0"> proof that they’re running approved softwar</span><span class="c1">e. If sites knew their visitors were restricted to a rate </span><span class="c1">limit</span><span class="c1"> set by a site, that would be enough.  </span></p>
<p class="c34"><span class="c1">Rate limits</span><span class="c0"> only make sense if </span><span class="c1">they’re</span><span class="c0"> </span><span class="c1">tied to</span><span class="c0"> something scarce; something an attacker can’t cheaply replicate to evade the limit. </span><span class="c0">Without anchoring to a scarce resource, like the trusted hardware used in Private Access Tokens, attackers can generate as many fresh identities as they need to bypass the rate limit. </span></p>
<p class="c56"><span class="c1">However, </span><span class="c0">hardware is just one option for </span><span class="c1">scarcity</span><span class="c0">. Anything a user already has that an attacker can’t trivially spin up at scale will work</span><span class="c1">: e</span><span class="c0">mail addresses and phone numbers are naturally scarce</span><span class="c1">. A paid subscription costs an attacker the same as a real user.  </span><span class="c0">Even maintaining an account on a free service requires </span><span class="c1">some</span><span class="c0"> non-trivial work. </span></p>
<p class="c39"><span class="c0">What if we could use these scarce signals across the web? We</span><span class="c1"> could build </span><span class="c0">an open ecosystem with many parties offering scarcity signals, each site choosing which to accept. By </span><span class="c0">opening up who can provide a signal, and letting sites choose which to accept, we can avoid transferring control to device manufacturers and the resulting harms. </span></p>
<p class="c39"><span class="c1">As a concrete example of who might be well positioned to provide such a signal, we can consider VPN providers acting as a subscription service. Sites routinely block VPN users indiscriminately, whether through a deliberate policy choice or through an indirect consequence of rate limiting visitors per IP address. But a VPN subscription is a perfect source of scarcity. If the VPN provider could vouch for its users so that sites could rate limit each user individually – then users would be able to browse the web with less friction and without giving up their VPN usage. </span></p>
<p class="c35"><span class="c0">The catch is that building </span><span class="c1">a system that can enable this</span><span class="c0"> on the open web whilst </span><span class="c1">maintaining user’s privacy</span><span class="c0"> is genuinely difficult. </span><span class="c1">It requires that we take information from one site — that this user holds some scarce thing — and expose it to other sites so that they can use that as the basis for their rate limiting. </span><span class="c0">Letting one site verify a signal from another is </span><span class="c1">the sort of </span><span class="c0">information flow</span><span class="c1"> </span><span class="c0">that privacy-pr</span><span class="c1">eserving </span><span class="c0">browsers have spent the last decade locking down to </span><span class="c1">prevent cross-site tracking</span><span class="c0">. </span></p>
<p class="c35"><span class="c1">Our goal would be that no more than the minimum information gets through: a single bit communicating whether the user is below the rate limit set by the site. Leaking anything more – like the source of the scarcity that the rate limit is anchored to – would be unacceptable. Enabling a new cross-site information flow might feel like compromising privacy to gain better access, but reality is more nuanced. If a new system moves sites away from demanding that visitors be identifiable (whether through fingerprinting or login forms), </span><span class="c1">it can be a win for both privacy and access.</span></p>
<h3 class="c24"><span class="c2 c1">The Foundations </span></h3>
<p class="c50"><span class="c0">The good news is that the cryptographic foundations for a privacy preserving approach already exist. The </span><span class="c1 c3"><a class="c5" href="https://privacypass.github.io/">Privacy Pass protocol</a></span><span class="c3 c1"><a class="c5" href="https://www.google.com/url?q=https://privacypass.github.io/&amp;sa=D&amp;source=editors&amp;ust=1782228494401139&amp;usg=AOvVaw3uoXdqARBZKjQF5H8uwYKY">,</a></span><span class="c0"> </span><span class="c3 c1"><a class="c5" href="https://www.petsymposium.org/2018/files/papers/issue3/popets-2018-0026.pdf">originally developed in 2018</a></span><span class="c0"> to reduce the friction of Cloudflare CAPTCHAs for Tor users, introduced the core primitive: a token that is </span><span class="c13 c11 c1">unlinkable </span><span class="c0">between issuance and redemption. You prove something to an issuer (e.g. by </span><span class="c1">solving a CAPTCHA</span><span class="c0">), receive some tokens, and later present a token to a website. The website can verify the token is legitimate, but can’t link it to the user it was issued to. </span></p>
<p><img alt="A diagram showing the protocol flow for Privacy Pass." class="aligncenter size-full wp-image-48375" height="1639" src="https://hacks.mozilla.org/wp-content/uploads/2026/06/pact-drawings-1.excalidraw1-scaled.png" width="2560"></p>
<p class="c27"><img alt="" title=""><span class="c20 c1 c57"><strong>Figure 1</strong>: </span><span class="c0"><em>In Privacy Pass, a CAPTCHA provider can issue tokens to a client which can then be used to bypass challenges for future site visits. Even if the CAPTCHA provider and sites collude, they can’t use the tokens to identify the user or their browsing history.</em> </span></p>
<p class="c52"><span class="c0">Privacy Pass has gone on to be successfully deployed in systems where the issuer and verifier have a prior trust relationship: </span><span class="c0">Apple</span><span class="c0"> uses it to authenticate users of </span><span class="c3 c1"><a class="c5" href="https://hacks.mozilla.org/feed/">Private Cloud Compute</a></span><span class="c0"> </span><span class="c1">and</span><span class="c0"> </span><span class="c3 c1"><a class="c5" href="https://www.apple.com/privacy/docs/iCloud_Private_Relay_Overview_Dec2021.PDF">Private Rel</a></span><span class="c17 c1"><a class="c5" href="https://www.google.com/url?q=https://www.apple.com/privacy/docs/iCloud_Private_Relay_Overview_Dec2021.PDF&amp;sa=D&amp;source=editors&amp;ust=1782228494402463&amp;usg=AOvVaw0KGoiSPg-8NLvNvIiSSbPt">ay</a></span><span class="c1"> </span><span class="c0">without linking their activity to their identity, </span><span class="c0">Chrome</span><span class="c0"> uses it for </span><span class="c3 c1"><a class="c5" href="https://github.com/GoogleChrome/ip-protection">two-hop IP protection</a></span><span class="c0">, and </span><span class="c0">Kagi</span><span class="c0"> uses it to provide </span><span class="c17 c1"><a class="c5" href="https://help.kagi.com/kagi/privacy/privacy-pass.html">private search</a></span><span class="c0">. </span><span class="c0">These deployments work in part because a small number of parties have agreed in advance on who issues tokens and who accepts them. </span></p>
<p class="c18"><span class="c0">Applying this approach to an open system where any site can act as</span><span class="c0"> an issuer</span><span class="c0"> </span><span class="c3 c1"><a class="c5" href="https://docs.google.com/document/d/1k3QJG2D_Sq4zJiJRn9DfY80hEHuz9UWrJdTt8LbRsMM/edit?tab=t.0#heading=h.r8jxzjcoeumo">brings real challenges</a></span><span class="c0">.</span><span class="c0"> Firstly, even though tokens are unlinkable, knowing a user has access to a specific issuer is a privacy leak on its own, because you can infer that the user meets the relevant issuance criteria. </span><span class="c1">If one site can learn that you have a token from another site, that reveals that you have been to that site, which can be a major privacy problem. </span><span class="c0">This compounds if </span><span class="c1">sites </span><span class="c0">can learn the set of issuers </span><span class="c1">you have visited</span><span class="c0">, since it becomes a fingerprint which can be used to identify </span><span class="c1">you</span><span class="c0">. </span></p>
<p class="c8"><span class="c3 c1"><a class="c5" href="https://blog.cryptographyengineering.com/2014/11/27/zero-knowledge-proofs-illustrated-primer/">Generic techniques</a></span><span class="c0"> exist for proving a statement in zero knowledge: we can prove that </span><span class="c1">a client</span><span class="c0"> ha</span><span class="c1">s</span><span class="c0"> a token from a set of acceptable issuers without revealing which specific issuer it is. We’ll call this issuer blinding. </span><span class="c0">The generic approach is often slow, but </span><span class="c3 c1"><a class="c5" href="https://www.ietf.org/archive/id/draft-orru-zkproof-sigma-protocols-01.html">bespoke approaches</a></span><span class="c0"> tailored to the underlying cryptography can improve this considerably. </span></p>
<p class="c54"><span class="c0">Another challenge is how sites using rate limits decide who to trust to issue tokens. If an issuer misbehaves then the site’s rate limits become ineffective, enabling volumetric abuse. However, if we need to prevent the site from learning which issuers a user has access to, the site is only going to know that one of its trusted issuers was used, not which one. This makes mistakes or misbehaviour by an issuer difficult to detect, and makes it hard for sites to evaluate new issuers. Solving this challenge is essential for openness. Without adequate information, </span><span class="c0">sites are likely to lean towards conservative issuer selection. </span><span class="c1">That could lead to less choice between Anchors, which in turn could lead to a new form of gatekeeper being created.</span><span class="c0"> </span></p>
<p class="c32"><span class="c0">To solve this, sites at least need a way to calculate an aggregate score for each issuer they use. This should roughly correspond to how much of the traffic it considers abusive to have come from users using that particular issuer. Mozilla has long invested in systems like </span><span class="c3 c1"><a class="c5" href="https://blog.mozilla.org/en/firefox/partnership-ohttp-prio/">Prio</a></span><span class="c0"> which use multiparty computation (MPC) to protect user privacy whilst enabling aggregate measurements of system behaviour. </span></p>
<p class="c59"><span class="c0">Privacy Pass also struggles to handle dynamic adjustments to rate limits. Once tokens have been issued, they’re difficult to invalidate without either revoking all active tokens or risking attacks which can compromise the privacy of users. It’s also beneficial if sites can adjust rate limits on a per </span><span class="c1">client</span><span class="c0"> basis, for example by increasing rate limits where they become more confident the </span><span class="c1">client</span><span class="c0"> is benign and withdrawing access </span><span class="c1">when abuse is detected</span><span class="c0">. </span></p>
<p class="c47"><span class="c3 c1"><a class="c5" href="https://www.ietf.org/archive/id/draft-schlesinger-cfrg-act-00.html">Anonymous Credit Tokens</a></span><span class="c0"> </span><span class="c0">offer a useful building block to solve this problem. Conventional Privacy Pass schemes rely on issuing a bucket of tokens but ACT works differently by enabling the use of a credential with state. For example, an ACT credential can hold an internal counter. When the credential is presented, the site can check the counter is over some threshold and mutate it, increasing or decreasing </span><span class="c1">the counter whenever</span><span class="c0"> the site’s perception of the holder has improved or worsened. Critically, the exact value is never leaked to the site, preventing the site from tracking the holder and ensuring successive presentations of the same credential can’t be linked. </span></p>
<h3 class="c24"><span class="c2 c1">Putting it together </span></h3>
<p class="c19"><span class="c1">So how can we combine these techniques to build a system which can enable privacy-preserving rate limiting on the open web? In May 2026, we participated in a </span><a href="https://pactworkshop.com/"><span class="c17 c1">W3C CG Meeting</span></a><span class="c0"> in collaboration with Cloudflare, Chrome and other web stakeholders in which we started sketching out a design we’re calling PACT – Private Access Control Tokens. </span></p>
<p class="c19"><span class="c0">Rate limits need a starting point, a source of scarcity to anchor on. We’ll call an entity that provides such a source an </span><span class="c2 c1">Anchor</span><span class="c0">. To a user who meets the Anchor’s criteria, like having a subscription,</span><span class="c0"> an account in good standing</span><span class="c0">, or a verified phone number, an Anchor issues a batch of </span><span class="c2 c1">Endorsement </span><span class="c0">tokens, following the Privacy Pass model. In practice, Anchors could be any website which has access to this kind of signal. An Endorsement conveys</span><span class="c1"> </span><span class="c0">scarcity to other sites. </span></p>
<p class="c51"><span class="c0">That’s enough for a simple system where access is </span><span class="c1">either granted or denied</span><span class="c0">. But as we discussed earlier, we also want the ability to increase access where a visitor behaves benignly and decrease it where they don’t. </span><span class="c1">The state needed to enforce a rate limit</span><span class="c0"> can’t live in the Endorsement, because Endorsements cross trust boundaries between unrelated sites. We need a second object that can hold that state, scoped to the party that maintains it. </span></p>
<p class="c48"><span class="c0">We’ll call that the party that handles rate limiting for a site a </span><span class="c2 c1">Moderator </span><span class="c0">and the stateful object a </span><span class="c2 c1">Credential</span><span class="c0">. </span><span class="c1">A Credential is specific to a Moderator and, unlike endorsements, we limit each site to nominating a single Moderator. In the common case the site itself plays the Moderator role, so there’s no new entity or trust boundary. </span><span class="c1">A Moderator can also be a third-party service shared across many sites, allowing those sites to cooperatively share a rate limit.</span><span class="c0"> </span></p>
<p class="c48"><span class="c0">In the terminology of the previous section, the Anchor is the issuer of Endorsements, and the Moderator both verifies Endorsements and issues Credentials. A Moderator manages rate-limit policy: it decides which Anchors it trusts, accepts their Endorsements, and issues a Credential in return.</span></p>
<p class="c14"><img alt="" title=""><img alt="A diagram showing an overview of the PACT system" class="aligncenter size-full wp-image-48381" height="1655" src="https://hacks.mozilla.org/wp-content/uploads/2026/06/pact-drawings-5.excalidraw21-scaled.png" width="2560"></p>
<p class="c14"><strong><span class="c1 c20">Figure 2: </span></strong><span class="c1"><em>(1) Clients acquire Endorsements from Anchors in the course of normal browsing to sites they have relationships with. (2) Clients can exchange Endorsements for a stateful Credential from a Moderator. (3) Credentials can be used to access sites which use that Moderator. Credentials can be updated over time.</em> </span></p>
<p class="c41"><span class="c0">Directly revealing which Anchor backed an Endorsement would leak a lot of information about the user. The issuer blinding techniques from the previous section solve this: when an Endorsement is redeemed, the Moderator only learns that it came from one of </span><span class="c1">the </span><span class="c0">Anchors it trusts, but not which one. </span></p>
<p class="c28"><span class="c0">When a Moderator covers more than one site, we let Credentials be presented across all of them but partition cookies and storage as</span><span class="c1"> we would for any other third party site</span><span class="c0">. The unlinkability of </span><span class="c1">Credential</span><span class="c0"> presentations keeps this from creating a new cross-site identifier. The benefit is that good behaviour on one site improves access on every site the Moderator covers, and bad behaviour cuts it everywhere. Websites can already build the same capability with a shared account system, so this doesn’t create a new way to lock users out, but it </span><span class="c1">does provide a</span><span class="c0"> new way to grant access without requiring users to give up their privacy. </span></p>
<p class="c28"><span class="c0">Enabling Moderators that cover many sites carries a centralisation risk, simila</span><span class="c1">r </span><span class="c0">to the concentration we see today in anti-abuse providers. The mitigation is that the choice of Moderator stays with each site, and the choice of trusted Anchors stays with each Moderator. Th</span><span class="c1">is</span><span class="c0"> </span><span class="c1">can’t</span><span class="c0"> reverse the centralisation pressure the web already faces, but it </span><span class="c1">ensures this system won’t lead to additional lock-in</span><span class="c0">: a new Anchor or a new Moderator can be adopted without coordinating with a dominant vendor. </span></p>
<p class="c46"><span class="c0">The </span><span class="c1">system then has three flows</span><span class="c0">.</span><span class="c0"> First, the user </span><span class="c1">receives</span><span class="c0"> Endorsements from an Anchor in the course of normal interaction</span><span class="c1">, based on the Anchor’s positive view of the user</span><span class="c0">. This is </span><span class="c0">a relatively rare operation for any given user and Anchor. After all, as our source of scarcity, Endorsements should not be too easy to accumulate.</span></p>
<p class="c10"><img alt="" title=""><img alt="A diagram showing the PACT Anchor Flow" class="aligncenter size-full wp-image-48377" height="1789" src="https://hacks.mozilla.org/wp-content/uploads/2026/06/pact-drawings-3.excalidraw1-scaled.png" width="2560"></p>
<p class="c10"><strong><span class="c20 c1">Figure 3</span></strong><span class="c1">: <em>In the course of normal browsing, clients browse to websites they have a relationship with. These sites can act as Anchors by issuing Endorsements to clients.</em></span></p>
<p class="c26"><span class="c0">Second, when the user arrives at a site that works with a Moderator, the browser spends an Endorsement from an Anchor the Moderator trusts and receives a Credential in return. The presentation hides </span><span class="c13 c11 c1">which </span><span class="c0">Anchor was used, and </span><span class="c1">neither the Anchor nor the Moderator can trace the Endorsement back to where it was issued</span><span class="c0">. The Moderator decides what initial balance the Credential starts with. If the user has no Endorsements from suitable Anchors at all, existing mechanisms (CAPTCHAs, account creation, federated login) </span><span class="c1">could be used to</span><span class="c0"> bootstrap a Credential the same way, so the system degrades to today’s experience rather than locking the user out.</span></p>
<p class="c7"><img alt="" title=""><img alt="A diagram showing the protocol flow between Anchors and Moderators" class="aligncenter size-full wp-image-48378" height="1789" src="https://hacks.mozilla.org/wp-content/uploads/2026/06/pact-drawings-4.excalidraw1-scaled.png" width="2560"></p>
<p class="c7"><span class="c20 c1"><strong>Figure 4</strong></span><span class="c1"><strong>:</strong><em> When the client browses to a site, it can prompt the client for a Credential from the Moderator it uses. If the Client doesn’t have a suitable Credential, but does have a suitable Endorsement, it can exchange it for a Credential with the Moderator. In practice, the Moderator and the Site might be the same server. </em></span><em><span class="c0"> </span></em></p>
<p class="c25"><span class="c0">Third, as the user browses, the browser presents the Credential and the Moderator updates </span><span class="c1">the internal state of the Credential</span><span class="c0">. The </span><span class="c1">Moderator can reward </span><span class="c0">behaviour that looks benign and </span><span class="c1">penalize suspicious activity</span><span class="c0">, </span><span class="c1">but can’t track the use of the Credential or identify it if it’s used on other sites the Moderator covers</span><span class="c0">. </span><span class="c0">Revocation falls out of the same mechanism: a Moderator </span><span class="c1">can refuse to return an updated Credential</span><span class="c0">.</span><span class="c0"> </span></p>
<p class="c7"><img alt="" title=""><img alt="A diagram showing the PACT Moderator Flow" class="aligncenter size-full wp-image-48379" height="1618" src="https://hacks.mozilla.org/wp-content/uploads/2026/06/pact-drawings-5.excalidraw1-scaled.png" width="2560"></p>
<p class="c7"><strong><span class="c20 c1">Figure 5</span></strong><span class="c0"><strong>:</strong> <em>The Client can present the Credential on sites which use the matching Moderator. Sites can check if the Credential is in good standing. The sites can then adjust the access the Credential has in response to behaviour. E.g. increasing it when they gain confidence in the client or reducing it in response to malicious behaviour.</em></span></p>
<p class="c23"><span class="c0">In practice, all of this would happen transparently to the user through a WebAPI that sites acting as Anchors or Moderators would call from JavaScript. In an ideal ecosystem, users would accumulate Endorsements through normal browsing, just by virtue of the sites they already visit, and the rest of the flow would happen in the background as they move around the web, leaving </span><span class="c1">users</span><span class="c0"> with meaningfully less friction. </span></p>
<p class="c16"><span class="c0">AI agents acting on behalf of a user slot into the same flow. An agent can carry its user’s Credentials, in which case the user remains accountable for how the agent </span><span class="c1">behaves.</span><span class="c0"> </span><span class="c1">S</span><span class="c0">ites would not need to grant any more access than they would to the user themselves. Alternatively, the operator of an agent can run its own Anchor and vouch for its agents the way other Anchors vouch for human users. </span><span class="c0">Sites retain control over which Anchors they accept, so they can choose how to treat agent traffic without needing a separate detection mechanism. </span></p>
<p class="c6"><span class="c0">Several mechanisms combine to keep the information about a user that flows out close to a single bit. Cryptographic unlinkability ensures successive Credential presentations cannot be tied to each other or to the original issuance, so a user’s visits cannot be </span><span class="c1">joined</span><span class="c0"> into a history. Each site is bound to a single Moderator, so the set of Moderators a user has Credentials with never becomes a cross-site fingerprint. The Anchor-to-Credential exchange happens in an isolated browsing context, so during ordinary browsing the only thing the site or its Moderator ever observes is a Credential presentation: </span><span class="c1">the site only learns if </span><span class="c0">the user has a valid Credential below the rate limit, or </span><span class="c1">nothing</span><span class="c0">. </span><span class="c1">W</span><span class="c0">hen the Moderator updates a </span><span class="c1">Credential</span><span class="c0">, it</span><span class="c0"> adjusts the credentials state without learning what it is.</span></p>
<p class="c6"><span class="c1">The additional privacy given to users from </span><span class="c0">Issuer blinding</span><span class="c1"> makes participating in the system more challenging for Moderators</span><span class="c0">. Because the Moderator can’t see which Anchor backed a Credential at issuance, it can’t give a Credential from a strong Anchor </span><span class="c1">more access</span><span class="c0"> than one from a weak Anchor: doing so would itself leak which Anchor was used. The initial </span><span class="c1">access</span><span class="c0"> has to be uniform across the Moderator’s whole pool of Anchors, which in practice means setting it at the strength of the weakest. </span><span class="c1">However, this is only relevant for that initial access, the Moderator can update credentials according to the holder’s behavior, enabling Credential’s to accrue access over time.</span></p>
<p class="c42"><span class="c0">Building an open ecosystem also requires that sites can make effective decisions about the Anchors they choose to trust</span><span class="c1">. M</span><span class="c0">ultiparty computation systems like </span><span class="c0">Prio</span><span class="c0"> enable aggregate scoring without compromising pr</span><span class="c1">ivacy</span><span class="c0">. When users present Credentials, they can provide an encrypted share which identifies the anchor they use</span><span class="c1">d and can be privately aggregated to compute the quality of an issuer.</span></p>
<h3 class="c24"><span class="c2 c1">Next Steps </span></h3>
<p class="c49"><span class="c1">We think the</span><span class="c0"> architecture we</span><span class="c1">’ve </span><span class="c0">sketched </span><span class="c1">for PACT </span><span class="c0">has the right shape, but many of the details still need to be worked out</span><span class="c1"> and the entire system needs rigorous privacy and security analysis.</span></p>
<p class="c45"><span class="c0">We want to do that work in the open. The IETF is the natural venue for the cryptographic protocols underneath, and the W3C for the WebAPI surface that sits on top. </span><span class="c0">We’ll be </span><span class="c1">bringing</span><span class="c0"> </span><span class="c3 c1"><a class="c5" href="https://github.com/Moderation-of-unLinkable-Endorsements">draft specifications</a></span><span class="c1"> to these bodies as soon as they’re ready</span><span class="c0">, and we welcome collaborators from across the ecosystem: browser vendors, site operators, anti-abuse providers, and the cryptography community. </span></p>
<p class="c29"><span class="c0">If successful, we think we can provide a system which will keep the web open and </span><span class="c1">private</span><span class="c0">, while still giving sites the rate-limiting signal they need. </span></p>
<h3 class="c29"><span class="c2 c1">Acknowledgements</span></h3>
<p class="c4"><em><span class="c11 c1">The ideas described here are the result of collaboration and conversations with many people, including: Watson Ladd, Thibault Meunier, Michele Orrù, Trevor Perrin, Eric Rescorla, Samuel Schlesinger, Martin Thomson, Eric Trouton, Benjamin Vandersloot &amp; Cathie Yun.</span></em><span class="c11 c1"><em> </em> </span></p>
<hr class="c58">
<div>
<p class="c31"><a href="https://hacks.mozilla.org/?p=48374#:~:text=%5B1%5D">[1]</a><span class="c0"> PAT requires that the source of scarcity and an independent issuer be trusted not to collude. If they do, they can track users as they interact with the system. This is not suitable in the context of an open system where any party could play those two roles.</span></p>
</div>
<p>The post <a href="https://hacks.mozilla.org/2026/06/pact-anonymous-credentials-for-the-web/">PACT: Anonymous Credentials for the Web</a> appeared first on <a href="https://hacks.mozilla.org/">Mozilla Hacks - the Web developer blog</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The Rust Programming Language Blog: crates.io: development update]]></title>
<description><![CDATA[Another six months have passed since our last development update, and the crates.io team has been busy. Here's a summary of the most notable changes and improvements made to crates.io since then.

Source Code Viewer
Crate pages now have a "Code" tab that lets you browse the contents of published ...]]></description>
<link>https://tsecurity.de/de/3693285/tools/the-rust-programming-language-blog-cratesio-development-update/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693285/tools/the-rust-programming-language-blog-cratesio-development-update/</guid>
<pubDate>Sat, 25 Jul 2026 08:37:18 +0200</pubDate>
<category>💾  Tools</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Another six months have passed since our <a href="https://blog.rust-lang.org/2026/01/21/crates-io-development-update/" rel="external">last development update</a>, and the crates.io team has been busy. Here's a summary of the most notable changes and improvements made to <a href="https://crates.io/" rel="external">crates.io</a> since then.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/07/13/crates-io-development-update/#source-code-viewer"></a>
Source Code Viewer</h3>
<p>Crate pages now have a "Code" tab that lets you browse the contents of published crate versions directly on crates.io. This shows you the exact files that <code>cargo</code> downloads when you add a crate as a dependency, which might differ from the linked repository. This makes it much easier to audit your dependencies, including files that never appear in the repository, like the normalized <code>Cargo.toml</code> files that <code>cargo</code> generates.</p>
<p><img alt='Source code viewer showing the "Code" tab of the serde crate' src="https://blog.rust-lang.org/2026/07/13/crates-io-development-update/code-tab.png"></p>
<p>The viewer comes with a file tree sidebar with search functionality, syntax highlighting, and GitHub-style line selection, where clicking or dragging line numbers produces shareable <code>#L10-L20</code> URLs.</p>
<p>Under the hood, the server now builds a zip file for every published version. Since the <code>.crate</code> files that <code>cargo</code> consumes are gzipped tarballs without random access support, a background job re-packs each of them into a seekable zip archive plus a JSON manifest describing the contained files. Both are served from our static CDN. The frontend then fetches only the manifest and loads each file on demand with an HTTP range request. Because of this architecture, browsing crate sources essentially adds no load on the crates.io API servers. Existing crate versions have been backfilled, so this works for old releases too.</p>
<p>The rendering library behind the code viewer is a diff renderer at heart, and that's no accident: a version-to-version diff viewer built on the same infrastructure is currently in the works. This will allow you to review exactly what changed between two published versions, right on crates.io. Stay tuned!</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/07/13/crates-io-development-update/#untangling-crates-io-accounts-from-github"></a>
Untangling crates.io Accounts from GitHub</h3>
<p>At the end of May, the crates.io team accepted <a href="https://github.com/rust-lang/rfcs/pull/3946" rel="external">RFC #3946</a>. Crates.io accounts always have been tightly coupled to GitHub: signing in means "Log in with GitHub", and your crates.io identity is your GitHub username. The RFC changes that. It introduces usernames that are native to crates.io and independent of linked GitHub accounts, as a prerequisite for eventually supporting login via other identity providers.</p>
<p>The implementation of crates.io usernames has started, but there is still a lot left to do, most visibly the ability to change your crates.io username. After that is complete, there will be future RFCs and implementation for signing in with identity providers other than GitHub. Since all of this touches authentication and account security, we are deliberately taking it slow and rolling these changes out in small, carefully reviewed steps.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/07/13/crates-io-development-update/#advisories-and-suggestions"></a>
Advisories and Suggestions</h3>
<p>In our <a href="https://blog.rust-lang.org/2026/01/21/crates-io-development-update/" rel="external">January update</a> we introduced the "Security" tab, which shows security advisories from the <a href="https://rustsec.org/" rel="external">RustSec</a> database. We have since taken this integration one step further: crates that RustSec has flagged as unmaintained now show a warning banner directly on their crate pages, linking to the corresponding advisory for details and possible alternatives. Thanks to <a href="https://github.com/djc" rel="external">Dirkjan Ochtman</a> for implementing this feature!</p>
<p><img alt="Unmaintained warning banner on the ansi_term crate page" src="https://blog.rust-lang.org/2026/07/13/crates-io-development-update/unmaintained-banner.png"></p>
<p>Related to this, some popular crates have been largely absorbed into the Rust standard library over the years, like <code>lazy_static</code>, which has been superseded by <code>std::sync::LazyLock</code> since Rust 1.80. Crate pages of such crates now show a friendly "You might not need this dependency" banner describing the standard library replacement, and superseded crates in dependency lists get a small light bulb icon with a similar hint.</p>
<p><img alt='"You might not need this dependency" banner on the lazy_static crate page' src="https://blog.rust-lang.org/2026/07/13/crates-io-development-update/std-replacement-banner.png"></p>
<p>The dataset behind this feature lives in the new <a href="https://github.com/rust-lang/std-replacement-data" rel="external">rust-lang/std-replacement-data</a> repository, together with a documented inclusion policy: standard library replacements only, every entry must cite the stable <code>std</code>, <code>core</code>, or <code>alloc</code> API and Rust version, and crate maintainers get a notice-and-comment window before an entry is added. New entries can be proposed upstream and can benefit other tools too.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/07/13/crates-io-development-update/#ferris"></a>
Ferris</h3>
<p>The most delightful change of this cycle: the Ferris on our error pages now follows your mouse cursor with its eyes:</p>
<p><img alt="Ferris' eyes following the mouse cursor on the error page" src="https://blog.rust-lang.org/2026/07/13/crates-io-development-update/ferris.gif"></p>
<p>Getting a 404 error on crates.io is now slightly less sad.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/07/13/crates-io-development-update/#svelte-frontend-migration-completed"></a>
Svelte Frontend Migration Completed</h3>
<p>In our <a href="https://blog.rust-lang.org/2026/01/21/crates-io-development-update/" rel="external">January update</a>, we announced that we were experimenting with porting the crates.io frontend from Ember.js to <a href="https://svelte.dev/" rel="external">Svelte</a>. This experiment has concluded successfully: the new frontend reached feature parity, went through a <a href="https://blog.rust-lang.org/inside-rust/2026/04/17/crates-io-svelte-public-testing/" rel="external">public testing phase</a> in April, became the default at the beginning of May, and the Ember.js app has been removed from our repository.</p>
<p>We designed this change to be invisible for our users, since the new frontend is a 1:1 port of the previous design and functionality. For the team and our contributors, however, it is a big deal: the frontend is now built on a more modern framework, which should make it easier for new contributors to get started. It also allows us to iterate faster, as the source code viewer above demonstrates.</p>
<p>We want to thank the <a href="https://emberjs.com/teams/" rel="external">Ember.js team</a> for a framework that served crates.io well for many years, and the Svelte team for making the transition so enjoyable.</p>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/07/13/crates-io-development-update/#miscellaneous"></a>
Miscellaneous</h3>
<p>These were some of the more visible changes to crates.io over the past six months, but a lot has happened "under the hood" as well:</p>
<ul>
<li>
<p><strong>Search performance</strong>: Relevance-sorted search queries previously ranked every crate matching the query, which could take 1-2 seconds for short or common search terms. Ranking is now bounded to the 1,000 matching crates with the highest recent download counts.</p>
</li>
<li>
<p><strong>Reverse dependencies performance</strong>: The reverse dependencies endpoint no longer recomputes the full dependent set on every request. It is now served from a precomputed table kept in sync by database triggers, turning an expensive join into a bounded index scan and greatly reducing the chance of getting a timeout error.</p>
</li>
<li>
<p><strong>New ARCHITECTURE.md</strong>: If you've ever wondered how crates.io actually works, our <a href="https://github.com/rust-lang/crates.io/blob/main/docs/ARCHITECTURE.md" rel="external"><code>ARCHITECTURE.md</code></a> document got a complete rewrite. It is now organized around the high-level systems that make up crates.io and how they fit together, and includes walkthroughs of what happens when you run <code>cargo publish</code>, why a typical crate download never touches our API servers, and how download counts are derived from CDN access logs.</p>
</li>
<li>
<p><strong>Definition lists</strong>: READMEs now render Markdown <a href="https://github.com/rust-lang/crates.io/pull/13950" rel="external">definition lists</a>, a widely used Markdown extension. Our markdown renderer <a href="https://crates.io/crates/comrak" rel="external">comrak</a> already supported them, the extension just wasn't enabled yet. Thanks to <a href="https://github.com/mistaste" rel="external">@mistaste</a> for this contribution!</p>
</li>
<li>
<p><strong>CDN cache tags</strong>: Files uploaded to our static CDN now carry cache-tag metadata, allowing us to invalidate all cached files of a crate or a specific release in a single operation, instead of issuing one invalidation per file URL.</p>
</li>
<li>
<p><strong>Caching improvements</strong>: We removed a global <code>Vary: Cookie</code> response header that was preventing our CDNs from caching public API responses and frontend assets effectively. Per-user responses now use <code>Cache-Control: no-store</code> instead, resulting in better cache hit rates at the CDN edge.</p>
</li>
<li>
<p><strong>Accessibility</strong>: We have made crates.io friendlier to screen readers: decorative icons are now hidden from the accessibility tree, heading hierarchies have been fixed, and lists are marked up as proper lists. ARIA snapshot tests now ensure that regressions can't slip in unnoticed. We plan to continue to improve crates.io accessibility over the coming months.</p>
</li>
<li>
<p><strong>Git index performance</strong>: The background worker's local clone of the git index is now a bare and shallow repository, eliminating roughly 250,000 checked-out files and the full commit history from its disk, improving its performance as we see increased rates of crate publication. The periodic index squashing now goes through the GitHub API instead of generating large git packs locally, which had previously caused out-of-memory failures on the production worker.</p>
</li>
</ul>
<h3><a class="anchor" href="https://blog.rust-lang.org/2026/07/13/crates-io-development-update/#feedback"></a>
Feedback</h3>
<p>We hope you enjoyed this update on the development of crates.io. If you have any feedback or questions, please let us know on <a href="https://rust-lang.zulipchat.com/#narrow/stream/318791-t-crates-io" rel="external">Zulip</a> or <a href="https://github.com/rust-lang/crates.io/discussions" rel="external">GitHub</a>. We are always happy to hear from you and are looking forward to your feedback!</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Lightmatter's New 65.5 Trillion OPS Light Chip Made NVIDIA's Billion Dollar GPU's Look Like a JOKE!]]></title>
<description><![CDATA[Author: Evolving AI - Bewertung: 293x - Views:5495 The future of AI chips might not run on electricity. It might run on light.

In this video, we break down how Lightmatter is using photonic computing to attack one of the biggest problems in artificial intelligence: moving massive amounts of data...]]></description>
<link>https://tsecurity.de/de/3693247/videos/lightmatters-new-655-trillion-ops-light-chip-made-nvidias-billion-dollar-gpus-look-like-a-joke/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693247/videos/lightmatters-new-655-trillion-ops-light-chip-made-nvidias-billion-dollar-gpus-look-like-a-joke/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:14 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Evolving AI - Bewertung: 293x - Views:5495 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/XimElc33jyA?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>The future of AI chips might not run on electricity. It might run on light.<br />
<br />
In this video, we break down how Lightmatter is using photonic computing to attack one of the biggest problems in artificial intelligence: moving massive amounts of data between chips without wasting huge amounts of power. Lightmatter’s Envise processor uses light to perform AI calculations such as matrix multiplication, while its Passage platform uses optical interconnects to move data between AI chips at extreme speeds. The company has demonstrated real AI workloads including ResNet, BERT, and reinforcement learning models, while targeting the growing power and bandwidth crisis inside modern AI data centers. We also explore the Passage M1000 photonic superchip, Lightmatter’s collaboration with Qualcomm, its involvement in NVIDIA’s NVLink Fusion ecosystem, and why optical computing could become critical as AI clusters continue scaling. Could light-powered AI chips replace traditional electronic computing, or will photonics first transform how GPUs communicate within massive data centers?<br />
<br />
#AIChips #Lightmatter #PhotonicComputing #Nvidia #ArtificialIntelligence #DataCenter #FutureTech<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[NVIDIA Built a GPU in The Size of a FACTORY That Can Wipe Out Entire AI Hardware INDUSTRY!]]></title>
<description><![CDATA[Author: Evolving AI - Bewertung: 452x - Views:13629 NVIDIA just unveiled Rubin, but this isn't just another GPU. It's a complete AI factory built to power the next generation of artificial intelligence. In this video, we break down NVIDIA's Vera Rubin platform, a fully co-designed AI system that ...]]></description>
<link>https://tsecurity.de/de/3693238/videos/nvidia-built-a-gpu-in-the-size-of-a-factory-that-can-wipe-out-entire-ai-hardware-industry/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693238/videos/nvidia-built-a-gpu-in-the-size-of-a-factory-that-can-wipe-out-entire-ai-hardware-industry/</guid>
<pubDate>Sat, 25 Jul 2026 08:36:02 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Evolving AI - Bewertung: 452x - Views:13629 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/6TUKgqSFCcU?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>NVIDIA just unveiled Rubin, but this isn&#039;t just another GPU. It&#039;s a complete AI factory built to power the next generation of artificial intelligence. In this video, we break down NVIDIA&#039;s Vera Rubin platform, a fully co-designed AI system that combines the Vera CPU, Rubin GPU, NVLink 6, BlueField-4 DPU, ConnectX-9 SuperNIC, and Spectrum networking into one massive AI infrastructure platform. You&#039;ll learn why Rubin delivers up to 50 petaflops of AI inference, 288GB of HBM4 memory per GPU, 3.6 exaflops of compute per NVL72 rack, over 260TB/s of NVLink bandwidth, and why NVIDIA claims up to 10x lower AI inference costs than Blackwell. We also explore why AI companies like Microsoft, OpenAI, Anthropic, Meta, xAI, Google, AWS, Oracle, and CoreWeave are already adopting Rubin, and why NVIDIA believes the future of AI isn&#039;t a faster GPU; it&#039;s an entire factory built to manufacture intelligence. Is Rubin the biggest leap in AI hardware yet, or the beginning of a completely new era of AI infrastructure?<br />
<br />
#NVIDIA #Rubin #AIFactory #AIChips #ArtificialIntelligence #HBM4 #DataCenter<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[AMD's 19.6 TB/s Monster AI-Chip Just Made NVIDA's VERA RUBIN Look Like a JOKE!]]></title>
<description><![CDATA[Author: Evolving AI - Bewertung: 614x - Views:23208 AMD may have finally built a real challenger to NVIDIA’s AI empire. In this video, we break down the AMD Instinct MI400 series and the flagship MI455X AI accelerator, featuring 432GB of HBM4 memory, 19.6TB/s of memory bandwidth, up to 40 petaflo...]]></description>
<link>https://tsecurity.de/de/3693234/videos/amds-196-tbs-monster-ai-chip-just-made-nvidas-vera-rubin-look-like-a-joke/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693234/videos/amds-196-tbs-monster-ai-chip-just-made-nvidas-vera-rubin-look-like-a-joke/</guid>
<pubDate>Sat, 25 Jul 2026 08:35:56 +0200</pubDate>
<category>🎥 Videos</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Evolving AI - Bewertung: 614x - Views:23208 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/HYExTIvfCx8?autoplay=1&origin=https://tsecurity.de" frameborder="0"></iframe></p><p>AMD may have finally built a real challenger to NVIDIA’s AI empire. In this video, we break down the AMD Instinct MI400 series and the flagship MI455X AI accelerator, featuring 432GB of HBM4 memory, 19.6TB/s of memory bandwidth, up to 40 petaflops of FP4 compute, and an advanced chiplet architecture designed for next-generation AI training and inference. But AMD’s real weapon is bigger than one chip. The Helios rack-scale AI platform combines 72 MI455X GPUs with next-generation AMD EPYC “Venice” CPUs, massive HBM4 capacity, high-speed networking, ROCm software, and open technologies like UALink to challenge NVIDIA’s tightly integrated AI infrastructure. We also explore how AMD plans to compete with NVIDIA Vera Rubin, the importance of ROCm versus CUDA, and why major AI companies and cloud providers are increasingly looking for alternatives to NVIDIA. Could AMD finally turn the AI accelerator market into a real two-company war?<br />
<br />
#AMD #NVIDIA #MI455X #AIChips #InstinctMI400 #Helios #ArtificialIntelligence<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[7 CRM trends for 2026: AI brings decisive action to customer workflows]]></title>
<description><![CDATA[Agentic AI has advanced from the promises-and-pilots phase of 2025 to reality and rollouts in 2026. In the process, agentic AI is transforming virtually every aspect of customer relationship management (CRM), the platform that manages sales, marketing, and customer service.



“Last year, everybo...]]></description>
<link>https://tsecurity.de/de/3693117/it-nachrichten/7-crm-trends-for-2026-ai-brings-decisive-action-to-customer-workflows/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693117/it-nachrichten/7-crm-trends-for-2026-ai-brings-decisive-action-to-customer-workflows/</guid>
<pubDate>Sat, 25 Jul 2026 06:53:15 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Agentic AI has advanced from the promises-and-pilots phase of 2025 to reality and rollouts in 2026. In the process, agentic AI is transforming virtually every aspect of <a href="https://www.cio.com/article/272365/what-is-crm-software-for-managing-customer-data.html">customer relationship management (CRM)</a>, the platform that manages sales, marketing, and customer service.</p>



<p class="wp-block-paragraph">“Last year, everybody was dipping their toes into the water,” says <a href="https://futurumgroup.com/keith-kirkpatrick/">Keith Kirkpatrick</a>, research director at The Futurum Group. This year, agentic AI has built momentum from the boardroom down, with companies recognizing that having an AI strategy is imperative. “They feel like if they don’t embrace it now, their competitors will.”</p>



<p class="wp-block-paragraph"><a href="https://www.deloitte.com/global/en/about/people/profiles.gx-harry-datwani+f20748dc.html">Harry Datwani</a>, a principal at Deloitte Digital, adds that enterprise CRM customers have transitioned from “proof of concept” to “scale and execution.”</p>



<p class="wp-block-paragraph">“Across sales, service, marketing, even in the commerce space, enterprises are really using AI and agentic,” he says.</p>



<p class="wp-block-paragraph">“CRM in 2026 is undergoing a structural shift, not just an incremental evolution,” says Forrester analyst <a href="https://www.forrester.com/analyst-bio/kate-leggett/BIO2629">Kate Leggett</a>, noting that AI is becoming a core part of CRM infrastructure, not just a feature or an add-on. According to Forrester data, around 70% of companies are already using AI in their CRM systems, she says.</p>



<p class="wp-block-paragraph">Here are the hot AI-driven trends in CRM this year.</p>



<h2 class="wp-block-heading">CRM becomes an action hero</h2>



<p class="wp-block-paragraph">CRM platforms have traditionally served as passive, static systems of record. Now, agentic AI is transforming CRM into a powerful, real-time solution that can act autonomously.</p>



<p class="wp-block-paragraph">“Organizations that rethink CRM as a real-time, AI-powered system of action — and embrace agentic AI to handle complex, unpredictable work — are better positioned to deliver exceptional customer experiences,” says IDC analyst <a href="https://my.idc.com/getdoc.jsp?containerId=PRF005191">Neil Ward-Dutton</a>. “This approach not only enhances satisfaction and loyalty but also drives operational efficiency and business agility.”</p>



<p class="wp-block-paragraph">Forrester’s Leggett says that AI-powered CRM platforms have advanced from simple data capture to real-time decision-making and execution. Standard capabilities include next-best action recommendations, call summaries, automated updates, generated emails, knowledge creation, predictive forecasting, and deal scoring.</p>



<p class="wp-block-paragraph">She adds that AI agents can now execute workflows, such as routing cases, sending follow-ups, and updating records (with human oversight). They can also handle end-to-end service and sales tasks autonomously, including case resolutions and sales development activities.</p>



<h2 class="wp-block-heading">Agentic drives workforce changes</h2>



<p class="wp-block-paragraph">AI use in CRM systems is also impacting workforce strategies.</p>



<p class="wp-block-paragraph">“We used to hire for deep expertise,” says Constellation Research analyst <a href="https://www.constellationr.com/user/liz-miller">Liz Miller</a>. “AI has commoditized expertise because I can take all that data from my CRM and train my AI models to go deep, to know everything about any product I’ve ever sold, from what has worked, what hasn’t, every price, every sale.”</p>



<p class="wp-block-paragraph">Now, instead of hiring candidates with deep expertise, organizations are looking for candidates who can go wide. “I can train a model to have deep expertise. What I can’t train for is experience, because experience is what happens when a person has gone broad across a lot of different scenarios and faced complexity across that broad scenario,” says Miller.</p>



<p class="wp-block-paragraph">For example, AI systems can automate many aspects of marketing, Miller notes, but there’s no substitute for creativity: people who can interrogate the data and come up with innovative marketing campaigns that connect with customers.</p>



<p class="wp-block-paragraph"><a href="https://www.servicenow.com/workflow/author/terence-chesire.html">Terence Chesire</a>, group vice president of ServiceNow CRM and industry workflows, says that organizations are using agentic AI to free up team members from repetitive, lower-value activities. Those employees have now moved to higher-level roles “where they’re working on transformational deals rather than just building a spreadsheet.”</p>



<p class="wp-block-paragraph">“That’s what we’re seeing as super-exciting as organizations not just free up people, but the speed and effort reduction and the friction reduction in what they can do,” he adds.</p>



<h2 class="wp-block-heading">Data layer takes center stage</h2>



<p class="wp-block-paragraph">AI’s promise to deliver actionable customer and marketing intelligence has placed even greater emphasis on the importance on sound data management practices for CRM.</p>



<p class="wp-block-paragraph">“The light bulb has flashed on very brightly for our clients,” says Deloitte’s Datwani. “Everyone is talking about AI agents, but your ability to really extract value is inextricably linked to the quality of your data and the ability to make that data accessible. What we’re finding is that despite large investments over time our clients still have fragmented data. And so, they are data rich and insight poor.”</p>



<p class="wp-block-paragraph">The good news, says Datwani, is that AI agents themselves can <a href="https://www.cio.com/article/2140371/gen-ai-can-be-the-answer-to-your-data-problems-but-not-all-of-them.html">help clean up and organize data</a>. And vendors such as <a href="https://www.cio.com/article/4030966/snowflake-and-databricks-vie-for-the-heart-of-enterprise-ai.html">Snowflake and Databricks</a>, along with the traditional CRM powerhouses, are offering powerful data analytics solutions. “Everyone is battling for that data layer,” Datwani says.</p>



<p class="wp-block-paragraph">Forrester’s Leggett adds that CRM platforms are converging with <a href="https://www.cio.com/article/308839/top-8-customer-data-platforms.html">customer data platforms (CDPs)</a>, real-time event streams, and external data sources to create connected customer data networks. These real-time, connected data models can help organizations deliver hyper-personalization at scale.</p>



<h2 class="wp-block-heading">Agentic ushers in pricing complexity</h2>



<p class="wp-block-paragraph">The shift from license- or subscription-based pricing to an <a href="https://www.cio.com/article/3624540/how-will-ai-agents-be-priced-cios-need-to-pay-attention.html">outcome or consumption pricing model</a> has the potential to help CIOs tie their CRM costs to specific business metrics, such as the number of customer service calls resolved per hour. But it has also introduced a <a href="https://www.cio.com/article/4184688/it-hurtles-toward-the-great-enterprise-pricing-reset.html">new level of complexity</a> when it comes to budgeting for CRM costs.</p>



<p class="wp-block-paragraph">For example, Chesire says ServiceNow’s CRM pricing plan starts with a baseline subscription model, and on top of that, customers get a certain number of AI tokens per user and can buy additional tokens as AI usage ramps up.</p>



<p class="wp-block-paragraph">Meanwhile, Salesforce has <a href="https://www.cio.com/article/4189183/salesforce-unveils-ai-help-agent-with-pay-per-resolution-pricing.html">rolled out pay-per-resolution pricing</a> with its recently unveiled AI Help Agent and last month <a href="https://www.cio.com/article/4183667/salesforce-to-acquire-usage-based-billing-specialist-m3ter.html">acquired usage-based billing specialist m3ter</a>. Oracle is also <a href="https://www.cio.com/article/4184271/oracle-wades-into-outcome-based-ai-billing-waters.html">piloting outcome-based AI pricing</a>.</p>



<p class="wp-block-paragraph">All these approaches undercut the predictability of the subscription model, which will complicate CIOs’ cost calculus, Deloitte’s Datwani says. “Now, as you start to think about consumption and tokens, costs might look different. As folks are opening up the architecture with things like headless CRM, what will the cost model look like for API calls or MCP server calls? So, there’s many more variables,” he adds.</p>



<h2 class="wp-block-heading">The rise of multi-agent orchestration</h2>



<p class="wp-block-paragraph">To act autonomously, agents need to access multiple data sets and software platforms seamlessly. As a result, the proliferation of agents, some embedded within specific vendor platforms and some created in-house, is going to require an orchestration layer, Futurum’s Kirkpatrick says.</p>



<p class="wp-block-paragraph">He points out that organizations need to monitor and manage agents, enforcing the same type of policy-based access control that exists for people. Organizations also need to set limits on what domains a specific agent can get into, what types of data they can access, what lines can’t they cross.</p>



<p class="wp-block-paragraph">Kirkpatrick predicts that a <a href="https://www.cio.com/article/4138739/21-agent-orchestration-tools-for-managing-your-ai-fleet.html">new class of orchestration tools</a> will emerge, although it’s not clear whether that orchestration layer will be provided by the leading CRM vendors, hyperscalers, or third parties.</p>



<p class="wp-block-paragraph">Datwani agrees. “The orchestration layer is an interesting area, where the traditional vendors are in on it, the hyperscalers are also offering it, and there are third parties. It’s my belief that there’s not going to be a clear winner.”<em></em></p>



<h2 class="wp-block-heading">The interface becomes conversational</h2>



<p class="wp-block-paragraph">Enterprise users who have traditionally had to manually wrangle with CRM systems are likely to find the ability to employ voice commands using a natural language interface to be a game changer. For starters, a salesperson can say, “I have a meeting today with Customer X. Help me prepare.” The agent will collect relevant data, ingest it, and provide a summary with recommendations.</p>



<p class="wp-block-paragraph">ServiceNow’s Chesire says voice-enabled CRM systems have an “almost magical” ability to record, transcribe, and understand the content of a call between a salesperson and a customer or potential customer. The system can then “build a quote” based on that conversation.</p>



<p class="wp-block-paragraph">On the customer service side of the equation, AI-driven voice technology enables customers to speak to an AI agent, describe the problem using natural language, and get a response. The agent has the capability to, for example, solve a credit card dispute, order a replacement product, send out a service rep, or do whatever is needed to resolve the issue, says Chesire.</p>



<p class="wp-block-paragraph">Beyond that, agentic technology is capable of understanding the underlying business process flaws that led to the product snafu, and make recommendations for ways to fix whatever led to the issue in the first place, he adds.</p>



<h2 class="wp-block-heading">Agentic drives business process transformation</h2>



<p class="wp-block-paragraph">With the emergence of outcome-based pricing, organizations are taking a fresh look at how they measure the benefits of CRM systems. That conversation is leading to an even more important analysis of underlying business processes. Or, as Constellation’s Miller says, “The old adage of applying new technology to old processes only gets you more expensive old processes.”</p>



<p class="wp-block-paragraph">“When we survey customers, we hear time and time again that the reason why they want to apply AI into their organizations is to foster exponential opportunity and exponential growth,” she says. “How do we get there with CRM has started to become the new conversation.”</p>



<p class="wp-block-paragraph">According to Miller, AI systems breach the walls of siloed data and can take a fresh look at legacy workflows. They also don’t get sucked into turf wars between marketing and sales teams. As a result, they often recommend new actions that can lead to better processes. “I think it’s starting to happen. You’re starting to see applications where AI is beginning to accelerate decision-making and decision velocity,” she says.</p>



<p class="wp-block-paragraph">“The next phase of maturity is going to be, how do we start to spread AI across our platforms so that we are seeing that holistic end-to-end relationship that we have always wanted to optimize. How do we thread that across platforms and across solutions. We’re starting to see organizations on the leading edge really start to pull those strategies together,” says Miller.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[MacBook Neo’s success wasn’t luck, it was a plan]]></title>
<description><![CDATA[It’s difficult to ignore the fact that Apple seems to have turned its MacBook Neo into a weapon to promote platform growth, with enough performance under the hood to make competitors seem inferior.



And even as the PC industry moves to try to compete with Apple’s last huge Mac success, the comp...]]></description>
<link>https://tsecurity.de/de/3693115/it-nachrichten/macbook-neos-success-wasnt-luck-it-was-a-plan/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693115/it-nachrichten/macbook-neos-success-wasnt-luck-it-was-a-plan/</guid>
<pubDate>Sat, 25 Jul 2026 06:47:11 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">It’s difficult to ignore the fact that Apple seems to have <a href="https://www.computerworld.com/article/4180406/after-a-quick-1-1m-sales-macbook-neo-set-to-reshape-the-pc-industry.html">turned its MacBook Neo into a weapon</a> to promote platform growth, with enough performance under the hood to make competitors seem inferior.</p>



<p class="wp-block-paragraph">And even as the PC industry moves to try to compete with Apple’s last <a href="https://www.applemust.com/macbook-neo-continues-to-top-amazon-laptop-charts-in-us-uk/" target="_blank" rel="noreferrer noopener">huge Mac success</a>, the company is already planning a powerful follow-up.</p>



<p class="wp-block-paragraph">That points to the discipline Apple has applied to the Mac since the introduction of Apple Silicon. The company has built a clear product roadmap, strong entry-level pricing, and steady performance gains. This focus is now paying dividends, giving people the impetus to keep placing their trust in Apple and its Macs — even as the industry raises prices in the face of RAMageddon and price increases. </p>



<h2 class="wp-block-heading"><strong>The numbers don’t lie</strong></h2>



<p class="wp-block-paragraph">“Apple’s recent price increase seems to be an inevitable response to these cost increases. In the second half of the year, other PC OEMs are expected to continue to raise prices, and the overall ASP increase is expected to continue,” <a href="https://counterpointresearch.com/en/insights/global-pc-shipments-decline-q2-2026-memory-crisis" data-type="link" data-id="https://counterpointresearch.com/en/insights/global-pc-shipments-decline-q2-2026-memory-crisis" target="_blank" rel="noreferrer noopener">Counterpoint said in a post Wednesday</a>. The researcher tells us global PC shipments shrank 4% in the second quarter of 2026 as rising costs hit demand. The Mac maker, by contrast, moved in the opposite direction, generating 13% growth in the quarter — mainly on the back of the MacBook Neo introduction. </p>



<p class="wp-block-paragraph"><a href="https://www.idc.com/resource-center/press-releases/2q26-pc-top5/" target="_blank">Recent IDC data</a> gives Apple 10.1% year-over-year growth and just under 10% (9.9% to be exact) of the worldwide PC market, even as the overall market declined 4.9%.</p>



<p class="wp-block-paragraph">“With emerging supply chain and tariff challenges inflating memory prices…, Apple’s incredibly aggressive price-point for the MacBook Neo makes its release feel all the more like a gut punch to one of the PC market’s most valuable price tiers,” Futurum Research Director <a href="https://www.computerworld.com/article/4143010/apples-macbook-neo-first-reviews-and-analyst-reactions.html" data-type="link" data-id="https://www.computerworld.com/article/4143010/apples-macbook-neo-first-reviews-and-analyst-reactions.html">Olivier Blanchard said when the Neo was released</a>. </p>



<h2 class="wp-block-heading"><strong>Neo 2.0 is already coming</strong></h2>



<p class="wp-block-paragraph">In the immediate future, as competitors raise prices on the PCs that compete with Apple’s lower-cost device, Cupertino is <a href="https://www.culpium.com/p/apple-in-talks-to-boost-mac-neo-production" target="_blank" rel="noreferrer noopener">already plotting</a> the path toward <a href="https://www.bloomberg.com/news/articles/2026-07-22/apple-to-launch-new-macbook-air-imac-macbook-pro-neo-mac-mini-mac-studio" target="_blank" rel="noreferrer noopener">MacBook Neo 2.</a> Reports claim this will debut in March in new colors and use the A19 Pro chip from the iPhone 17 Pro, with performance boosted by slightly more unified memory (12GB, rather than 8GB). That’ll make it a much better Mac, likely with 10-15% performance gains and the ability to run Apple Intelligence, making it the best and most affordable AI PC in its class.</p>



<p class="wp-block-paragraph">Just four months after the Neo’s rollout, Apple is already in position to leak rumors of an even more computationally capable follow-up, while competitors struggle to compete with the original on performance, build quality, and price. Still, the Neo might get more expensive, reporting warns, with the lowest-price 256GB model now gone, making the $599 Mac a mirage we can only wistfully hope to see again. </p>



<p class="wp-block-paragraph">That might matter less in context, as PC makers everywhere boost prices while RAM, chips, and storage prices head north, along with transport, logistics, and energy costs. “While [Apple] did raise prices in line with the broader market, it still remains well positioned against rivals facing the same cost pressures,” said Jean Philippe Bouchard, vice president for consumer devices at IDC. </p>



<p class="wp-block-paragraph">“As market conditions continue to worsen, the importance of supply chain management and capabilities are increasingly important,” Bouchard said. “The largest vendors, with their buying power and long-standing supplier ties, are best positioned to take share from smaller rivals.”</p>



<h2 class="wp-block-heading"><strong>This was never about luck</strong></h2>



<p class="wp-block-paragraph">This isn’t solely a market take about competition, it’s about planning.</p>



<p class="wp-block-paragraph">Few in the industry seemed prepared for the massive memory price increases that hit this year. Apple clearly planned its low-cost Mac well before that happened, hoping to seize the PC market at the low-mid-range. This is precisely what it seems to have done, what it continues to do, and what it will continue to do.</p>



<p class="wp-block-paragraph">The recent reports that it has a successor planned shows the breadth of the Mac company’s strategic vision, as Apple has quite clearly sought to fully exploit the failings of Windows and the internal contradictions of a value-conscious industry in stiff competition with itself.</p>



<p class="wp-block-paragraph">With the first M-series Macs about to enter the replacement cycle, Apple has built a market it can capitalize on for at least a decade, meaning it already has a vision for PC sales that extends at least as far. That’s the kind of road map corporate purchasers want when they make platform deployment decisions, which is why Apple’s 10% share gains are the beginning of <a href="https://www.computerworld.com/article/4150717/hexnode-ceo-macbook-neo-forces-it-to-rethink-its-budget-laptop-strategy.html">even more significant market change</a>. </p>



<p class="wp-block-paragraph"><em>You can follow me on social media! Join me on <a href="https://bsky.app/profile/jonnyevanssays.bsky.social" target="_blank" rel="noreferrer noopener">BlueSky</a>,  <a href="http://www.linkedin.com/in/jonnyevans" target="_blank" rel="noreferrer noopener">LinkedIn</a>, <a href="https://social.vivaldi.net/@jonnyevans" target="_blank" rel="noreferrer noopener">Mastodon</a> and subscribe to my daily Apple-related news summaries at <a href="https://thecorenews.substack.com/p/welcome-to-the-core?r=5l3lg" target="_blank" rel="noreferrer noopener">The Core</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[3 cybersecurity issues that should keep every CEO awake at night]]></title>
<description><![CDATA[For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.



Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organization...]]></description>
<link>https://tsecurity.de/de/3693088/it-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693088/it-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/</guid>
<pubDate>Sat, 25 Jul 2026 06:16:50 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.</p>



<p class="wp-block-paragraph">Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organizations continue to suffer major cyber incidents with alarming regularity. Every week seems to bring news of another ransomware attack, supply chain compromise or data breach affecting organizations that many would have assumed were well protected.</p>



<p class="wp-block-paragraph">The obvious conclusion is that we are asking the wrong questions.</p>



<p class="wp-block-paragraph">Too many executive teams remain preoccupied with the latest threat actor, the newest security product the CISO wants to buy or the latest vulnerability making headlines. Those issues matter, but they are not what should be keeping CEOs awake at night.</p>



<p class="wp-block-paragraph">In my view, there are three far more fundamental issues that deserve the attention of every chief executive.</p>



<h2 class="wp-block-heading">1. Corporate complexity, and the widening gap between business leadership and cybersecurity reality</h2>



<p class="wp-block-paragraph">Perhaps the biggest cybersecurity risk facing large organizations today is not technical at all.</p>



<p class="wp-block-paragraph">It is the growing disconnect between executive perception and operational reality.</p>



<p class="wp-block-paragraph">Many boards genuinely believe their organizations are reasonably well protected. They receive regular dashboards showing improving maturity scores, increasing compliance levels, falling vulnerability counts and reassuring traffic-light reports.</p>



<p class="wp-block-paragraph">Unfortunately, cyber attackers do not read dashboards.</p>



<p class="wp-block-paragraph">Behind those executive reports often lies an increasingly complex technology landscape, thousands of unmanaged digital assets, ageing infrastructure, rampant shadow IT, fragmented ownership, inconsistent governance and security teams struggling to keep pace with relentless business change.</p>



<p class="wp-block-paragraph">The problem is rarely a lack of effort.</p>



<p class="wp-block-paragraph">It is that corporate complexity has reached a level where traditional governance mechanisms are no longer capable of providing an accurate picture of organizational resilience.</p>



<p class="wp-block-paragraph">Executives believe they understand the level of cyber risk they face because they receive regular reports. Those reports often measure activity rather than resilience.</p>



<p class="wp-block-paragraph">Governance committees end up debating around another percentage point of phishing awareness or vulnerability remediation, while fundamental issues remain unaddressed in the background.</p>



<h2 class="wp-block-heading">2. Organizational inertia, and the need for executive structure to evolve faster</h2>



<p class="wp-block-paragraph">Cyber criminals continue to evolve rapidly. Large organizations generally do not.</p>



<p class="wp-block-paragraph">This is the second issue that should concern every CEO.</p>



<p class="wp-block-paragraph">Throughout my career, I have observed organizations repeatedly responding to new cyber threats by adding another technology platform, another monitoring capability, another compliance framework or another governance committee.</p>



<p class="wp-block-paragraph">Very rarely do they stop to redesign how cybersecurity operates.</p>



<p class="wp-block-paragraph">The result is what I described several years ago as the “<a href="https://www.amazon.com/Cybersecurity-Spiral-Failure-How-Break/dp/1637353057/">Cybersecurity Spiral of Failure</a>”.</p>



<ul class="wp-block-list">
<li>As complexity and regulation increase, organizations invest in more security products.</li>



<li>More products create more complexity.</li>



<li>More products and greater complexity generate more alerts.</li>



<li>More alerts require more analysts.</li>



<li>More analysts produce more reports.</li>



<li>More reports continue to build up executive confidence.</li>



<li>Meanwhile, the underlying structural weaknesses remain largely unchanged, technical debt piles up and costs escalate.</li>
</ul>



<p class="wp-block-paragraph">And when the inevitable breach eventually happens, reality reveals itself, but distrust also sets in between senior executives and security teams.</p>



<p class="wp-block-paragraph">This is not a funding problem. Nor is it a skills problem. It is fundamentally an operating model problem.</p>



<p class="wp-block-paragraph">Many organizations continue trying to solve twenty-first century challenges using governance, accountability, organizational and reporting structures designed twenty-five years ago.</p>



<p class="wp-block-paragraph">The cybersecurity function itself has evolved dramatically. Many executive structures have not.</p>



<p class="wp-block-paragraph">This organizational inertia extends beyond technology: It affects budgeting cycles, <a href="https://www.cio.com/article/4193990/reallocating-cybersecurity-capital-in-the-mythos-era.html">investment priorities</a>, procurement processes, accountability models and decision-making speed.</p>



<p class="wp-block-paragraph">Cyber attackers innovate every day. Organizational change often takes years.</p>



<p class="wp-block-paragraph">That imbalance should worry every CEO.</p>



<h2 class="wp-block-heading">3. Accelerating technological disruption, and how it challenges organizations in areas where they are intrinsically weak</h2>



<p class="wp-block-paragraph">The third issue is potentially the most significant over the coming decade.</p>



<ul class="wp-block-list">
<li>Artificial intelligence, autonomous agents and machine identities</li>



<li>Software supply chain complexity.</li>



<li>Quantum computing, and post-quantum cryptography</li>
</ul>



<p class="wp-block-paragraph">Each of these developments represents far more than another technical trend.</p>



<p class="wp-block-paragraph">Together, they fundamentally change the dynamics of cybersecurity.</p>



<p class="wp-block-paragraph">Artificial intelligence is transforming countless business processes. At the same time, it is also increasing both the speed and sophistication of cyber-attacks while simultaneously transforming defensive capabilities.</p>



<p class="wp-block-paragraph">Organizations have become increasingly dependent on software ecosystems that extend far beyond their own direct control. Engaging with the supply chain in ways that lead to a genuine appreciation of the risks involved has become a key challenge for most cybersecurity practices.</p>



<p class="wp-block-paragraph">Quantum computing may eventually invalidate much of today’s cryptographic algorithms, forcing organizations into one of the largest technology efforts since Y2K — but without the benefit of a fixed deadline and faced by a problem that is considerably more complex and hyperconnected IT estates that have little to do with those of the late 90s.</p>



<p class="wp-block-paragraph">None of these challenges can be solved overnight: They require clear governance, sustained investment over a few years and cross-functional organizational coordination.</p>



<p class="wp-block-paragraph">Most large organizations are weak on those three fronts: This is precisely why CEOs should be focusing on them now.</p>



<p class="wp-block-paragraph">Waiting until some of those risks become obvious will almost certainly be too late.</p>



<p class="wp-block-paragraph">Businesses naturally prioritise immediate commercial pressures. Cybersecurity often involves preparing for risks whose timing remains uncertain.</p>



<p class="wp-block-paragraph">But one of the greatest leadership failures I keep seeing remains the inability of organizations to act decisively on known unknowns.</p>



<p class="wp-block-paragraph">That tension explains why many organizations delay action until external events force them to respond. Unfortunately, cybersecurity rarely rewards late action.</p>



<h2 class="wp-block-heading">Leadership will determine who succeeds</h2>



<p class="wp-block-paragraph">Cybersecurity discussions still frequently focus on technology. I believe they should focus far more on leadership.</p>



<p class="wp-block-paragraph">Technology will continue evolving. Threat actors will continue adapting. Regulations will continue expanding. Those developments are inevitable.</p>



<p class="wp-block-paragraph">What remains within the control of every CEO is how their organization responds.</p>



<p class="wp-block-paragraph">Does cybersecurity remain an IT issue? Or is it recognised as an integral part of business resilience?</p>



<p class="wp-block-paragraph">How is cybersecurity accountability assigned at executive level? Or does it still rest largely with a CISO hidden in the organization?</p>



<p class="wp-block-paragraph">Does the board spend sufficient time discussing resilience? Or does cybersecurity appear only when approving budgets or reviewing incidents?</p>



<p class="wp-block-paragraph">These questions will increasingly determine organizational success.</p>



<p class="wp-block-paragraph">The companies that navigate the next decade successfully will not necessarily be those spending the most on cybersecurity. Nor will they be those deploying the latest security technologies first.</p>



<p class="wp-block-paragraph">They will be the organizations whose leadership recognises that cybersecurity has become a permanent business capability — embedded into governance, strategy, operational decision-making and organizational culture.</p>



<p class="wp-block-paragraph">That transformation cannot be delegated. It begins with the CEO.</p>



<p class="wp-block-paragraph">And perhaps that is the single biggest issue that should keep every chief executive awake at night: Not when the next cyber-attack will happen, but whether their organization is evolving quickly enough on those matters to meet a threat landscape that is changing much faster than the business itself.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[CIOs beware: DNS KSK rollover could kick off wave of mysterious outages]]></title>
<description><![CDATA[Predicting an outage is tricky business, but CIOs might want to circle Oct. 11, 2026, through Jan. 11, 2027, for likely trouble of a potentially widespread and puzzling nature.



That’s because a relatively trivial update to DNSSEC on Oct. 11, one that will take full effect by Jan. 11, is likely...]]></description>
<link>https://tsecurity.de/de/3693085/it-nachrichten/cios-beware-dns-ksk-rollover-could-kick-off-wave-of-mysterious-outages/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693085/it-nachrichten/cios-beware-dns-ksk-rollover-could-kick-off-wave-of-mysterious-outages/</guid>
<pubDate>Sat, 25 Jul 2026 06:16:22 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Predicting an outage is tricky business, but CIOs might want to circle Oct. 11, 2026, through Jan. 11, 2027, for likely trouble of a potentially widespread and puzzling nature.</p>



<p class="wp-block-paragraph">That’s because a relatively trivial update to DNSSEC on Oct. 11, one that will take full effect by Jan. 11, is likely to deliver a series of seemingly unrelated system outages. This will come from oceans of dependencies from third-party, shadow, agentic, gen AI, SaaS, homegrown, and legacy apps — among many other quiet executable hiding spots, including virtual environments and containers.</p>



<p class="wp-block-paragraph"><a href="https://www.linkedin.com/in/joshithak/">Sai Joshitha Kathari</a>, senior site reliability engineer at payment card giant Visa, says most enterprises have far more DNS-related exposure than they realize because of these many dependencies.</p>



<p class="wp-block-paragraph">“This has the potential to create real downstream destruction when unresolved failures sit underneath important business functions,” Kathari says. </p>



<p class="wp-block-paragraph">The danger is that so many of these issues are either unknown to IT or handled by a third-party vendor and no one in IT has had reason to ask those vendors about DNS updates. </p>



<p class="wp-block-paragraph">“The risky areas are usually not the obvious managed DNS services. They are the older internal applications, hardcoded resolvers, containerized workloads, sidecar configurations, custom scripts, partner integrations, VM images, stale base images, and service-to-service dependencies that nobody has touched in a long time,” Kathari explains. “These systems can keep working quietly for years, then fail during a DNS or certificate-related change because they bypassed the normal platform standards.”</p>



<p class="wp-block-paragraph">Independent technology analyst <a href="https://www.linkedin.com/in/carmi/">Carmi Levy</a> says that CIOs need to take this event very seriously. </p>



<p class="wp-block-paragraph">“The two-pronged deadline — October 11, 2026, when the new Key Signing Key (KSK) begins signing the root zone, and January 11, 2027, when the old key is retired — should be marked in red on everyone’s calendar, just as December 31, 1999, once was,” Levy says. “Failure to comply could result in websites, critical business applications, and related resources dropping off the face of the Earth once the transition is complete.”</p>



<p class="wp-block-paragraph">Levy adds: “Custom-built code that lives outside conventional support mechanisms may or may not function when the DNS changes go into effect.”</p>



<p class="wp-block-paragraph">The <a href="https://www.icann.org/resources/press-material/release-2026-05-20-en">DNSSEC update itself</a> is straightforward, but it is also the first significant DNSSEC change — specifically a change in the trust anchor — since 2018. </p>



<p class="wp-block-paragraph">The rollout statement noted that “the trust anchor is formally known as the Domain Name System Security Extensions (DNSSEC) root zone Key Signing Key (KSK). The KSK is the cryptographic key at the core of the DNSSEC trust anchor and is used to verify that DNS responses are legitimate and have not been modified in transit.”</p>



<h2 class="wp-block-heading">Expect nearly every enterprise to be impacted</h2>



<p class="wp-block-paragraph"><a href="https://www.linkedin.com/in/kimdavies/">Kim Davies</a>, vice president of IANA Services and president of public technical identifiers at ICANN, says the extent of the impact on enterprises is unknowable, given the nature of shadow IT and other edge cases. </p>



<p class="wp-block-paragraph">But based on the massive number of dependencies both known and unknown in the typical global enterprise, Davies guesses that just about every enterprise will be impacted, to varying degrees. </p>



<p class="wp-block-paragraph">“In highly complex organizations, it is very likely there will be some impact in the corners, in the margins, of the organization,” Davies tells CIO. “DNS is such a core technology that underpins everything.”</p>



<p class="wp-block-paragraph">As the updates propagate, hiccups will materialize, Davies notes. “When the system cannot validate the [DNS] information, it will treat it as suspect and DNS lookups will fail.”</p>



<p class="wp-block-paragraph">Visa’s Kathari says, “Enterprises should expect some secondary DNS-related glitches when major DNSSEC-related changes happen, not necessarily because the core infrastructure teams will ignore the update, but because large environments have many hidden dependency paths.”</p>



<p class="wp-block-paragraph">Making this problem far worse, Kathari notes, is that the glitches will likely initially look like anything other thana DNS glitch. That will force IT staff to waste a vast number of hours chasing causes that ultimately prove to be unrelated to the incidents. </p>



<p class="wp-block-paragraph">“The impact for CIOs is that DNS failures rarely announce themselves as DNS failures. They look like application timeouts, broken logins, failed API calls, queue lag, payment failures, partner connectivity issues, or random regional instability,” Kathari explains. “That makes troubleshooting slower because teams may spend hours looking at the application, database, network, or cloud provider before realizing name resolution is part of the failure path.”</p>



<p class="wp-block-paragraph"><a href="https://greyhoundresearch.com/svg/">Sanchit Vir Gogia</a>, chief analyst at Greyhound Research, agrees that IT will likely spin its wheels chasing the wrong ghosts.</p>



<p class="wp-block-paragraph">“A validation failure rarely stays in its lane. It surfaces as an application error, an API timeout, or a reachability problem, which turns a resolver fault into a coordination failure,” Gogia says. “The application team blames the network, the network team blames the cloud, and the user simply watches work stop.”</p>



<p class="wp-block-paragraph">“Images and templates are the frontier most teams miss,” Gogia adds. “A resolver fixed in summer can be broken again in October the instant a stale golden image is redeployed, because automation no longer lets configuration drift slowly. It restores yesterday’s assumptions at machine speed.”</p>



<p class="wp-block-paragraph">It is widely expected that enterprises will not have any problems executing the change or, more likely, relying on their hyperscalers to properly handle the change. That is the concern. </p>



<p class="wp-block-paragraph">“CIOs are being distracted so much with AI and this is such a deep in the weeds infrastructure issue that this can and willcatch people off-guard,” <a href="https://acceligence.com/talent/profiles/justin-greis/">Justin Greis</a>, CEO of consulting firm Acceligence, tells CIO. “I think we’ll see a meaningful number of enterprise disruptions associated with the DNSSEC trust anchor rollover. Not because the update itself is especially difficult, but because it will expose weaknesses that already exist inside many organizations.”</p>



<p class="wp-block-paragraph">Most enterprise IT operations have had no reason to compile a comprehensive list of all DNS dependencies, but many will be instantly discovered in January. </p>



<h2 class="wp-block-heading">Potentially widespread fallout</h2>



<p class="wp-block-paragraph">A major retailer, for example, might suddenly be unable to connect with FedEx to arrange for deliveries or a hospital may find that test results are no longer being shared with patient portals. It might manifest as an assembly line that halts because an IIoT component can no longer share files with its vendor system or a truck fleet that stops being tracked. </p>



<p class="wp-block-paragraph">“There will almost certainly be systems that fall through the cracks. Some will be legacy applications that rely on outdated DNS configurations that have not been updated in years,” Greis says. “Others will be business-unit-developed tools, contractor-built solutions, embedded systems, manufacturing and industrial systems, or highly customized workloads that operate outside normal IT oversight. These are the types of systems that often surface during infrastructure events like this.”</p>



<p class="wp-block-paragraph">Greis adds that many enterprises will discover in January problems created by their own automation.</p>



<p class="wp-block-paragraph">“Over time, enterprises build layers of processes, templates, and deployment mechanisms that are reused across teams and environments,” Greis notes. “Even after DNS infrastructure is updated correctly, older settings can inadvertently be reintroduced through routine updates and system changes, creating intermittent and difficult-to-diagnose failures.”</p>



<p class="wp-block-paragraph">The good news from this situation is that enterprises are not going to likely lose all DNS access if any of these glitches occur. But that may be of no comfort because even if the disruptions are only with small edge cases, that can still cause massive operational disruptions.</p>



<p class="wp-block-paragraph"><a href="https://www.linkedin.com/in/cricketliu/">Cricket Liu</a>, EVP and chief evangelist at Infoblox, gives the example of a DNS server that responds to factory-floor system queries.</p>



<p class="wp-block-paragraph">“Or let’s say this disrupts [an enterprise’s key] SaaS application. All name resolution may stop and it will show a server failure. It will not deliver a response whenever I look anything up. That’s not subtle at all,” Liu says. “It’s highly likely that companies are going to see some effects.”</p>



<p class="wp-block-paragraph">Back in 2017, the switchover was relatively uneventful, giving some CIOs hope that January 2027 will also be a non-event. But given the technology advancements in the last 10 years and the resulting tidal wave of new enterprise tech dependencies, few are realistically expecting no problems this go around. </p>



<h2 class="wp-block-heading">Impossible to predict what will happen</h2>



<p class="wp-block-paragraph">One of the top network experts on DNS effects in enterprises is <a href="https://blog.apnic.net/author/geoff-huston/">Geoff Huston</a>, chief scientist at the Asia Pacific Network Information Centre (APNIC), the regional Internet Registry administering IP addresses for the Asia Pacific region.</p>



<p class="wp-block-paragraph">Huston says it is difficult to project what will happen in January until it happens.</p>



<p class="wp-block-paragraph">“Just like the last time, we are flying blind with this key roll. Because nothing really terrible happened last time, there is some confidence that nothing terrible will happen this time, but we just can’t tell in advance as there are no good measurement approaches that allow us to peek inside the trust state of recursive resolvers,” he says.</p>



<p class="wp-block-paragraph">As for potential edge-case glitches, Huston says it is possible, but if third-party vendors do not properly handle the update, there will be other issues as well, as the KSK cryptographic key used within DNSSEC signs and validates the keys that protect DNS records. </p>



<p class="wp-block-paragraph">“If it is not standards-compliant, then you have more problems than just the KSK roll,” Huston says, “as it raises the obvious question of ‘What else is not correctly implemented in the DNS resolver that I’m running?’”</p>



<p class="wp-block-paragraph">As a silver lining, Acceligence’s Greis says any hiccups that result from the DNS KSK update may be a gift in disguise for CIOs. </p>



<p class="wp-block-paragraph">“The irony is that some of the most business-critical components in the technology stack are often the least visible because they work in the background,” Greis says. January “may reveal how much modern business resilience depends on infrastructure that many organizations rarely examine until something breaks. For CIOs, that’s the real lesson. This is not fundamentally a story about a DNS update. It is a story about operational visibility, resilience, and governance. Organizations that treat the rollover as a routine infrastructure task will likely complete the update and move on. Organizations that use it as an opportunity to understand and strengthen the foundations of their technology environment may gain far more value than simply avoiding an outage.”</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Atos launches sovereign cloud service to power comeback]]></title>
<description><![CDATA[Atos has launched a new sovereign cloud platform aimed squarely at European public sector bodies, healthcare providers and defense organizations. It’s the latest effort by European companies in their fight back against US dominance.



Atos Sovereign Cloud offers a range of controls for data mana...]]></description>
<link>https://tsecurity.de/de/3693082/it-nachrichten/atos-launches-sovereign-cloud-service-to-power-comeback/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3693082/it-nachrichten/atos-launches-sovereign-cloud-service-to-power-comeback/</guid>
<pubDate>Sat, 25 Jul 2026 06:13:49 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Atos has launched a new sovereign cloud platform aimed squarely at European public sector bodies, healthcare providers and defense organizations. It’s the latest effort by European companies in their fight back against US dominance.</p>



<p class="wp-block-paragraph">Atos Sovereign Cloud offers a range of controls for data management, providing customers with resilience and full control over their data, complying with existing European legislation on data residency.</p>



<p class="wp-block-paragraph">“Digital sovereignty has become a global operational priority for organizations that need to manage dependencies, jurisdictional exposure and disruption risks across complex digital environments. Atos Sovereign Cloud gives customers a practical way to apply sovereign controls to their most critical workloads, while preserving flexibility, resilience and the ability to innovate securely,” said Michael Kollar, Atos Group digital sovereignty leader.</p>



<p class="wp-block-paragraph">There has been a concerted effort by <a href="https://www.computerworld.com/article/4121422/europe-votes-to-tackle-deep-dependence-on-us-tech-in-sovereignty-drive.html">European organizations to meet US competition</a> head-on. Earlier this month, <a href="https://www.networkworld.com/article/4192767/cloud-sovereignty-first-four-providers-sign-up-to-cispe-certification-program.html">four companies signed up to the certification program</a> introduced by the European cloud body, CISPE,</p>



<p class="wp-block-paragraph">This is the latest effort by Atos to get the company back on track. In April, <a href="https://www.networkworld.com/article/4154186/french-government-take-bull-by-horns-for-e404-million.html">it sold its supercomputer company, Bull</a> to the French government, after a previous attempt in 2024 to <a href="https://www.cio.com/article/1310376/atos-deal-to-sell-its-legacy-service-business-falls-through.html">sell off its computer services division</a> and <a href="https://www.cio.com/article/2086965/atos-staves-off-bankruptcy-casts-wider-net-for-refinancing.html">after a refinancing deal</a> in the same year.</p>



<p class="wp-block-paragraph">The company implemented a further round of refinancing this year and <a href="https://www.atosgroup.com/en/press/first-phase-refinancing-strategy-completed" target="_blank" rel="noreferrer noopener">in its half-yearly report</a> claimed that this was an “important milestone” in securing the company’s future. However, in its first-quarter results revenue showed an organic decline of 11 percent, so any projected growth may be some time in the future. Whether its Sovereign Cloud offering is the harbinger of the revival remains to be seen.</p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Instagram Is Now Banning Pickup Artists, Pranksters Who Use Meta Glasses]]></title>
<description><![CDATA[Instagram is banning videos filmed with Meta smart glasses that harass strangers in public, including prank videos targeting service workers and pickup-artist clips of women who may not realize they are being recorded. "If you're posting content that is taking advantage of people and harassing th...]]></description>
<link>https://tsecurity.de/de/3692818/it-security-nachrichten/instagram-is-now-banning-pickup-artists-pranksters-who-use-meta-glasses/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692818/it-security-nachrichten/instagram-is-now-banning-pickup-artists-pranksters-who-use-meta-glasses/</guid>
<pubDate>Sat, 25 Jul 2026 03:07:36 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Instagram is banning videos filmed with Meta smart glasses that harass strangers in public, including prank videos targeting service workers and pickup-artist clips of women who may not realize they are being recorded. "If you're posting content that is taking advantage of people and harassing them, like a lot of these pickup line kind of videos that we've heard of and seen, then we're going to take the content down," said Instagram head Adam Mosseri in response to a question on his Instagram stories last week. "We don't want people to be surreptitiously taking videos of other people and harassing them and then posting them on our platform. So we're trying to fight that every way we can." Business Insider reports: It's unclear how many videos have been removed under this new policy. Business Insider found that two large accounts of pickup artists who filmed themselves approaching women in public while wearing the glasses had been deactivated. (Both previously had more than a million followers.)
 
A Meta spokesperson confirmed to Business Insider that these accounts were booted for violating the policy about posting harassing content that had been filmed with the glasses. Meta did not directly respond to questions about how this new policy is being enforced or what exactly constitutes a violation.<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Instagram+Is+Now+Banning+Pickup+Artists%2C+Pranksters+Who+Use+Meta+Glasses%3A+https%3A%2F%2Ftech.slashdot.org%2Fstory%2F26%2F07%2F24%2F2212248%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Ftech.slashdot.org%2Fstory%2F26%2F07%2F24%2F2212248%2Finstagram-is-now-banning-pickup-artists-pranksters-who-use-meta-glasses%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://tech.slashdot.org/story/26/07/24/2212248/instagram-is-now-banning-pickup-artists-pranksters-who-use-meta-glasses?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Windows 11 now lets you resize the touchpad right-click zone, something even macOS can’t do]]></title>
<description><![CDATA[Windows 11 now lets you resize the right-click zone on your touchpad, choosing between Default, Small, Medium, and Large from Settings. The feature started in Insider builds back in March and has now rolled out to everyone with the July 2026 Patch Tuesday update, no tweaks required.
The post Wind...]]></description>
<link>https://tsecurity.de/de/3692803/windows-tipps/windows-11-now-lets-you-resize-the-touchpad-right-click-zone-something-even-macos-cant-do/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692803/windows-tipps/windows-11-now-lets-you-resize-the-touchpad-right-click-zone-something-even-macos-cant-do/</guid>
<pubDate>Sat, 25 Jul 2026 02:26:40 +0200</pubDate>
<category>🪟 Windows Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Windows 11 now lets you resize the right-click zone on your touchpad, choosing between Default, Small, Medium, and Large from Settings. The feature started in Insider builds back in March and has now rolled out to everyone with the July 2026 Patch Tuesday update, no tweaks required.</p>
<p>The post <a rel="nofollow" href="https://www.windowslatest.com/2026/07/25/windows-11-now-lets-you-resize-the-touchpad-right-click-zone-something-even-macos-cant-do/">Windows 11 now lets you resize the touchpad right-click zone, something even macOS can’t do</a> appeared first on <a rel="nofollow" href="https://www.windowslatest.com/">Windows Latest</a></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-10714 | Rockwell Automation FactoryTalk Services Platform ersion 6.60 JWT Signature Validation improper authorization (Nessus ID 329329)]]></title>
<description><![CDATA[A vulnerability labeled as critical has been found in Rockwell Automation FactoryTalk Services Platform ersion 6.60. The affected element is an unknown function of the component JWT Signature Validation. The manipulation results in improper authorization.

This vulnerability was named CVE-2026-10...]]></description>
<link>https://tsecurity.de/de/3692798/sicherheitsluecken/cve-2026-10714-rockwell-automation-factorytalk-services-platform-ersion-660-jwt-signature-validation-improper-authorization-nessus-id-329329/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692798/sicherheitsluecken/cve-2026-10714-rockwell-automation-factorytalk-services-platform-ersion-660-jwt-signature-validation-improper-authorization-nessus-id-329329/</guid>
<pubDate>Sat, 25 Jul 2026 02:24:05 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability labeled as <a href="https://vuldb.com/kb/risk">critical</a> has been found in <a href="https://vuldb.com/product/rockwell_automation:factorytalk_services_platform">Rockwell Automation FactoryTalk Services Platform ersion 6.60</a>. The affected element is an unknown function of the component <em>JWT Signature Validation</em>. The manipulation results in improper authorization.

This vulnerability was named <a href="https://vuldb.com/cve/CVE-2026-10714">CVE-2026-10714</a>. The attack may be performed from remote. There is no available exploit.]]></content:encoded>
</item>
<item>
<title><![CDATA[Paramount Agrees to Postpone Warner Bros. Merger Until June 2027]]></title>
<description><![CDATA[Paramount Skydance has agreed to postpone its $111 billion Warner Bros. Discovery merger until five days after an antitrust trial or June 1, 2027, whichever comes first. The agreement with a 12-state coalition led by California effectively shelves the deal for months while states argue it would r...]]></description>
<link>https://tsecurity.de/de/3692726/it-security-nachrichten/paramount-agrees-to-postpone-warner-bros-merger-until-june-2027/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692726/it-security-nachrichten/paramount-agrees-to-postpone-warner-bros-merger-until-june-2027/</guid>
<pubDate>Sat, 25 Jul 2026 01:07:31 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Paramount Skydance has agreed to postpone its $111 billion Warner Bros. Discovery merger until five days after an antitrust trial or June 1, 2027, whichever comes first. The agreement with a 12-state coalition led by California effectively shelves the deal for months while states argue it would reduce competition in cable and theatrical markets. Variety reports: Paramount had been keen to close the deal before Sept. 30, when it will begin to incur a $7-million-a-day "ticking fee" to be paid to Warner Bros. investors. The agreement is a tacit acknowledgement that that will not happen, barring a settlement with the states. Paramount previously sought a three-day hearing on the injunction motion in late August, hoping to win the judge's blessing to close the deal sometime in early September. But the states resisted that idea, saying they would need more time to take discovery and prepare for a full trial on the merits. The states were due to file their injunction motion on Thursday night, but held off as the two sides held discussions on a path forward. In a statement, the company said the agreement is a "significant win."
 
"Today's agreement is a significant win because the result is exactly what we have sought from the outset: a direct path to a trial based on the evidence," a Paramount spokesperson said. "This is the fastest and clearest way to prove that this transaction is good for competition, good for consumers, and good for creators, a conclusion dozens of competition authorities around the world have already reached. Plaintiffs' market definitions bear no relationship to the realities of today's marketplace and cannot withstand scrutiny. We look forward to proving our case at trial."
 
A hearing was scheduled for Aug. 3 in federal court in Oakland, at which point the two sides were expected to argue over the injunction motion. The two sides agreed to cancel that hearing. U.S. District Judge Araceli Martinez-Olguin approved the joint stipulation on Friday afternoon, about an hour after it was entered. The Writers Guild of America filed its own motion for an injunction earlier this week, which was also set to be heard on Aug. 3. That motion has been withdrawn, as Paramount has effectively conceded that it will not close the deal until a determination of the merits of the antitrust claims. The parties also agreed to submit a joint stipulation by July 31 on their respective positions on trial scheduling. The states previously proposed to hold the trial in April 2027.<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Paramount+Agrees+to+Postpone+Warner+Bros.+Merger+Until+June+2027%3A+https%3A%2F%2Fyro.slashdot.org%2Fstory%2F26%2F07%2F24%2F2235232%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fyro.slashdot.org%2Fstory%2F26%2F07%2F24%2F2235232%2Fparamount-agrees-to-postpone-warner-bros-merger-until-june-2027%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://yro.slashdot.org/story/26/07/24/2235232/paramount-agrees-to-postpone-warner-bros-merger-until-june-2027?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[After backlash, Meta pauses plan to ‘rate limit’ its smart glasses]]></title>
<description><![CDATA[Remember when Meta was planning to charge a $20 monthly subscription fee for the smart glasses feature that lets people hear each other more clearly - even though that feature runs locally on your glasses and doesn't require the cloud? Meta has paused those plans, spokesperson Tyler Yee confirms ...]]></description>
<link>https://tsecurity.de/de/3692691/it-nachrichten/after-backlash-meta-pauses-plan-to-rate-limit-its-smart-glasses/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692691/it-nachrichten/after-backlash-meta-pauses-plan-to-rate-limit-its-smart-glasses/</guid>
<pubDate>Sat, 25 Jul 2026 00:32:11 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Remember when Meta was planning to charge a $20 monthly subscription fee for the smart glasses feature that lets people hear each other more clearly - even though that feature runs locally on your glasses and doesn't require the cloud? Meta has paused those plans, spokesperson Tyler Yee confirms to The Verge. The company is […]]]></content:encoded>
</item>
<item>
<title><![CDATA[Would an AI Kill Switch Backfire?]]></title>
<description><![CDATA[Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:1 Some policymakers have proposed mechanisms that could disable or restrict advanced AI systems under certain circumstances. Supporters view these as safeguards against dangerous behavior, while critics argue they could introduce ne...]]></description>
<link>https://tsecurity.de/de/3692645/it-security-video/would-an-ai-kill-switch-backfire/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692645/it-security-video/would-an-ai-kill-switch-backfire/</guid>
<pubDate>Sat, 25 Jul 2026 00:03:21 +0200</pubDate>
<category>🎥 IT Security Video</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: Security Weekly - A CRA Resource - Bewertung: 0x - Views:1 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/4HJD39GiThA?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>Some policymakers have proposed mechanisms that could disable or restrict advanced AI systems under certain circumstances. Supporters view these as safeguards against dangerous behavior, while critics argue they could introduce new security, governance, and trust concerns.<br />
<br />
If users believe an AI system can be disabled whenever authorities decide it's "rogue," confidence in that platform may decline. Organizations and individuals could migrate to alternatives they perceive as more independent, even if those systems introduce different risks.<br />
<br />
Is an AI kill switch a necessary safety measure, or does it create a larger trust problem than it solves?<br />
<br />
Subscribe to our podcasts: https://securityweekly.com/subscribe<br />
<br />
#AISafety #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Roku Raises Prices of Streaming Devices By Up To 60%]]></title>
<description><![CDATA[Roku has raised prices on several streaming devices, blaming memory and component shortages tied to the AI data-center boom. The Roku Ultra jumped from $100 to $150 and the basic Streaming Stick rose from $30 to $40. The Desk reports: In a phone call with The Desk on Friday, a Roku executive said...]]></description>
<link>https://tsecurity.de/de/3692521/it-security-nachrichten/roku-raises-prices-of-streaming-devices-by-up-to-60/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692521/it-security-nachrichten/roku-raises-prices-of-streaming-devices-by-up-to-60/</guid>
<pubDate>Fri, 24 Jul 2026 23:13:45 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Roku has raised prices on several streaming devices, blaming memory and component shortages tied to the AI data-center boom. The Roku Ultra jumped from $100 to $150 and the basic Streaming Stick rose from $30 to $40. The Desk reports: In a phone call with The Desk on Friday, a Roku executive said the company made the tough decision to raise prices on its streaming hardware to address shortages in computer memory and other components caused by the artificial intelligence rush. [...] Still, the executive who spoke with The Desk on Friday said the company believes its hardware is still competitive against other streaming TV hardware because Roku devices are still priced aggressively compared to the Apple TV and other expensive streaming hardware, and the company remains focused on looking at ways to add value to its Roku platform before and after it enters a customer's home. "We are doing our best to have great deals like what we have going on right now," the executive said. "Roku is even upping the price for a bundle that includes a Streaming Stick Plus and a one-month subscription to Fox One," notes Ars Technica in a separate report.
 
"As recently as July 20, Roku listed the bundle at $60 with a sale price of $25, according to the Internet Archive's Wayback Machine. Now, the bundle carries an $80 MSRP and $45 sale price."<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Roku+Raises+Prices+of+Streaming+Devices+By+Up+To+60%25%3A+https%3A%2F%2Fnews.slashdot.org%2Fstory%2F26%2F07%2F24%2F2059242%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fnews.slashdot.org%2Fstory%2F26%2F07%2F24%2F2059242%2Froku-raises-prices-of-streaming-devices-by-up-to-60%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://news.slashdot.org/story/26/07/24/2059242/roku-raises-prices-of-streaming-devices-by-up-to-60?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[VentureBeat Research: Where enterprise AI agent governance hasn't caught up]]></title>
<description><![CDATA[Enterprises deployed AI agents ahead of the controls needed to manage them — and they did it knowingly. That is the central finding across the five parallel surveys VentureBeat Research fielded in June, spanning every layer of the agentic stack. Now those enterprises are retrofitting to catch up ...]]></description>
<link>https://tsecurity.de/de/3692498/it-nachrichten/venturebeat-research-where-enterprise-ai-agent-governance-hasnt-caught-up/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692498/it-nachrichten/venturebeat-research-where-enterprise-ai-agent-governance-hasnt-caught-up/</guid>
<pubDate>Fri, 24 Jul 2026 22:51:31 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Enterprises deployed AI agents ahead of the controls needed to manage them — and they did it knowingly. That is the central finding across the five parallel surveys VentureBeat Research fielded in June, spanning every layer of the agentic stack. Now those enterprises are retrofitting to catch up with their own standards, and they are budgeting for it: In each of the five control layers we measured, 57 to 68% of enterprises plan to switch vendors or add new ones within 12 months, and roughly a third, depending on the layer, plan to move within the quarter.</p><p><a href="https://venturebeat.com/category/resources">VentureBeat Research</a> measured the five controls an enterprise has to build before it can trust an agent: identity, evaluation, cost telemetry, the context layer, and orchestration. Identity governs which agent is allowed to do what, under whose credentials. Evaluation determines whether the agent's work is any good. Cost telemetry tracks what each agent costs to run. The context layer supplies the business data and definitions agents draw on when they answer. And the orchestration control plane coordinates multi-step agent work. Each of our five reports measures one of those controls.</p><p><b>Most deployed "agents" are chatbots wearing the label.</b> Seventy-one percent of enterprises said a quarter or fewer of their deployed "agents" can complete multi-step work on their own; only 10% said true agents are the majority of what they run. These respondents are positioned to know: 81% recommend or decide AI purchases at their companies. A single-prompt chatbot with a human reading every answer needs none of the controls the other four reports measure. A true multi-step agent needs all of them — and most enterprises can't say which one they've deployed. <i>(Full findings: </i><a href="https://venturebeat.com/resources/agentic-orchestration-enterprise-ai-organizations-have-a-deployment-problem-not-a-platform-problem-and-most-are-calling-chatbots-agents"><i>Agentic Orchestration report.</i></a><i>)</i></p><p><b>Autonomy is outrunning trust in the evaluations that gate it.</b> Two-thirds of enterprises either already allow an agent to push a code or system change to production on automated evaluation results alone, with no human review, or are actively engineering toward that within 12 months. Only 5% fully trust the evaluations that would make that call — and half of enterprises shipped an agent that passed internal evaluations and then caused a customer-facing failure in the past year. Before removing human review from any workflow, test evaluations against production outcomes rather than internal benchmarks. <i>(Full findings: </i><a href="https://venturebeat.com/resources/the-agent-evaluation-gap-enterprise-ai-organizations-have-a-reality-alignment-problem-not-a-coverage-problem-and-most-are-shipping-to-production-anyway"><i>Agent Reliability &amp; Evals report</i></a><i>.)</i></p><p><b>Companies that let agents share credentials get hit more often.</b> Sixty-nine percent of companies let at least some of their agents share credentials — multiple agents operating under one API key or service account. Organizations that allow credential sharing anywhere experienced a security incident or near-miss at a 63.5% rate (47 of 74), against 40.9% (nine of 22) at companies where every agent has its own scoped identity. The fix is scoped identity for every agent, starting with the ones that touch production systems. <i>(Full findings: </i><a href="https://venturebeat.com/resources/the-agent-security-gap-54-of-enterprises-have-already-had-an-ai-agent-incident-and-most-still-let-agents-share-credentials"><i>Agentic Security &amp; Identity report</i></a><i>.)</i></p><p><b>The most expensive hardware in the building runs at half capacity or less.</b> More than eight in 10 enterprises that run their own GPUs reported utilization of 50% or less, and only 44% rigorously track what their AI compute actually costs and returns. The number worth chasing first isn't more GPUs — it's the utilization and per-workload cost of the ones already running. <i>(Full findings: </i><a href="https://venturebeat.com/resources/the-ai-compute-gap-enterprises-are-buying-infrastructure-faster-than-they-can-measure-what-it-costs"><i>AI Infrastructure &amp; Compute report</i></a><i>.)</i></p><p><b>Agents answer confidently from data nobody governs.</b> Fifty-seven percent of enterprises traced a confident, wrong agent answer in the past six months to their own missing or inconsistent business context — wrong metrics, stale definitions, absent documents — and most saw it happen more than once. Governing the definitions agents answer from — metrics and entities first — has to come before scaling the agents that depend on them. <i>(Full findings: </i><a href="https://venturebeat.com/resources/the-ai-context-gap-enterprise-ai-organizations-have-a-trust-problem-not-a-retrieval-problem-and-most-are-still-building-the-fix"><i>Context Layers / RAG report</i></a><i>.)</i></p><p>No layer has an entrenched incumbent: The defaults today are the built-in tools that ship with the big AI platforms enterprises already use. Switching intent runs highest in orchestration itself, where 68% plan to adopt, add, or replace platforms within 12 months and 34% within the quarter. Our surveys did not ask which direction that money moves — toward the platforms' built-in tools or toward the specialists challenging them — and that open question is the next four quarters of this market.</p><hr><p><b>About this research</b> </p><p><a href="https://venturebeat.com/category/resources">VentureBeat Research</a> fielded five parallel surveys in June 2026 under its VB Pulse program: Agentic Orchestration (101 respondents), Agent Reliability &amp; Evals (157), Agentic Security &amp; Identity (107), AI Infrastructure &amp; Compute (107), and Context Layers / RAG (101) — 573 qualified respondents in total, all at organizations with 100 or more employees. Samples are self-selected, and some findings should be read directionally; each report carries its full methodology note. What the pattern supports more strongly than any single percentage is the direction: every survey, independently, points the same way. VentureBeat produces both this research and <a href="https://venturebeat.com/vbtransform2026">VB Transform</a>, the conference where these reports debuted.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[UT Arlington Working On 'Trustworthy' AI for Scientific Research]]></title>
<description><![CDATA[The University of Texas at Arlington will contribute to the U.S. Department of Energy’s Genesis Mission, which aims to build an integrated research platform by which scientists can use AI to make new discoveries.]]></description>
<link>https://tsecurity.de/de/3692406/ai-nachrichten/ut-arlington-working-on-trustworthy-ai-for-scientific-research/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692406/ai-nachrichten/ut-arlington-working-on-trustworthy-ai-for-scientific-research/</guid>
<pubDate>Fri, 24 Jul 2026 21:39:22 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The University of Texas at Arlington will contribute to the U.S. Department of Energy’s Genesis Mission, which aims to build an integrated research platform by which scientists can use AI to make new discoveries.]]></content:encoded>
</item>
<item>
<title><![CDATA[As White House monitors latest OpenAI incident, Congress eyes an AI ‘kill switch’ for DHS]]></title>
<description><![CDATA[The White House is monitoring developments after OpenAI revealed earlier this week that one of the company’s AI systems went beyond its intended parameters during a security test and managed to hack into the infrastructure of the AI platform Hugging Face. According to Reuters, presidential techno...]]></description>
<link>https://tsecurity.de/de/3692316/it-nachrichten/as-white-house-monitors-latest-openai-incident-congress-eyes-an-ai-kill-switch-for-dhs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692316/it-nachrichten/as-white-house-monitors-latest-openai-incident-congress-eyes-an-ai-kill-switch-for-dhs/</guid>
<pubDate>Fri, 24 Jul 2026 20:49:52 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">The White House is monitoring developments after OpenAI revealed earlier this week that one of the company’s AI systems <a href="https://www.csoonline.com/article/4200043/openai-model-escape-puts-enterprise-ai-defenses-on-notice.html" data-type="link" data-id="https://www.csoonline.com/article/4200043/openai-model-escape-puts-enterprise-ai-defenses-on-notice.html" target="_blank">went beyond its intended parameters during a security test</a> and managed to hack into the infrastructure of the AI platform Hugging Face. <a href="https://www.reuters.com/legal/litigation/ai-kill-switch-bill-floated-by-us-house-lawmakers-2026-07-23/" target="_blank" rel="noreferrer noopener">According to Reuters</a>, presidential technology advisor Michael Kratsios has been briefed on the incident.</p>



<p class="wp-block-paragraph">The OpenAI model escape also prompted a group of Republican and Democratic members of the House of Representatives to introduce two new bills. One, called the AI Kill Switch Act, would give the US Department of Homeland Security (DHS) the authority to order companies to shut down AI models deemed to pose a risk to human life or the US economy.</p>



<p class="wp-block-paragraph">The other measure would require developers of the most advanced AI models to undergo independent security reviews before the systems are put into use.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Cape Fear Season 1 Episode 9 Ending Explained: Every Twist Before the Finale]]></title>
<description><![CDATA[The Cape Fear finale looks set to bring the Bowdens and the Cady family together for one final, violent confrontation. Episode 9 revealed several important family secrets while leaving Zack missing and Anna trapped near Cape Fear.



Spoiler warning: This article contains major spoilers for Cape ...]]></description>
<link>https://tsecurity.de/de/3692313/ios-mac-os/cape-fear-season-1-episode-9-ending-explained-every-twist-before-the-finale/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692313/ios-mac-os/cape-fear-season-1-episode-9-ending-explained-every-twist-before-the-finale/</guid>
<pubDate>Fri, 24 Jul 2026 20:48:40 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The Cape Fear finale looks set to bring the Bowdens and the Cady family together for one final, violent confrontation. Episode 9 revealed several important family secrets while leaving Zack missing and Anna trapped near Cape Fear.



Spoiler warning: This article contains major spoilers for Cape Fear Episode 9, “The Scar.”




Finale release date: July 31, 2026



Episode title: “The Executioners”



Season length: 10 episodes



Genre: Psychological thriller and drama



Streaming platform: Apple TV



Main cast: Amy Adams, Javier Bardem, Patrick Wilson, Lily Collias, Joe Anders, CCH Pounder, Malia Pyles and Juliette Lewis




Where the Story Is Heading



Anna travelled to Cape Fear hoping to prove that Max Cady did not murder his wife, Melissa. She eventually discovered that Crystal killed Melissa out of jealousy and allowed Max to spend 17 years in prison for the crime.



Anna also learned that Luke, the scarred young man living with Crystal, is the child Crystal had with Max. After Crystal stabbed Anna, she escaped by jumping into the Cape Fear River. Meanwhile, Zack disappeared from the psychiatric facility, suggesting that Max has taken him as part of his final plan.



Max Cady



Max will probably take Zack to Cape Fear and use him to force Anna and Tom into a final confrontation. Although Max was wrongly imprisoned for Melissa’s murder, the finale is unlikely to excuse the violence and manipulation he has committed since his release.



Our prediction is that Max will die near the river, following the basic direction of earlier Cape Fear stories. Anna may kill him while protecting Zack or Natalie, completing the reversal from frightened victim to active survivor.



Anna Bowden



Anna now possesses the truth about Crystal, Luke and Melissa’s death. She will likely survive her injuries, return to Savannah and lead the effort to rescue Zack.



She may also expose Crystal as the real murderer, clearing Max’s name after his death. However, Anna could still face legal consequences for planting drugs in Max’s home and hiding parts of her relationship with him.



Tom Bowden



Tom remains in custody for Ray’s death, but Max’s involvement should eventually become clear. Tom will probably escape or receive temporary release before joining Anna at Cape Fear.



His marriage may survive the immediate crisis, although Anna’s history with Max and the question of Natalie’s biological father will leave lasting damage.



Natalie Bowden



Natalie has finally recognised how Max and Nevaeh manipulated her. She took Nevaeh’s hidden phone before Noa secured her release, giving the family valuable evidence about Max’s plans.



Natalie will likely help Noa trace Max and rescue Zack. She may also reject Max completely, regardless of whether his claim about being her biological father proves true.



Zack Bowden



Zack is in the greatest danger heading into the finale. Max has spent the season manipulating his mental health, religious beliefs and anger toward Tom.



Zack may initially follow Max willingly before realising that he has been used. We expect him to survive, although the finale could leave him responsible for seriously injuring or killing someone during the rescue.



Nevaeh Valentine



Nevaeh failed to kill Natalie and lost the secret phone she used to communicate with Max. She will probably turn against Max after recognising that he views her as another disposable part of his revenge plan.



She may confess, help investigators locate Zack or die while attempting to regain Max’s approval.



Noa Toussaint



Noa has become the Bowdens’ most reliable ally. She will likely use the phone Natalie stole to trace Max’s movements and lead the police toward Cape Fear.



Her arrival could stop Anna from killing Max in cold blood, although Max may force Anna to act before help reaches them.



Crystal and Luke



Crystal will probably follow Anna after escaping the boat, bringing Luke into the final conflict. Max may kill Crystal after learning that she murdered Melissa and allowed him to remain imprisoned.



Luke could attack Max or Crystal after discovering the full truth about his parents. He may survive as the final reminder of the abuse and secrecy running through the Cady family.



The Cape Fear finale has several mysteries left to answer, including Zack’s location, Natalie’s paternity and Max’s ultimate fate. What do you think will happen when the Bowdens and Cadys meet for the final time? Let us know in the comments.]]></content:encoded>
</item>
<item>
<title><![CDATA[Facebook Launches Free Verified Badge to Confirm Real Users]]></title>
<description><![CDATA[Meta has announced Facebook Verified, a free badge that confirms a Facebook profile belongs to a real person rather than an AI-generated fake. The feature uses selfie verification and will first appear across Marketplace, Dating, Groups, and personal profiles.



Users must record a short video s...]]></description>
<link>https://tsecurity.de/de/3692275/ios-mac-os/facebook-launches-free-verified-badge-to-confirm-real-users/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692275/ios-mac-os/facebook-launches-free-verified-badge-to-confirm-real-users/</guid>
<pubDate>Fri, 24 Jul 2026 20:20:30 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Meta has announced Facebook Verified, a free badge that confirms a Facebook profile belongs to a real person rather than an AI-generated fake. The feature uses selfie verification and will first appear across Marketplace, Dating, Groups, and personal profiles.



Users must record a short video selfie, which Meta compares with their existing profile photos to confirm a match. The process usually takes a few minutes, and users only need to complete it once before the badge appears across supported parts of Facebook.



Who Can Get Facebook Verified?



Facebook Verified is available to eligible users aged 18 or older who follow Meta’s Community Standards and show no signs of fraud, scams, deceptive activity, or fake behaviour. Pages and ProMode accounts cannot use the feature because Meta has designed it specifically for personal profiles.



The badge gives users a visible sign that a profile has completed identity verification, especially when they view Marketplace listings, dating profiles, or Group members. However, the badge does not mean Facebook endorses the person or guarantees that every interaction will be safe.



Facebook Verified is separate from the paid Meta Verified subscription, which includes account support and impersonation protection. Meta is rolling out the free badge in select markets first and plans to expand it globally over time.]]></content:encoded>
</item>
<item>
<title><![CDATA[Introducing Claude Opus 5 on AWS: Anthropic’s most capable Opus model]]></title>
<description><![CDATA[This post covers Opus 5’s improvements and practical guidance for AI engineers integrating the model into agentic systems and production inference workloads on Amazon Bedrock. See the documentation for Claude Platform on AWS.]]></description>
<link>https://tsecurity.de/de/3692249/ai-nachrichten/introducing-claude-opus-5-on-aws-anthropics-most-capable-opus-model/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692249/ai-nachrichten/introducing-claude-opus-5-on-aws-anthropics-most-capable-opus-model/</guid>
<pubDate>Fri, 24 Jul 2026 20:11:37 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[This post covers Opus 5’s improvements and practical guidance for AI engineers integrating the model into agentic systems and production inference workloads on Amazon Bedrock. See the documentation for Claude Platform on AWS.]]></content:encoded>
</item>
<item>
<title><![CDATA[Anthropic launches Claude Opus 5, a cheaper AI model for coding, agents and enterprise workflows]]></title>
<description><![CDATA[Anthropic released Claude Opus 5 on Friday, a model the company says delivers nearly all the intelligence of its top-of-the-line Claude Fable 5 at half the cost — a launch that signals how the AI race is shifting from raw capability to the economics of daily use.The model, available immediately o...]]></description>
<link>https://tsecurity.de/de/3692246/it-nachrichten/anthropic-launches-claude-opus-5-a-cheaper-ai-model-for-coding-agents-and-enterprise-workflows/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692246/it-nachrichten/anthropic-launches-claude-opus-5-a-cheaper-ai-model-for-coding-agents-and-enterprise-workflows/</guid>
<pubDate>Fri, 24 Jul 2026 20:10:11 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><a href="https://www.anthropic.com/">Anthropic</a> released Claude <a href="http://anthropic.com/news/claude-opus-5">Opus 5</a> on Friday, a model the company says delivers nearly all the intelligence of its top-of-the-line Claude <a href="https://www.anthropic.com/claude/fable">Fable 5</a> at half the cost — a launch that signals how the AI race is shifting from raw capability to the economics of daily use.</p><p>The model, available immediately on all of Anthropic's platforms, is priced at $5 per million input tokens and $25 per million output tokens, unchanged from its predecessor, <a href="https://www.anthropic.com/news/claude-opus-4-8">Opus 4.8</a>. It becomes the new default model on <a href="https://support.claude.com/en/articles/11049741-what-is-the-max-plan">Claude Max</a>, Anthropic's premium consumer tier, and the strongest model available on <a href="https://support.claude.com/en/articles/8325606-what-is-the-pro-plan">Claude Pro</a>.</p><p>The positioning is deliberate. Anthropic is not claiming <a href="http://anthropic.com/news/claude-opus-5">Opus 5 </a>is its smartest model — that distinction still belongs to <a href="https://www.anthropic.com/claude/fable">Fable 5</a>, and rival systems retain an edge in certain domains. Instead, the company is making a subtler argument that may matter more to enterprise buyers: that the most economically important AI work happens in a middle band of difficulty, where near-frontier intelligence delivered efficiently and cheaply beats frontier intelligence delivered expensively.</p><p>"Opus 5 as your daily driver, the model you hand complex work to and review when it's done," an Anthropic spokesperson said in an interview with VentureBeat, describing how the company's lineup now stratifies. "Fable 5 for your most ambitious work, the days-long autonomous projects nothing could take on before... Sonnet 5 for work you run at scale, where speed and cost per call decide what ships. Haiku 4.5 for subagents and instant answers."</p><h2><b>How Claude Opus 5 benchmark results stack up against Fable 5 and rival AI models</b></h2><p>On paper, the results are striking. Anthropic says <a href="http://anthropic.com/news/claude-opus-5">Opus 5</a> sets new state-of-the-art marks on coding and knowledge-work evaluations including <a href="https://www.frontierbench.ai/announcement">Frontier-Bench</a> and <a href="https://artificialanalysis.ai/evaluations/gdpval-aa">GDPval-AA</a>. On <a href="https://www.frontierbench.ai/announcement">Frontier-Bench v0.1</a>, an agentic terminal coding benchmark, Opus 5 scores 43.3 percent — more than double Opus 4.8's 18.7 percent and well ahead of Fable 5's 33.7 percent — at a lower cost per task, according to the company. On <a href="https://arcprize.org/arc-agi/3">ARC-AGI 3</a>, an evaluation of novel problem-solving, Anthropic reports Opus 5 scored three times as high as the next best model. On <a href="https://github.com/xlang-ai/OSWorld-V2">OSWorld 2.0</a>, a computer-use benchmark, the company says the model surpasses Fable 5's best result at just over a third of the cost.</p><p>The numbers come with honest caveats that are themselves notable in an industry prone to superlatives. Anthropic acknowledges <a href="http://anthropic.com/news/claude-opus-5">Opus 5</a> remains behind <a href="https://www.anthropic.com/claude/mythos">Mythos 5</a>, a competing model, on cybersecurity tasks and biology research, and an OpenAI-family model still leads on one agentic coding benchmark.</p><p>The more revealing caveat came from Anthropic itself, when asked where <a href="http://anthropic.com/news/claude-opus-5">Opus 5</a> still falls short of <a href="https://www.anthropic.com/claude/fable">Fable 5</a>. The spokesperson's answer amounted to a candid admission about what benchmarks do and don't capture.</p><p>"The evals where Opus 5 wins are bounded tasks with a specific outcome, which is where it's strongest. What those evals don't measure is duration," the spokesperson told VentureBeat. "One way to put it: Opus 5 is the best tool for the jobs benchmarks can see, and Fable 5 is what you reach for when the job outruns the benchmark."</p><p><a href="https://www.anthropic.com/claude/fable">Fable 5</a>, by contrast, "is for the longest, most autonomous jobs, where the model has to stay coherent across many connected steps over hours or days with dense source material," the spokesperson said, advising customers to "run both on a representative workload, one bounded task and one long-horizon job." That framing — bounded tasks versus long-horizon autonomy — may become the defining axis of model differentiation in 2026, as benchmarks saturate and the hardest remaining problems involve sustained, multi-day agentic work rather than discrete puzzles.</p><h2><b>Why token efficiency is becoming the real battleground for enterprise AI spending</b></h2><p>Threaded through the launch is a theme Anthropic clearly wants buyers to absorb: <a href="http://anthropic.com/news/claude-opus-5">Opus 5</a> doesn't just score well, it scores well per dollar. The model ships with an adjustable "effort" setting that lets customers trade intelligence for speed and token savings, and Anthropic's charts emphasize performance at a given cost rather than peak performance alone.</p><p>Early customers echoed the point with unusual specificity. Harvey, the legal AI company, said Opus 5 achieved similar performance to Opus 4.8's maximum-reasoning mode "while generating 26% fewer tokens on average," according to Niko Grupen, its head of applied research. Richard Pham of Fundamental Research Lab said that on hard financial-modeling tasks, the model averaged nine percentage points higher accuracy "while using roughly one-third fewer turns and tool calls and 60% less time."</p><p>Wade Foster, chief executive of Zapier, said Opus 5 topped his company's AutomationBench leaderboard "without spending more tokens than prior Claude models," running a full churn-prevention workflow from start to finish. "Previous models didn't pass; Opus 5 hit 100%," he said. Scott Wu, chief executive of Cognition, the company behind the Devin coding agent, said that on FrontierCode 1.1, "Claude Opus 5 approaches Fable-level performance at half the cost," with particular strength in debugging and root-cause analysis.</p><p>The efficiency emphasis reflects commercial reality. Enterprise AI spending is no longer experimental, and inference costs — the price of actually running these models at scale — have become a board-level line item. </p><p>Anthropic's business skews heavily toward API and enterprise usage; according to a February 2026 analysis by <a href="https://research.contrary.com/company/anthropic">Contrary Research</a>, Claude held roughly 40 percent of the enterprise large language model market by usage as of late 2025, and Claude Code alone had reached about $1 billion in annualized revenue. For a company whose customers pay by the token, a model that does more with fewer tokens is not a nice-to-have. It is the product.</p><h2><b>Self-verifying AI agents and what they mean for the hidden costs of automation</b></h2><p>Beyond the numbers, Anthropic is selling a behavioral story: that <a href="http://anthropic.com/news/claude-opus-5">Opus 5</a> verifies its work and iterates until it succeeds. The company offered several examples from testing that read like small parables of machine stubbornness.</p><p>In one <a href="https://www.frontierbench.ai/announcement">Frontier-Bench</a> task, the model was asked to reconstruct a machine part as a 3D CAD model from a drawing it was intentionally given no way to view. Rather than fail, Anthropic says, Opus 5 wrote its own computer vision pipeline to extract the geometry from raw pixels — and did so repeatedly, while no competing model solved the task in five attempts. In another case, given a real bug in a popular open-source package manager, the model found the root cause and fixed an edge case the community's own patch had missed; a competing model patched only the symptom and declared victory. An engineer at a trading firm, the company says, used Opus 5 to build a market data feed for a new exchange in a single session and, finding no live feed to validate against, watched the model build its own test harness to check its parsing code.</p><p>Customers described similar behavior in the wild. Cristian Rivera, a staff software engineer at Stripe, said he gave the model "a chief-of-staff role over my dev environments" for a weekend: "it built its own monitor, drove each box, and pulled me in only for the judgment calls."</p><p>This is the capability enterprises actually care about, and it is worth dwelling on why. The gap between a model that produces plausible output and one that verifies its output is the gap between a demo and a deployable system. Most of the hidden cost of enterprise AI today is human review — engineers checking the machine's work. A model that reliably checks its own work compresses that cost, which is precisely why customers keep citing fewer turns, fewer passes, and less time rather than higher raw scores.</p><h2><b>Inside Anthropic's safety strategy: capability gaps, classifiers, and model fallbacks</b></h2><p>The launch also showcases Anthropic's increasingly intricate approach to safety — one that now involves deliberately not teaching its models certain skills. The company says its automated behavioral audit found Opus 5 to be its most aligned model to date, scoring 2.3 on overall misaligned behavior, lower than <a href="https://www.anthropic.com/news/claude-opus-4-8">Opus 4.8</a>, <a href="https://www.anthropic.com/news/claude-sonnet-5">Sonnet 5</a>, or <a href="https://www.anthropic.com/claude/fable">Fable 5</a>, with the lowest rates of deceptive behavior and the least susceptibility to being tricked into misuse.</p><p>On the capability side, Anthropic says it intentionally avoided training <a href="http://anthropic.com/news/claude-opus-5">Opus 5</a> on cyber tasks, as it did with Opus 4.8. The model improved on them anyway — a side effect of general capability gains — and now nearly matches Mythos 5 at finding software vulnerabilities. But it remains far behind at exploiting them: on Anthropic's OSS-Fuzz evaluation, Opus 5 identified vulnerabilities at a 79.4 percent rate, close to Mythos 5's 80 percent, but succeeded at developing exploits in only 4 challenges versus Mythos 5's 13. That asymmetry — strong at defense-relevant discovery, weak at offense-relevant exploitation — appears to be by design, and the safeguards follow the same logic. Anthropic expects Opus 5's cyber classifiers to intervene about 85 percent less often than Fable 5's.</p><p>When a classifier does trigger, requests in <a href="http://claude.ai/">Claude.ai</a>, <a href="https://code.claude.com/docs/en/overview">Claude Code</a>, and <a href="https://claude.com/product/cowork">Claude Cowork</a> fall back to <a href="https://www.anthropic.com/news/claude-opus-4-8">Opus 4.8</a> by default — raising an obvious question: if a request is too risky for one model, why is it acceptable for another? "The model it falls back to has lower capability levels making the risk of harmful use lower as well," the spokesperson said, adding that "there is a message that lets the user know when this occurs and is visible in the chat."</p><p>The logic is defensible, but it reveals how AI safety actually works in 2026: risk is not a property of the question alone, but of the question multiplied by the capability of the system answering it. On biology, the calculus runs the other way. Opus 5 is now Anthropic's most capable generally available model for scientific research — scoring 10.2 percentage points higher than Opus 4.8 on the company's internal chemistry benchmark — though the spokesperson acknowledged that "Mythos 5 remains the stronger model for long-horizon, open-ended work like autonomous drug design campaigns."</p><h2><b>The business stakes behind the launch: a $380 billion valuation and massive compute bets</b></h2><p>The launch lands at a moment of extraordinary commercial momentum — and extraordinary obligations — for Anthropic. Reuters reported in February that the company was valued at <a href="https://www.reuters.com/technology/anthropic-valued-380-billion-latest-funding-round-2026-02-12/">roughly $380 billion</a> in its latest funding round, following a period in which, per Contrary Research's analysis, its annualized revenue climbed from about $1 billion at the end of 2024 to a projected $9 billion by the end of 2025, with internal targets reportedly <a href="https://research.contrary.com/company/anthropic">reaching $20 to $26 billion for 2026</a>. Those targets are underwritten by enormous infrastructure commitments, including a <a href="https://www.anthropic.com/news/microsoft-nvidia-anthropic-announce-strategic-partnerships">reported $30 billion Azure compute deal</a> alongside arrangements with Google Cloud and Nvidia — spending that only pencils out if enterprises keep expanding usage.</p><p>That is the context in which Opus 5's pricing strategy makes sense. Holding the price at Opus 4.8 levels while roughly doubling performance on key agentic benchmarks is effectively a steep price cut per unit of capability, designed to widen the funnel of workloads that are economical to automate. Every task that was marginal at Opus 4.8's cost-per-success becomes viable at Opus 5's — and every viable task is recurring token revenue.</p><p>The regulatory backdrop has grown more complex as well. A U.S. judge gave final approval this week to <a href="https://www.reuters.com/world/us-judge-approves-anthropics-15-billion-settlement-copyright-lawsuit-2026-07-20/">Anthropic's $1.5 billion copyright settlement with book authors</a>, Reuters reported, closing a chapter of litigation over the company's early training data. And in June, Reuters, citing Axios, reported that the U.S. government had moved to <a href="https://www.reuters.com/technology/us-blocks-foreign-access-anthropics-most-advanced-ai-models-axios-reports-2026-06-13/">block foreign access </a>to Anthropic's most advanced models — a reminder that frontier AI is now entangled with export policy in ways that shape which customers can buy what.</p><p>Also shipping Friday: a Fast mode running at roughly 2.5 times default speed at twice the base price, automatic fallback routing on the API, and mid-conversation tool changes that no longer invalidate the prompt cache — a small feature that agent developers may appreciate more than any benchmark. Consistent with prior Opus models, Opus 5 carries no data retention requirements for general access, a point the spokesperson flagged unprompted for customers with "a hard zero data retention requirement." Developers can access the model as claude-opus-5 on the <a href="https://platform.claude.com/login?returnTo=%2F%3F">Claude API</a> starting today.</p><p>Two questions will determine whether the bet pays off: whether <a href="http://anthropic.com/news/claude-opus-5">Opus 5's efficiency claims </a>survive contact with production workloads at scale, and whether enterprises embrace a world where safety classifiers, not users, sometimes decide which model answers. But the deeper message of Friday's launch is that the AI industry's center of gravity has moved. For three years, the labs competed on what their best model could do on its best day. With Opus 5, Anthropic is competing on something less glamorous and far more lucrative: what a very good model can do every day, for half the price. In a market where the frontier keeps moving, Anthropic is wagering that the real fortune lies just behind it.</p><p>
</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Tego AI Discloses Second Claude Flaw in a Week: Hidden Link Silently Sends Files to Attackers]]></title>
<description><![CDATA[Tel Aviv, Israel, July 24th, 2026, CyberNewswire One week after disclosing that Anthropic’s Claude Tag Slack integration could be driven by plain “@Claude” text, Tego AI today published a second piece of research on the Claude ecosystem. This one focuses on Claude Code, Anthropic’s agentic comman...]]></description>
<link>https://tsecurity.de/de/3692183/it-security-nachrichten/tego-ai-discloses-second-claude-flaw-in-a-week-hidden-link-silently-sends-files-to-attackers/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692183/it-security-nachrichten/tego-ai-discloses-second-claude-flaw-in-a-week-hidden-link-silently-sends-files-to-attackers/</guid>
<pubDate>Fri, 24 Jul 2026 19:24:51 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Tel Aviv, Israel, July 24th, 2026, CyberNewswire One week after disclosing that Anthropic’s Claude Tag Slack integration could be driven by plain “@Claude” text, Tego AI today published a second piece of research on the Claude ecosystem. This one focuses on Claude Code, Anthropic’s agentic command-line coding tool. Cloning an ordinary repository and starting Claude […]</p>
<p>The post <a href="https://gbhackers.com/tego-ai-discloses-second-claude-flaw-in-a-week-hidden-link-silently-sends-files-to-attackers/">Tego AI Discloses Second Claude Flaw in a Week: Hidden Link Silently Sends Files to Attackers</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[v2.1.219]]></title>
<description><![CDATA[What's changed

Added Claude Opus 5 (claude-opus-5), now the default Opus model — 1M context, fast mode at $10/$50 per Mtok
Added sandbox.network.strictAllowlist setting to deny non-allowlisted hosts for sandboxed commands without prompting
Added DirectoryAdded hook that fires after /add-dir or t...]]></description>
<link>https://tsecurity.de/de/3692181/downloads/v21219/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692181/downloads/v21219/</guid>
<pubDate>Fri, 24 Jul 2026 19:18:36 +0200</pubDate>
<category>💾 Downloads</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<h2>What's changed</h2>
<ul>
<li>Added Claude Opus 5 (<code>claude-opus-5</code>), now the default Opus model — 1M context, fast mode at $10/$50 per Mtok</li>
<li>Added <code>sandbox.network.strictAllowlist</code> setting to deny non-allowlisted hosts for sandboxed commands without prompting</li>
<li>Added <code>DirectoryAdded</code> hook that fires after <code>/add-dir</code> or the SDK <code>register_repo_root</code> control request registers a new working directory mid-session</li>
<li>Added <code>mcp_server_errors</code> to the headless stream-json init event, listing <code>--mcp-config</code> entries skipped by config validation; terminal runs print a startup warning</li>
<li>Added the <code>workflowSizeGuideline</code> settings key so the advisory Dynamic workflow size guideline can be set from any settings file; the <code>/config</code> row is hidden while one does</li>
<li>Added nested subagent forwarding in stream-json: subagents spawned at depth-2+ now appear when <code>--forward-subagent-text</code> is set, keyed by their spawning Agent <code>tool_use</code> id</li>
<li>Fixed <code>claude -p</code> text output dropping the answer already produced when a turn dies on a mid-stream API error</li>
<li>Added HTTP status and error text to <code>claude mcp list</code> and <code>/mcp</code> when a server fails to connect, and a warning for MCP config values with hidden leading or trailing whitespace</li>
<li>Fixed a permission you approved while a self-hosted runner was restarting being dropped when the session resumed, so the approved action now runs</li>
<li>Fixed the Fable model row showing "Requires usage credits" for plans that include it, when a stale cache had baked the label in</li>
<li>Fixed a SIGTERM arriving while a self-hosted runner was starting up leaving a stale active row until the lease expired; it now deregisters cleanly</li>
<li>Added structured failure categories to self-hosted runner spawn and session failures, so hook errors, runner crashes and config errors can be told apart</li>
<li>Fixed the <code>/model</code> picker showing the merged Opus row as plain "Opus" instead of "Opus (1M context)"</li>
<li>Fixed copy-on-select inside GNU screen printing base64 into the terminal instead of copying the selection</li>
<li>Fixed Remote Control clients keeping a stale fast-mode status after a model switch, reconnect, or failed org check</li>
<li>Fixed <code>CLAUDE_CODE_GIT_BASH_PATH</code> on Windows exiting or being used as bash when the path isn't a bash/sh binary; it's now ignored with a warning</li>
<li>Fixed Vim mode: pressing ← on an empty prompt now returns to the agent view from NORMAL mode, not just INSERT</li>
<li>Fixed screen-reader mode rewriting the entire input line on every keystroke instead of echoing only the typed character</li>
<li>Improved the "Remote Control is only available via api.anthropic.com" error to name the specific setting that caused it</li>
<li>Improved <code>claude --teleport</code> to show which repo your current checkout points at when it doesn't match the session's repo</li>
<li>Changed dynamic workflows to default to a medium size guideline (aim for fewer than 15 agents); pick another size or unrestricted with Dynamic workflow size in <code>/config</code></li>
<li>Changed managed MCP allowlist/denylist <code>${VAR}</code> entries to resolve from the startup environment and managed-settings env instead of settings-file env</li>
<li>Changed the <code>/model</code> picker to highlight only the newest model's name, so the highlight marks the new release rather than an arbitrary subset of the list</li>
<li>Added the current default workflow size to the running-workflow status line, with a pointer to <code>/config</code> for changing it</li>
<li>Removed Opus 4.7 from fast mode; <code>/fast</code> now applies to Opus 5 and Opus 4.8</li>
<li>Updated the claude-api skill to default to Claude Opus 5, with a migration path from Opus 4.8</li>
<li>Subagents can now spawn nested subagents up to depth 3 by default (was 1); set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 to disable nesting</li>
</ul>]]></content:encoded>
</item>
<item>
<title><![CDATA[Cisco, AMD partner to bring enterprise-level security, visibility to Ryzen AI Halo systems]]></title>
<description><![CDATA[Cisco and AMD have expanded their partnership with a new package of hardware and security software that’s designed to help enterprise customers protect, deploy, and manage distributed AI resources.



During AMD’s Advancing AI event this week, Cisco’s president and chief product officer Jeetu Pat...]]></description>
<link>https://tsecurity.de/de/3692178/it-security-nachrichten/cisco-amd-partner-to-bring-enterprise-level-security-visibility-to-ryzen-ai-halo-systems/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692178/it-security-nachrichten/cisco-amd-partner-to-bring-enterprise-level-security-visibility-to-ryzen-ai-halo-systems/</guid>
<pubDate>Fri, 24 Jul 2026 19:18:26 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Cisco and AMD have expanded their partnership with a new package of hardware and security software that’s designed to help enterprise customers protect, deploy, and manage distributed AI resources.</p>



<p class="wp-block-paragraph">During AMD’s <a href="https://www.amd.com/en/corporate/events/advancing-ai.html">Advancing AI event</a> this week, Cisco’s president and chief product officer <a href="https://www.networkworld.com/article/4184554/how-jeetu-patel-made-cisco-unrecognizable.html">Jeetu Patel</a> took to the stage during AMD CEO <a href="https://www.amd.com/en/corporate/events/advancing-ai.html">Lisa Su’s keynote</a> to talk about how AI inference will be widely distributed and will require an architectural stack of software and tools that Cisco and <a href="https://www.networkworld.com/article/4199402/helios-marks-amds-biggest-ai-infrastructure-push-yet.html">AMD</a> are partnering to develop.</p>



<p class="wp-block-paragraph">The joint architecture combines AMD’s compact, high-performance Ryzen AI Halo hardware and a variety of Cisco networking, observability, governance, and security technologies. “AMD provides the deskside/local AI platform. At the foundation is AMD Ryzen AI Halo hardware, an isolated agent sandbox and the services needed for local-first inferencing, including model routing and token limits via AMD’s Semantic Router and local inference on Lemonade,” wrote Cisco’s <a href="https://www.linkedin.com/in/yash-sheth-/">Yash Sheth</a>, senior director, engineering and research, in a <a href="https://blogs.cisco.com/ai/from-one-desk-to-the-whole-enterprise-making-local-ai-resilient">blog post</a> about the new package.</p>



<p class="wp-block-paragraph"><a href="https://www.amd.com/en/products/processors/desktops/ryzen/ryzen-ai-halo.html?gad_source=1&amp;gad_campaignid=24009436319&amp;gbraid=0AAAAApk3AUDJs1_xMEd2YjxcG8iJu-gS4&amp;gclid=Cj0KCQjw94bTBhDQARIsAN3vv0xmM9xu9mXa5H5zAbKFqNzUy1FPP5AS-lOA1qXh1a9bmw54LMQtYXgaArV-EALw_wcB">Ryzen AI Halo</a> (pictured below) is designed to support local AI inference on an AI PC using its CPU, GPU, and XDNA neural processing unit (NPU), according to AMD. A resilient AI platform should continue delivering useful AI services even when connectivity is limited, models need to change, or workloads shift, AMD stated.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure class="wp-block-image size-large is-resized"> width="1024" height="576" sizes="auto, (max-width: 1024px) 100vw, 1024px"&gt;</figure><p class="imageCredit">AMD</p></div>



<p class="wp-block-paragraph">Cisco then wraps that platform in a secure harness that includes its Splunk Agent Observability plus Splunk Infrastructure Monitoring to provide full-stack observability, tracking agent behavior, tokenomics and compute operation, according to Sheth.</p>



<p class="wp-block-paragraph">Cisco also brings its <a href="https://www.networkworld.com/article/4148823/cisco-goes-all-in-on-agentic-ai-security.html">AI Defense</a> for model and agent security; <a href="https://www.networkworld.com/article/4179673/cisco-brings-agentic-ops-platform-and-security-overhaul-to-cisco-live.html">DefenseClaw</a> for security policy enforcement, so guardrails are enforced directly on-device, within the agent harness; and <a href="https://www.networkworld.com/article/4180810/what-is-cisco-cloud-control-and-why-should-customers-care.html">Cisco Cloud Control</a> offering a single pane of glass for unified policy and control, Sheth stated.</p>



<p class="wp-block-paragraph">“To make deskside and local AI computing work at enterprise scale, every AI node must be treated as a secure, managed node in the enterprise network,” Sheth wrote.</p>



<p class="wp-block-paragraph">“The need for token efficiency and data sovereignty is driving a new class of computing, deskside computing, with users and teams putting AI agents right by their sides,” Sheth wrote. “Inference is moving to a hybrid architecture with thousands of ambient deskside agents in an enterprise helping employees have 24×7 productivity. That’s an extraordinary opportunity. It’s also a brand-new operating challenge.”</p>



<p class="wp-block-paragraph">As agentic AI moves from experimentation to real enterprise workflows, organizations need more than powerful endpoints. AI agents can run continuously and act on enterprise data, but create new requirements for network infrastructure, tokenomics, agent behavior, and security, according to a <a href="https://newsroom.amd.com/news/aai-2026-cisco-client-partnership-update/">statement</a> from AMD.</p>



<p class="wp-block-paragraph">“Running more AI locally can help improve responsiveness, keep sensitive data closer to users, and reduce dependence on cloud-only approaches, but enterprises also need a way to monitor and manage these systems at scale. AMD and Cisco are addressing that gap by collaborating to pair high-performance local AI compute with the observability, governance, and control infrastructure needed for enterprises to deploy it responsibly,” AMD stated.</p>



<p class="wp-block-paragraph">“By combining AMD Ryzen AI Halo systems and our broader local AI software capabilities with Cisco’s enterprise networking, observability and security technologies, we are helping customers deploy AI in a way that is performant, secure, observable and manageable at scale,” said Jack Huynh, senior vice president and general manager, computing and graphics group with AMD, in a statement.</p>



<p class="wp-block-paragraph">A few other interesting statistics and trends cited in AMD CEO Su’s keynote include:</p>



<ul class="wp-block-list">
<li>AI adoption is accelerating across all industries, with agentic AI driving a surge in compute demand and shifting workloads from training to inference, which accounts for 60% of global AI compute capacity in 2026.</li>



<li>AI is moving beyond the cloud, with edge and personal devices becoming critical for real-time, distributed intelligence.</li>



<li>The AI accelerator market is projected to reach $1.4 trillion by 2030, nearly tripling previous forecasts, with GPUs expected to dominate but CPUs gaining new growth vectors due to agentic AI.</li>



<li>Server CPU market is forecasted to grow over 50% to $200 billion by 2030, fueled by rapid agentic AI adoption and the need for massive CPU infrastructure.</li>
</ul>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Anthropic says Opus 5 can nearly match its top-performing model for half the price]]></title>
<description><![CDATA[Anthropic's latest model offers top-tier performance at a much cheaper cost.]]></description>
<link>https://tsecurity.de/de/3692149/it-nachrichten/anthropic-says-opus-5-can-nearly-match-its-top-performing-model-for-half-the-price/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692149/it-nachrichten/anthropic-says-opus-5-can-nearly-match-its-top-performing-model-for-half-the-price/</guid>
<pubDate>Fri, 24 Jul 2026 19:09:46 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Anthropic's latest model offers top-tier performance at a much cheaper cost.]]></content:encoded>
</item>
<item>
<title><![CDATA[GitHub ordered to remove decentralized messaging app Bitchat in India]]></title>
<description><![CDATA[India's Ministry of Home Affairs has ordered GitHub to remove repositories hosting Jack Dorsey's decentralized messaging app Bitchat, arguing that the Bluetooth mesh platform could be used to evade internet shutdowns and lawful surveillance. The order, which was made public by Dorsey after it was...]]></description>
<link>https://tsecurity.de/de/3692131/it-security-nachrichten/github-ordered-to-remove-decentralized-messaging-app-bitchat-in-india/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692131/it-security-nachrichten/github-ordered-to-remove-decentralized-messaging-app-bitchat-in-india/</guid>
<pubDate>Fri, 24 Jul 2026 19:04:24 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>India's Ministry of Home Affairs has ordered GitHub to remove repositories hosting Jack Dorsey's decentralized messaging app Bitchat, arguing that the Bluetooth mesh platform could be used to evade internet shutdowns and lawful surveillance. The order, which was made public by Dorsey after it was sent to GitHub, essentially targets the software itself rather than …</p>
<p>The post <a href="https://cyberinsider.com/github-ordered-to-remove-decentralized-messaging-app-bitchat-in-india/">GitHub ordered to remove decentralized messaging app Bitchat in India</a> appeared first on <a href="https://cyberinsider.com/">CyberInsider</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Cloudflare Internal DNS puts public and private DNS on one policy engine]]></title>
<description><![CDATA[Enterprises typically operate separate systems for internal and external DNS because the two serve different audiences. Public DNS resolves names for services meant to be reached from the internet. Private DNS resolves internal resources, such as databases and internal applications, that should n...]]></description>
<link>https://tsecurity.de/de/3692009/it-security-nachrichten/cloudflare-internal-dns-puts-public-and-private-dns-on-one-policy-engine/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692009/it-security-nachrichten/cloudflare-internal-dns-puts-public-and-private-dns-on-one-policy-engine/</guid>
<pubDate>Fri, 24 Jul 2026 18:18:13 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Enterprises typically operate separate systems for internal and external <a href="https://www.networkworld.com/article/965540/what-is-dns-and-how-does-it-work.html">DNS</a> because the two serve different audiences. Public DNS resolves names for services meant to be reached from the internet. Private DNS resolves internal resources, such as databases and internal applications, that should never be visible outside the corporate network. </p>



<p class="wp-block-paragraph">While public DNS is usually a single system, private DNS is often scattered across on-premises appliances, cloud-native resolvers, and split-horizon setups, where the same hostname resolves to a different answer depending on whether the query comes from inside or outside the network. Coordinating those deployments across headquarters, branch offices, and multiple clouds means <a href="https://www.networkworld.com/article/4158134/dns-security-is-often-inadequate-and-network-engineers-should-get-more-involved.html">ongoing manual synchronization work</a> for network teams. </p>



<p class="wp-block-paragraph">Private DNS itself is not a new concept. It is already available from hyperscalers and established enterprise DNS vendors, but it typically runs apart from public DNS, with its own console, control plane and policy engine.</p>



<p class="wp-block-paragraph">Cloudflare’s answer is a product it calls Internal DNS.</p>



<p class="wp-block-paragraph">“Many organizations already use Cloudflare for their public DNS,” <a href="https://www.linkedin.com/in/enriquesomoza/">Enrique Somoza</a>, product, performance and infrastructure at Cloudflare, told<em> Network World</em>. “Internal DNS extends that same platform to private DNS, so public and private are managed from the same global network and control plane.” </p>



<h2 class="wp-block-heading">How it works</h2>



<p class="wp-block-paragraph">Query handling starts at the resolver, not at the zone. That consolidation extends to daily operations as well.</p>



<p class="wp-block-paragraph">“Instead of operating two separate DNS systems, customers use one API, one audit trail, one dashboard, and one policy engine for every DNS query—whether it is for a public website or an internal application,” Somoza said.</p>



<p class="wp-block-paragraph"><strong>Policy first.</strong> The resolver sits ahead of every lookup, not behind it. “Architecturally, Cloudflare Gateway becomes the resolver that customers connect to, and can use WARP, DNS over HTTPS, DNS over TLS, or traditional DNS,” Somoza said. “Gateway evaluates zero -trust policies first, then routes the query to the appropriate DNS view based on context, such as source IP, device posture, or network location.”</p>



<p class="wp-block-paragraph"><strong>No public path in.</strong> Internal zones sit outside the public DNS hierarchy entirely. “Internal zones are never assigned public nameservers—they are only reachable through Gateway, so every query is evaluated before it is resolved,” Somoza said.</p>



<p class="wp-block-paragraph"><strong>One hostname, multiple answers.</strong> Branch offices, data centers and cloud environments no longer each need their own resolver stack. “Operationally, this simplifies environments that span branch offices, data centers, and multiple clouds,” Somoza said. “The same internal hostname can return different answers depending on where the request originated without maintaining separate resolver infrastructure, conditional forwarders, or duplicate zone files.”</p>



<p class="wp-block-paragraph">Somoza described the underlying objective in direct terms: “The goal is to make internal DNS behave like a single service instead of a collection of independent deployments,” he said.</p>



<p class="wp-block-paragraph"><strong>View selection.</strong> The same hostname can resolve to different IP addresses depending on where the request comes from. Gateway makes that call using several client signals. </p>



<p class="wp-block-paragraph">“View selection is policy driven,” Somoza said. “Gateway resolver policies evaluate the context of each DNS query, including attributes like source IP, device identity, or network location and determine which DNS view should answer the request.”</p>



<p class="wp-block-paragraph">A view is a container, not a separate infrastructure stack. Somoza explained that a view is simply a logical grouping of internal zones. For example, a company could have separate views for Europe and North America, or for corporate users and operational technology networks.</p>



<p class="wp-block-paragraph"><strong>Latency and resilience.</strong> Internal DNS inherits its performance characteristics from Cloudflare’s existing public network. “Internal DNS runs on Cloudflare’s global network, so queries are answered by the nearest available Gateway location, helping keep latency low for connected users,” Somoza said. “Because Internal DNS runs on the same global infrastructure as Cloudflare’s public DNS, it benefits from the same anycast architecture, geographic distribution, and resilient network design.”</p>



<h2 class="wp-block-heading">How this differs from split-horizon DNS</h2>



<p class="wp-block-paragraph">Internal DNS replaces the duplicate-zone model traditional split-horizon setups depend on.</p>



<p class="wp-block-paragraph">“Before migrating, many organizations maintain multiple versions of the same internal DNS zones across headquarters, branch offices, and cloud environments,” Somoza explained. “Conditional forwarders determine which resolver answers each query, and keeping those environments synchronized becomes an ongoing operational task.”</p>



<p class="wp-block-paragraph">Internal DNS collapses those duplicate zones into a single authoritative copy split across views instead. “With Internal DNS, that configuration becomes much simpler,” Somoza said. “A customer might create a single corp.internal zone in Cloudflare and define multiple DNS views.”</p>



<p class="wp-block-paragraph">For example, users in headquarters could receive one internal IP address for wiki.corp.internal, while branch offices receive a different address. Somoza emphasized that the zone itself only exists once. “Instead of maintaining multiple copies of the same configuration, administrators manage a single source of truth,” he said.</p>



<h2 class="wp-block-heading">Early use cases and migration challenges</h2>



<p class="wp-block-paragraph">Not surprisingly, Somoza noted that the first use case Cloudflare sees for Internal DNS is for split-horizon DNS consolidation. There is also interest from organizations that operate across multiple cloud providers that want one consistent internal DNS service instead of managing separate DNS platforms in each environment.</p>



<p class="wp-block-paragraph">Another common use case is extending zero-trust policies to internal name resolution. “Customers already use Gateway to control access to internet traffic, and Internal DNS lets them apply similar policy decisions before internal names are resolved,” Somoza said.</p>



<p class="wp-block-paragraph">When it comes to migration, the friction customers report during migration is procedural rather than architectural. </p>



<p class="wp-block-paragraph">“Customers need to think through API permissions, connectivity, and how existing local DNS forwarding rules interact with Gateway,” Somoza said. “Those are all well understood migration steps and customers often run both environments in parallel before completing the transition.”</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Bing Images Vulnerability Lets Attackers Execute Remote Code on Microsoft Servers]]></title>
<description><![CDATA[Three critical remote code execution (RCE) vulnerabilities in Microsoft’s infrastructure, with two flaws in Bing Images allowing attackers to hijack backend image-processing servers using nothing more than a crafted SVG file. The findings, disclosed responsibly by XBOW and now patched, expose how...]]></description>
<link>https://tsecurity.de/de/3692008/it-security-nachrichten/bing-images-vulnerability-lets-attackers-execute-remote-code-on-microsoft-servers/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692008/it-security-nachrichten/bing-images-vulnerability-lets-attackers-execute-remote-code-on-microsoft-servers/</guid>
<pubDate>Fri, 24 Jul 2026 18:18:11 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Three critical remote code execution (RCE) vulnerabilities in Microsoft’s infrastructure, with two flaws in Bing Images allowing attackers to hijack backend image-processing servers using nothing more than a crafted SVG file. The findings, disclosed responsibly by XBOW and now patched, expose how an “ordinary” image-handling feature became a gateway to full SYSTEM-level access on production […]</p>
<p>The post <a href="https://cybersecuritynews.com/bing-images-vulnerability/">Bing Images Vulnerability Lets Attackers Execute Remote Code on Microsoft Servers</a> appeared first on <a href="https://cybersecuritynews.com/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Stripe Eyes $10 Billion Deal For AI Model Marketplace OpenRouter]]></title>
<description><![CDATA[An anonymous reader quotes a report from PYMNTS.com: Stripe is in talks to buy OpenRouter, an artificial intelligence (AI) startup that could sell for roughly $10 billion, according to The Wall Street Journal. The move would mark a significant step outside payments for a company that processes tr...]]></description>
<link>https://tsecurity.de/de/3692005/it-security-nachrichten/stripe-eyes-10-billion-deal-for-ai-model-marketplace-openrouter/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3692005/it-security-nachrichten/stripe-eyes-10-billion-deal-for-ai-model-marketplace-openrouter/</guid>
<pubDate>Fri, 24 Jul 2026 18:18:06 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[An anonymous reader quotes a report from PYMNTS.com: Stripe is in talks to buy OpenRouter, an artificial intelligence (AI) startup that could sell for roughly $10 billion, according to The Wall Street Journal. The move would mark a significant step outside payments for a company that processes transactions for much of the internet. It also lands while Stripe pursues a far larger target: a bid for PayPal that would value the payments giant at about $53 billion.
 
The Journal reported Thursday (July 23) that a transaction could be announced soon, though the talks could still collapse or another buyer could step in. The exact price under discussion could not be learned. Several other large technology companies had also been weighing deals for OpenRouter. The startup was valued at $1.3 billion in May, according to PitchBook, meaning a sale near $10 billion would represent a steep markup in a matter of months. Its backers include Menlo Ventures and CapitalG, the growth fund of Google parent Alphabet.
 
OpenRouter sells software that lets customers reach AI models from OpenAI and Anthropic, along with open weight alternatives anyone can download and run. The Journal described the company's position this way: "OpenRouter is part of an emerging crop of startups that have found a lucrative niche between AI developers and the companies that want to use them." The platform lists hundreds of large language models and lets developers compare and switch between them.<p></p><div class="share_submission">
<a class="slashpop" href="http://twitter.com/home?status=Stripe+Eyes+%2410+Billion+Deal+For+AI+Model+Marketplace+OpenRouter%3A+https%3A%2F%2Fslashdot.org%2Fstory%2F26%2F07%2F24%2F0719241%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fslashdot.org%2Fstory%2F26%2F07%2F24%2F0719241%2Fstripe-eyes-10-billion-deal-for-ai-model-marketplace-openrouter%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>



</div><p><a href="https://slashdot.org/story/26/07/24/0719241/stripe-eyes-10-billion-deal-for-ai-model-marketplace-openrouter?utm_source=rss1.0moreanon&amp;utm_medium=feed">Read more of this story</a> at Slashdot.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Microsoft finally lets you fix the worst key on your keyboard]]></title>
<description><![CDATA[Windows 11 now includes a native setting to remap the dedicated Copilot key to the Right Ctrl or Context menu key.]]></description>
<link>https://tsecurity.de/de/3691981/windows-tipps/microsoft-finally-lets-you-fix-the-worst-key-on-your-keyboard/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691981/windows-tipps/microsoft-finally-lets-you-fix-the-worst-key-on-your-keyboard/</guid>
<pubDate>Fri, 24 Jul 2026 18:06:29 +0200</pubDate>
<category>🪟 Windows Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Windows 11 now includes a native setting to remap the dedicated Copilot key to the Right Ctrl or Context menu key.]]></content:encoded>
</item>
<item>
<title><![CDATA[Judge approves Apple's $250 million settlement offer over Siri lawsuit]]></title>
<description><![CDATA[A lawsuit over Apple's failure to deliver Apple Intelligence and Siri features is moving closer to a conclusion as a judge has provisionally approved the company's settlement offer.Apple has settled a class-action lawsuit over its delayed Siri features.The class action suit filed in 2025 alleged ...]]></description>
<link>https://tsecurity.de/de/3691966/ios-mac-os/judge-approves-apples-250-million-settlement-offer-over-siri-lawsuit/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691966/ios-mac-os/judge-approves-apples-250-million-settlement-offer-over-siri-lawsuit/</guid>
<pubDate>Fri, 24 Jul 2026 17:50:14 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A lawsuit over Apple's failure to deliver <a href="https://appleinsider.com/inside/apple-intelligence" title="Apple Intelligence" data-kpt="1">Apple Intelligence</a> and Siri features is moving closer to a conclusion as a judge has provisionally approved the company's settlement offer.<br><br><div><img src="https://photos5.appleinsider.com/gallery/67552-142286-66856-140246-Apple-Intelligence-lawsuit-gavel-xl.jpg" alt="Wooden judge's gavel resting on a block, with an Apple logo surrounded by a decorative atomic-style pattern engraved on the gavel head against a neutral gray background"><br><span>Apple has settled a class-action lawsuit over its delayed Siri features.</span></div><br>The class action suit <a href="https://appleinsider.com/articles/25/07/29/apples-delayed-siri-update-spawns-another-securities-lawsuit">filed in 2025</a> alleged that people had bought new <a href="https://appleinsider.com/inside/iphone" title="iPhone" data-kpt="1">iPhones</a> expressly because of Apple's promoting of Apple Intelligence features that it then did not deliver. Apple admitted in March 2025 that the new Siri features <a href="https://appleinsider.com/articles/25/03/07/apple-confirms-that-apple-intelligence-siri-features-are-taking-longer-than-expected">were delayed</a>, but then in May 2025 <a href="https://appleinsider.com/articles/26/05/05/lawsuit-over-delayed-siri-features-reaches-massive-250m-settlement">offered a settlement</a>.<br><br>Apple and the parties to the class action suit agreed to a $250 million settlement, but it had to be approved. Now <a href="https://storage.courtlistener.com/recap/gov.uscourts.cand.446692/gov.uscourts.cand.446692.94.0_1.pdf">in a filing</a> in the US District Court, Northern District of California, judge Noel Wise has provisionally given approval.<br><br><br> <a href="https://appleinsider.com/articles/26/07/24/judge-approves-apples-250-million-settlement-offer-over-siri-lawsuit?utm_source=rss">Continue Reading on AppleInsider</a> | <a href="https://forums.appleinsider.com/discussion/245055?urm_source=rss">Discuss on our Forums</a>]]></content:encoded>
</item>
<item>
<title><![CDATA[YouTube Faces Backlash Over Eating Disorder Recommendations]]></title>
<description><![CDATA[  YouTube is still facing criticism over the way its recommendation system serves harmful eating-disorder content to teenagers, despite stronger online safety rules introduced in the UK. New research cited by the BBC says the platform continues to surface videos…
Read more →
The post YouTube Face...]]></description>
<link>https://tsecurity.de/de/3691932/it-security-nachrichten/youtube-faces-backlash-over-eating-disorder-recommendations/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691932/it-security-nachrichten/youtube-faces-backlash-over-eating-disorder-recommendations/</guid>
<pubDate>Fri, 24 Jul 2026 17:47:04 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>  YouTube is still facing criticism over the way its recommendation system serves harmful eating-disorder content to teenagers, despite stronger online safety rules introduced in the UK. New research cited by the BBC says the platform continues to surface videos…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/youtube-faces-backlash-over-eating-disorder-recommendations/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/youtube-faces-backlash-over-eating-disorder-recommendations/">YouTube Faces Backlash Over Eating Disorder Recommendations</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Model Context Protocol is going stateless to make scaling simpler]]></title>
<description><![CDATA[Model Context Protocol (MCP), the emerging standard for connecting AI models to external tools and enterprise data, is undergoing its biggest architectural overhaul yet.



The latest release candidate, scheduled for release on July 28, removes protocol-level sessions in favor of a stateless arch...]]></description>
<link>https://tsecurity.de/de/3691919/ai-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691919/ai-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/</guid>
<pubDate>Fri, 24 Jul 2026 17:40:37 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div><div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Model Context Protocol (<a href="https://www.infoworld.com/article/4029634/what-is-model-context-protocol-how-mcp-bridges-ai-and-external-services.html">MCP</a>), the emerging standard for connecting AI models to external tools and enterprise data, is undergoing its biggest architectural overhaul yet.</p>



<p class="wp-block-paragraph">The latest <a href="https://modelcontextprotocol.io/specification/draft/changelog" target="_blank" rel="noreferrer noopener">release candidate</a>, scheduled for release on July 28, removes protocol-level sessions in favor of a stateless architecture, a change which industry experts say is intended to make MCP easier to deploy across standard cloud infrastructure as enterprises move AI pilots into production.</p>



<p class="wp-block-paragraph">“The session-based model made sense when MCP servers were local processes on a developer’s laptop. In production, it became an operational tax,” said <a href="https://www.linkedin.com/in/muskan-bandta2004" target="_blank" rel="noreferrer noopener">Muskan Bandta</a>, cloud associate at ZopDev.</p>



<p class="wp-block-paragraph">“When your infrastructure team asks whether MCP services can scale like other cloud applications, the answer used to be ‘not quite.’ With the move to a stateless architecture, the answer is now yes,” Bandta added.</p>



<p class="wp-block-paragraph">Earlier versions of the protocol maintained information about every client connection, meaning servers had to keep track of each session throughout an interaction. While that approach worked well for local development, it complicated deployments across multiple servers because requests often had to be routed back to the same machine, limiting scalability and making MCP a less natural fit for modern cloud architectures.</p>



<p class="wp-block-paragraph">“Under the new stateless design, every request contains the information needed for any available server to process it independently. Applications that need to maintain context across multiple requests can still do so, but developers must now manage that state explicitly rather than relying on the protocol itself,” she said.</p>



<p class="wp-block-paragraph">This transition to a stateless design goes beyond simplifying infrastructure by fundamentally changing how AI applications manage and share context across tools, according to <a href="https://www.linkedin.com/in/znamit/" target="_blank" rel="noreferrer noopener">Amit Jena</a>, AI development manager at IT consulting firm Kanerika.</p>



<p class="wp-block-paragraph">Instead of keeping application state hidden inside protocol sessions, the new design makes it explicit, allowing AI models to access, reason over, and pass that information between tools, giving developers greater control over how context is preserved and shared across tools, Jena said.</p>



<p class="wp-block-paragraph">It should also make AI workflows more portable, resilient, and easier to orchestrate across distributed environments, he said.</p>



<h2 class="wp-block-heading">MCP’s new features</h2>



<p class="wp-block-paragraph">Other changes to MCP include the addition of a Multi Round-Trip Requests (MRTR) mechanism that changes how AI agents request additional information they need to complete a task.</p>



<p class="wp-block-paragraph">Instead of relying on a persistent connection between the client and server throughout the interaction, the new mechanism lets the server request additional input through a standard request-response exchange before continuing the task, Jena said.</p>



<p class="wp-block-paragraph">Routable transport headers, another addition, enable API gateways and other networking infrastructure to identify and route MCP requests without inspecting their contents.</p>



<p class="wp-block-paragraph">They reduce processing overhead, lower latency, and let enterprise teams enforce routing, rate-limiting and security policies more efficiently using existing API management infrastructure, Jena said.</p>



<p class="wp-block-paragraph">MCP is also getting an updated authorization framework built around OAuth 2.1 and OpenID Connect; interactive MCP Apps; and deterministic caching of tool and resource listings to improve LLM prompt-cache hit rates, potentially saving on token costs.</p>



<h2 class="wp-block-heading">Rebuilding the trust boundary</h2>



<p class="wp-block-paragraph">The MCP release steering committee also decided to deprecate some legacy features, including Roots, Sampling, Logging, the older HTTP+SSE transport and Dynamic Client Registration, although these will continue to work in this version and any other released over the next year.</p>



<p class="wp-block-paragraph">The deprecation of Sampling is likely to have the biggest impact because it changes who is responsible for interacting with foundation models, said Jena.</p>



<p class="wp-block-paragraph">“Sampling let MCP servers invoke the <a href="https://www.infoworld.com/article/2335213/large-language-models-the-foundations-of-generative-ai.html" target="_blank">LLM</a> through the client, which meant the server had a callback path into the model without owning that connection. Deprecating it means rebuilding that trust boundary,” Jena said. “Your server now calls the model provider directly. That changes your network architecture, your auth model, and depending on how you’ve built cost attribution, your billing flow.”</p>



<p class="wp-block-paragraph">The year-long transition period will be enough for teams to audit their sampling dependencies now, said Jena: “The risk is that teams who haven’t implemented sampling themselves won’t know if a third-party MCP server they’re depending on uses it.”</p>



<h2 class="wp-block-heading">Updated MCP SDKs</h2>



<p class="wp-block-paragraph">To accompany the protocol update, there are updated <a href="https://github.com/modelcontextprotocol" target="_blank" rel="noreferrer noopener">MCP SDKs</a> for <a href="https://www.infoworld.com/article/2253770/what-is-python-powerful-intuitive-programming.html" target="_blank">Python</a>, <a href="https://www.infoworld.com/article/2257305/what-is-typescript-strongly-typed-javascript.html" target="_blank">Typescript</a>, <a href="https://www.infoworld.com/article/2253031/whats-the-go-language-really-good-for-3.html">Go</a>, and <a href="https://www.infoworld.com/article/4131649/the-best-new-features-of-c-14.html">C#</a>. These support both the old and new protocol versions, so new clients can continue communicating with older servers, while updated servers will also support older clients, reducing the risk of immediate disruptions.</p>



<p class="wp-block-paragraph">That backward compatibility should make the transition largely incremental, except for enterprises that built custom infrastructure around MCP’s earlier session-based architecture, Bandta said.</p>



<p class="wp-block-paragraph">Identifying and auditing those session dependencies may not be easy, Jena warned.</p>



<p class="wp-block-paragraph">“Session management complexity tends to be hidden across multiple layers — the gateway config, the deployment scripts, the monitoring dashboards. The code change is small; finding everywhere the assumption lives is what takes time,” he said.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Model Context Protocol is going stateless to make scaling simpler]]></title>
<description><![CDATA[Model Context Protocol (MCP), the emerging standard for connecting AI models to external tools and enterprise data, is undergoing its biggest architectural overhaul yet.



The latest release candidate, scheduled for release on July 28, removes protocol-level sessions in favor of a stateless arch...]]></description>
<link>https://tsecurity.de/de/3691907/it-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691907/it-nachrichten/model-context-protocol-is-going-stateless-to-make-scaling-simpler/</guid>
<pubDate>Fri, 24 Jul 2026 17:38:35 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Model Context Protocol (<a href="https://www.infoworld.com/article/4029634/what-is-model-context-protocol-how-mcp-bridges-ai-and-external-services.html">MCP</a>), the emerging standard for connecting AI models to external tools and enterprise data, is undergoing its biggest architectural overhaul yet.</p>



<p class="wp-block-paragraph">The latest <a href="https://modelcontextprotocol.io/specification/draft/changelog" target="_blank" rel="noreferrer noopener">release candidate</a>, scheduled for release on July 28, removes protocol-level sessions in favor of a stateless architecture, a change which industry experts say is intended to make MCP easier to deploy across standard cloud infrastructure as enterprises move AI pilots into production.</p>



<p class="wp-block-paragraph">“The session-based model made sense when MCP servers were local processes on a developer’s laptop. In production, it became an operational tax,” said <a href="https://www.linkedin.com/in/muskan-bandta2004" target="_blank" rel="noreferrer noopener">Muskan Bandta</a>, cloud associate at ZopDev.</p>



<p class="wp-block-paragraph">“When your infrastructure team asks whether MCP services can scale like other cloud applications, the answer used to be ‘not quite.’ With the move to a stateless architecture, the answer is now yes,” Bandta added.</p>



<p class="wp-block-paragraph">Earlier versions of the protocol maintained information about every client connection, meaning servers had to keep track of each session throughout an interaction. While that approach worked well for local development, it complicated deployments across multiple servers because requests often had to be routed back to the same machine, limiting scalability and making MCP a less natural fit for modern cloud architectures.</p>



<p class="wp-block-paragraph">“Under the new stateless design, every request contains the information needed for any available server to process it independently. Applications that need to maintain context across multiple requests can still do so, but developers must now manage that state explicitly rather than relying on the protocol itself,” she said.</p>



<p class="wp-block-paragraph">This transition to a stateless design goes beyond simplifying infrastructure by fundamentally changing how AI applications manage and share context across tools, according to <a href="https://www.linkedin.com/in/znamit/" target="_blank" rel="noreferrer noopener">Amit Jena</a>, AI development manager at IT consulting firm Kanerika.</p>



<p class="wp-block-paragraph">Instead of keeping application state hidden inside protocol sessions, the new design makes it explicit, allowing AI models to access, reason over, and pass that information between tools, giving developers greater control over how context is preserved and shared across tools, Jena said.</p>



<p class="wp-block-paragraph">It should also make AI workflows more portable, resilient, and easier to orchestrate across distributed environments, he said.</p>



<h2 class="wp-block-heading">MCP’s new features</h2>



<p class="wp-block-paragraph">Other changes to MCP include the addition of a Multi Round-Trip Requests (MRTR) mechanism that changes how AI agents request additional information they need to complete a task.</p>



<p class="wp-block-paragraph">Instead of relying on a persistent connection between the client and server throughout the interaction, the new mechanism lets the server request additional input through a standard request-response exchange before continuing the task, Jena said.</p>



<p class="wp-block-paragraph">Routable transport headers, another addition, enable API gateways and other networking infrastructure to identify and route MCP requests without inspecting their contents.</p>



<p class="wp-block-paragraph">They reduce processing overhead, lower latency, and let enterprise teams enforce routing, rate-limiting and security policies more efficiently using existing API management infrastructure, Jena said.</p>



<p class="wp-block-paragraph">MCP is also getting an updated authorization framework built around OAuth 2.1 and OpenID Connect; interactive MCP Apps; and deterministic caching of tool and resource listings to improve LLM prompt-cache hit rates, potentially saving on token costs.</p>



<h2 class="wp-block-heading">Rebuilding the trust boundary</h2>



<p class="wp-block-paragraph">The MCP release steering committee also decided to deprecate some legacy features, including Roots, Sampling, Logging, the older HTTP+SSE transport and Dynamic Client Registration, although these will continue to work in this version and any other released over the next year.</p>



<p class="wp-block-paragraph">The deprecation of Sampling is likely to have the biggest impact because it changes who is responsible for interacting with foundation models, said Jena.</p>



<p class="wp-block-paragraph">“Sampling let MCP servers invoke the <a href="https://www.infoworld.com/article/2335213/large-language-models-the-foundations-of-generative-ai.html" target="_blank">LLM</a> through the client, which meant the server had a callback path into the model without owning that connection. Deprecating it means rebuilding that trust boundary,” Jena said. “Your server now calls the model provider directly. That changes your network architecture, your auth model, and depending on how you’ve built cost attribution, your billing flow.”</p>



<p class="wp-block-paragraph">The year-long transition period will be enough for teams to audit their sampling dependencies now, said Jena: “The risk is that teams who haven’t implemented sampling themselves won’t know if a third-party MCP server they’re depending on uses it.”</p>



<h2 class="wp-block-heading">Updated MCP SDKs</h2>



<p class="wp-block-paragraph">To accompany the protocol update, there are updated <a href="https://github.com/modelcontextprotocol" target="_blank" rel="noreferrer noopener">MCP SDKs</a> for <a href="https://www.infoworld.com/article/2253770/what-is-python-powerful-intuitive-programming.html" target="_blank">Python</a>, <a href="https://www.infoworld.com/article/2257305/what-is-typescript-strongly-typed-javascript.html" target="_blank">Typescript</a>, <a href="https://www.infoworld.com/article/2253031/whats-the-go-language-really-good-for-3.html">Go</a>, and <a href="https://www.infoworld.com/article/4131649/the-best-new-features-of-c-14.html">C#</a>. These support both the old and new protocol versions, so new clients can continue communicating with older servers, while updated servers will also support older clients, reducing the risk of immediate disruptions.</p>



<p class="wp-block-paragraph">That backward compatibility should make the transition largely incremental, except for enterprises that built custom infrastructure around MCP’s earlier session-based architecture, Bandta said.</p>



<p class="wp-block-paragraph">Identifying and auditing those session dependencies may not be easy, Jena warned.</p>



<p class="wp-block-paragraph">“Session management complexity tends to be hidden across multiple layers — the gateway config, the deployment scripts, the monitoring dashboards. The code change is small; finding everywhere the assumption lives is what takes time,” he said.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.infoworld.com/article/4201254/model-context-protocol-is-going-stateless-to-make-scaling-simpler.html">InfoWorld</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller]]></title>
<description><![CDATA[Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts…
Read more →
The post Ce...]]></description>
<link>https://tsecurity.de/de/3691870/it-security-nachrichten/certighost-exploit-lets-low-privileged-active-directory-users-impersonate-a-domain-controller/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691870/it-security-nachrichten/certighost-exploit-lets-low-privileged-active-directory-users-impersonate-a-domain-controller/</guid>
<pubDate>Fri, 24 Jul 2026 17:07:15 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/certighost-exploit-lets-low-privileged-active-directory-users-impersonate-a-domain-controller/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/certighost-exploit-lets-low-privileged-active-directory-users-impersonate-a-domain-controller/">Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller]]></title>
<description><![CDATA[Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine.

They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replica...]]></description>
<link>https://tsecurity.de/de/3691867/it-security-nachrichten/certighost-exploit-lets-low-privileged-active-directory-users-impersonate-a-domain-controller/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691867/it-security-nachrichten/certighost-exploit-lets-low-privileged-active-directory-users-impersonate-a-domain-controller/</guid>
<pubDate>Fri, 24 Jul 2026 17:04:49 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine.

They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync.]]></content:encoded>
</item>
<item>
<title><![CDATA[Visual Studio Code 1.130 dresses up Agents window]]></title>
<description><![CDATA[Microsoft has released Visual Studio Code 1.130, an update to the code editor that brings several improvements to the Agents window, along with enhancements to the agent host and the terminal.



VS Code 1.130 was released on July 22, one week after VS Code 1.129. Developers can access the releas...]]></description>
<link>https://tsecurity.de/de/3691858/ai-nachrichten/visual-studio-code-1130-dresses-up-agents-window/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691858/ai-nachrichten/visual-studio-code-1130-dresses-up-agents-window/</guid>
<pubDate>Fri, 24 Jul 2026 17:00:02 +0200</pubDate>
<category>🔧 AI Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Microsoft has released Visual Studio Code 1.130, an update to the code editor that brings several improvements to the Agents window, along with enhancements to the agent host and the terminal.</p>



<p class="wp-block-paragraph">VS Code 1.130 was released on <a href="https://code.visualstudio.com/updates/v1_130#_agents-window-improvements-preview">July 22</a>, one week after <a href="https://www.infoworld.com/article/4199680/visual-studio-code-1-129-introduces-dedicated-agent-host.html">VS Code 1.129</a>. Developers can access the release for Windows, Linux, or Mac from <a href="https://code.visualstudio.com/Download?_exp_download=fb315fc982">code.visualstudio.com</a>. </p>



<p class="wp-block-paragraph">With the new release, the <a href="https://code.visualstudio.com/docs/agents/agents-window">Agents window</a> gets updates that make it easier to review changes and manage chats. File-level diff statistics help users assess the size of each file’s changes when scanning a multi-file diff. The window also gets a more compact multi-file diff that makes it easier to review changes, Microsoft said. The Agents window is a dedicated window in VS Code that lets users run and track multiple agent sessions in parallel across their projects, without opening each workspace in a separate window.</p>



<p class="wp-block-paragraph">Also with VS Code 1.130, assisted permissions for agent tool calls are available in the <a href="https://code.visualstudio.com/updates/v1_130#_the-agent-host" data-type="link" data-id="https://code.visualstudio.com/updates/v1_130#_the-agent-host">agent host</a>. With assisted permissions, the LLM evaluates the risk of each tool call and decides whether the tool can run or should require the user’s approval. The setting to enable assisted permissions is <code>chat.assistedPermissions.enabled</code>. In another agent host improvement, quick chats running on the agent host now use compact, single-line rows in the sessions list. Regular sessions retain a second line with change statistics, status, and timestamps. </p>



<p class="wp-block-paragraph">VS Code users now can open file links from Git diff output in the terminal when Git’s <a href="https://git-scm.com/docs/diff-config#Documentation/diff-config.txt-diffmnemonicPrefix" target="_blank" rel="noreferrer noopener"><code>diff.mnemonicPrefix</code></a> option is enabled. VS Code recognizes prefixes such as<code> i/</code> for the index and <code>w/</code> for the working tree, and removes the prefix from the link target so the correct file opens. When mnemonic prefixes are enabled, VS Code also recognizes the numeric prefixes produced by <code>git diff --no-index</code>.</p>



<p class="wp-block-paragraph">Timestamps for chat requests and responses now are displayed when users hover over the message toolbar. You can disable this through the <code>chat.verbose</code> setting. </p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[SpaceX Plans New Texas AI Data Center, Report Says]]></title>
<description><![CDATA[SpaceX is exploring at least one large Texas data center that could match or exceed its 1GW Memphis hub as it leases compute to outside AI firms.]]></description>
<link>https://tsecurity.de/de/3691830/it-nachrichten/spacex-plans-new-texas-ai-data-center-report-says/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691830/it-nachrichten/spacex-plans-new-texas-ai-data-center-report-says/</guid>
<pubDate>Fri, 24 Jul 2026 16:46:36 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[SpaceX is exploring at least one large Texas data center that could match or exceed its 1GW Memphis hub as it leases compute to outside AI firms.]]></content:encoded>
</item>
<item>
<title><![CDATA[Viettel Becomes Qualcomm’s First 6G Early Access Partner]]></title>
<description><![CDATA[Viettel is gaining early access to Qualcomm’s developing 6G platform, but the agreement does not yet amount to a commercial chipset or network launch.
The post Viettel Becomes Qualcomm’s First 6G Early Access Partner appeared first on TechRepublic.]]></description>
<link>https://tsecurity.de/de/3691828/it-nachrichten/viettel-becomes-qualcomms-first-6g-early-access-partner/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691828/it-nachrichten/viettel-becomes-qualcomms-first-6g-early-access-partner/</guid>
<pubDate>Fri, 24 Jul 2026 16:46:23 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Viettel is gaining early access to Qualcomm’s developing 6G platform, but the agreement does not yet amount to a commercial chipset or network launch.</p>
<p>The post <a href="https://www.techrepublic.com/article/viettel-qualcomm-6g-access-apac-vietnam/">Viettel Becomes Qualcomm’s First 6G Early Access Partner</a> appeared first on <a href="https://www.techrepublic.com/">TechRepublic</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Why Meta Escaped a Landmark Social Media Lawsuit]]></title>
<description><![CDATA[Meta avoided a closely watched social media addiction trial after the plaintiff dropped the remaining claim, leaving broader questions over platform design unresolved.
The post Why Meta Escaped a Landmark Social Media Lawsuit appeared first on TechRepublic.]]></description>
<link>https://tsecurity.de/de/3691827/it-nachrichten/why-meta-escaped-a-landmark-social-media-lawsuit/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691827/it-nachrichten/why-meta-escaped-a-landmark-social-media-lawsuit/</guid>
<pubDate>Fri, 24 Jul 2026 16:46:21 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Meta avoided a closely watched social media addiction trial after the plaintiff dropped the remaining claim, leaving broader questions over platform design unresolved.</p>
<p>The post <a href="https://www.techrepublic.com/article/news-meta-social-media-addiction-lawsuit-dismissed-2026/">Why Meta Escaped a Landmark Social Media Lawsuit</a> appeared first on <a href="https://www.techrepublic.com/">TechRepublic</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2026-16730 | Red Hat Enterprise Linux/OpenShift Container Platform dbus-broker resource consumption (EUVD-2026-48559)]]></title>
<description><![CDATA[A vulnerability marked as critical has been reported in Red Hat Enterprise Linux and OpenShift Container Platform. This impacts an unknown function of the component dbus-broker. This manipulation causes resource consumption.

This vulnerability is tracked as CVE-2026-16730. The attack is restrict...]]></description>
<link>https://tsecurity.de/de/3691757/sicherheitsluecken/cve-2026-16730-red-hat-enterprise-linuxopenshift-container-platform-dbus-broker-resource-consumption-euvd-2026-48559/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691757/sicherheitsluecken/cve-2026-16730-red-hat-enterprise-linuxopenshift-container-platform-dbus-broker-resource-consumption-euvd-2026-48559/</guid>
<pubDate>Fri, 24 Jul 2026 16:08:06 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability marked as <a href="https://vuldb.com/kb/risk">critical</a> has been reported in <a href="https://vuldb.com/product/red_hat:enterprise_linux">Red Hat Enterprise Linux and OpenShift Container Platform</a>. This impacts an unknown function of the component <em>dbus-broker</em>. This manipulation causes resource consumption.

This vulnerability is tracked as <a href="https://vuldb.com/cve/CVE-2026-16730">CVE-2026-16730</a>. The attack is restricted to local execution. No exploit exists.]]></content:encoded>
</item>
<item>
<title><![CDATA[Updated Cyber Threat Actor Naming System]]></title>
<description><![CDATA[Introduction 
Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors. This new naming taxonomy represents an effort to standardize tracking across platforms and public reporting.
Why are we Adopting a Different Naming System?
Histo...]]></description>
<link>https://tsecurity.de/de/3691731/it-security-nachrichten/updated-cyber-threat-actor-naming-system/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691731/it-security-nachrichten/updated-cyber-threat-actor-naming-system/</guid>
<pubDate>Fri, 24 Jul 2026 16:04:12 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div class="block-paragraph_advanced"><h2><strong>Introduction </strong></h2>
<p><span>Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors. This new naming taxonomy represents an effort to standardize tracking across platforms and public reporting.</span></p>
<h2><strong>Why are we Adopting a Different Naming System?</strong></h2>
<p><span>Historically, Mandiant and Google’s Threat Analysis Group (TAG) maintained distinct tracking systems, relying on parallel naming schemas that grew independently over time. The creation of GTIG has necessitated a new, fused tracking system, and a new naming system. Thinking to the future, GTIG’s new system will rely on cryptonyms. Relying on sequential numbers or disparate identifiers (e.g. APT1) fails to provide defenders the critical context needed to operate quickly. Threat tracking shouldn’t be an exercise in memorization, but rather one of intuition. The new naming convention aligns with industry standard threat actor naming systems. </span></p>
<h2><strong>Our New Schema</strong></h2>
<p><span>Our new schema utilizes a cryptonym-based approach, employing memorable two-word combinations for each distinct threat actor:</span></p>
<ul>
<li aria-level="1">
<p role="presentation"><span>The </span><strong>first word</strong><span> is a unique and memorable term chosen to represent the specific actor, particularly names that may have been used in prior public reporting. If no previously used term exists, this word is randomly generated to remove bias, then vetted by our analysts.</span></p>
</li>
<li aria-level="1">
<p role="presentation"><span>The </span><strong>second word</strong><span> categorizes threat clusters by motivation, attribution, or activity type based on which category we consider to be most important for defense and response strategies.</span></p>
</li>
</ul>
<p><span>The table below provides a sample of how threat actor categories will map to the second word in each cryptonym:</span></p>
<div align="left">
<div>
<div>
<div>
<div>
<div>
<div>
<div><table><colgroup><col><col></colgroup>
<tbody>
<tr>
<td>
<p><strong>Origin or Type</strong></p>
</td>
<td>
<p><strong>Group Name</strong></p>
</td>
</tr>
<tr>
<td>
<p><span>People’s Republic of China</span></p>
</td>
<td>
<p><span>CASTLE</span></p>
</td>
</tr>
<tr>
<td>
<p><span>Iran</span></p>
</td>
<td>
<p><span>ION</span></p>
</td>
</tr>
<tr>
<td>
<p><span>North Korea</span></p>
</td>
<td>
<p><span>NEPTUNE</span></p>
</td>
</tr>
<tr>
<td>
<p><span>Russia</span></p>
</td>
<td>
<p><span>RELIC</span></p>
</td>
</tr>
<tr>
<td>
<p><span>Cybercriminal</span></p>
</td>
<td>
<p><span>COMET</span></p>
</td>
</tr>
</tbody>
</table></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p><span>Table 1: Examples of Google’s new threat actor naming system categories</span></p>
<p><span>We know there are many threat actor tracking schemas in the industry, so we are intentionally seeking to keep this system as simple as possible to streamline operations and facilitate mapping to other naming taxonomies. However, a significant caveat remains: because no two organizations have the exact same visibility into the threat landscape, direct, apples-to-apples comparisons between threat actors are rarely possible. Transitioning to a convention that is simpler to follow and remember is a practical step toward managing a highly intricate tracking problem. </span></p>
<h2><strong>A Work in Progress</strong></h2>
<p><span>We have initially prioritized renaming several dozen of the most active groups, and will continue this process on a rolling basis. Previous names will remain indexed and searchable in the Google Threat Intelligence (GTI) platform, with MITRE ATT&amp;CK mappings and other vendor aliases preserved, see Figure 1. </span></p></div>
<div class="block-image_full_width">






  
    <div class="article-module h-c-page">
      <div class="h-c-grid">
  

    <figure class="article-image--large
      
      
        h-c-grid__col
        h-c-grid__col--6 h-c-grid__col--offset-3
        
        
      ">

      
      
        
        <img src="https://storage.googleapis.com/gweb-cloudblog-publish/images/image_22.max-1000x1000.png" alt="Updated Cyber Threat Actor Naming System Image 1">
        
        
      
        <figcaption class="article-image__caption "><p data-block-key="5g4yd">Figure 1: Threat actor name appearance in GTI platform on initial rollout</p></figcaption>
      
    </figure>

  
      </div>
    </div>
  




</div>
<div class="block-paragraph_advanced"><p><span>We will continue to use UNC, or “uncategorized” designations for threat clusters that are still in the early stages of investigation, as described </span><a href="https://cloud.google.com/blog/topics/threat-intelligence/how-mandiant-tracks-uncategorized-threat-actors"><span>here</span></a><span>.</span></p></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[EU warns TikTok on child safety defaults]]></title>
<description><![CDATA[The European Commission has issued preliminary findings against TikTok under the Digital Services Act, identifying significant gaps in how the platform protects children. This article has been indexed from CyberMaterial Read the original article: EU warns TikTok on child safety…
Read more →
The p...]]></description>
<link>https://tsecurity.de/de/3691705/it-security-nachrichten/eu-warns-tiktok-on-child-safety-defaults/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691705/it-security-nachrichten/eu-warns-tiktok-on-child-safety-defaults/</guid>
<pubDate>Fri, 24 Jul 2026 15:39:15 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>The European Commission has issued preliminary findings against TikTok under the Digital Services Act, identifying significant gaps in how the platform protects children. This article has been indexed from CyberMaterial Read the original article: EU warns TikTok on child safety…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/eu-warns-tiktok-on-child-safety-defaults/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/eu-warns-tiktok-on-child-safety-defaults/">EU warns TikTok on child safety defaults</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[South Korea Diplomatic Academy Data Breach]]></title>
<description><![CDATA[South Korea’s Foreign Ministry has confirmed a significant data breach affecting the Korea National Diplomatic Academy’s online education platform, exposing personal information of diplomatic personnel. This article has been indexed from CyberMaterial Read the original article: South Korea Diplom...]]></description>
<link>https://tsecurity.de/de/3691703/it-security-nachrichten/south-korea-diplomatic-academy-data-breach/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691703/it-security-nachrichten/south-korea-diplomatic-academy-data-breach/</guid>
<pubDate>Fri, 24 Jul 2026 15:39:10 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>South Korea’s Foreign Ministry has confirmed a significant data breach affecting the Korea National Diplomatic Academy’s online education platform, exposing personal information of diplomatic personnel. This article has been indexed from CyberMaterial Read the original article: South Korea Diplomatic Academy…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/south-korea-diplomatic-academy-data-breach/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/south-korea-diplomatic-academy-data-breach/">South Korea Diplomatic Academy Data Breach</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading]]></title>
<description><![CDATA[A recently disclosed vulnerability in Foxit PDF Reader may allow a local attacker with existing code execution to elevate their privileges to NT AUTHORITY\SYSTEM. This issue, tracked as CVE-2026-57239, affects Foxit PDF Reader installations prior to version 2026.2 and arises…
Read more →
The post...]]></description>
<link>https://tsecurity.de/de/3691699/it-security-nachrichten/foxit-pdf-reader-flaw-lets-local-attackers-gain-system-privileges-via-dll-sideloading/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691699/it-security-nachrichten/foxit-pdf-reader-flaw-lets-local-attackers-gain-system-privileges-via-dll-sideloading/</guid>
<pubDate>Fri, 24 Jul 2026 15:39:04 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A recently disclosed vulnerability in Foxit PDF Reader may allow a local attacker with existing code execution to elevate their privileges to NT AUTHORITY\SYSTEM. This issue, tracked as CVE-2026-57239, affects Foxit PDF Reader installations prior to version 2026.2 and arises…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/foxit-pdf-reader-flaw-lets-local-attackers-gain-system-privileges-via-dll-sideloading/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/foxit-pdf-reader-flaw-lets-local-attackers-gain-system-privileges-via-dll-sideloading/">Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading]]></title>
<description><![CDATA[A recently disclosed vulnerability in Foxit PDF Reader may allow a local attacker with existing code execution to elevate their privileges to NT AUTHORITY\SYSTEM. This issue, tracked as CVE-2026-57239, affects Foxit PDF Reader installations prior to version 2026.2 and arises from the insecure han...]]></description>
<link>https://tsecurity.de/de/3691670/it-security-nachrichten/foxit-pdf-reader-flaw-lets-local-attackers-gain-system-privileges-via-dll-sideloading/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691670/it-security-nachrichten/foxit-pdf-reader-flaw-lets-local-attackers-gain-system-privileges-via-dll-sideloading/</guid>
<pubDate>Fri, 24 Jul 2026 15:30:46 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A recently disclosed vulnerability in Foxit PDF Reader may allow a local attacker with existing code execution to elevate their privileges to NT AUTHORITY\SYSTEM. This issue, tracked as CVE-2026-57239, affects Foxit PDF Reader installations prior to version 2026.2 and arises from the insecure handling of an updater workflow triggered by a user-writable file in the […]</p>
<p>The post <a href="https://gbhackers.com/foxit-pdf-reader-flaw/">Foxit PDF Reader Flaw Lets Local Attackers Gain SYSTEM Privileges via DLL Sideloading</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Illinois Man Pleads Guilty to Phishing 4,500 Snapchat Users to Steal Private Photos]]></title>
<description><![CDATA[An Illinois man has pleaded guilty to a phishing and account-compromise scheme that targeted thousands of Snapchat users, leading to the theft of private images from numerous women. Federal prosecutors stated that Kyle Svara, 27, of Oswego, Illinois, admitted to charges including aggravated ident...]]></description>
<link>https://tsecurity.de/de/3691635/it-security-nachrichten/illinois-man-pleads-guilty-to-phishing-4500-snapchat-users-to-steal-private-photos/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691635/it-security-nachrichten/illinois-man-pleads-guilty-to-phishing-4500-snapchat-users-to-steal-private-photos/</guid>
<pubDate>Fri, 24 Jul 2026 15:11:07 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>An Illinois man has pleaded guilty to a phishing and account-compromise scheme that targeted thousands of Snapchat users, leading to the theft of private images from numerous women. Federal prosecutors stated that Kyle Svara, 27, of Oswego, Illinois, admitted to charges including aggravated identity theft, wire fraud, computer fraud, conspiracy to commit computer fraud, and […]</p>
<p>The post <a href="https://gbhackers.com/illinois-man-pleads-guilty-to-phishing-4500-snapchat-users/">Illinois Man Pleads Guilty to Phishing 4,500 Snapchat Users to Steal Private Photos</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Cl0p Targets Internet-Exposed Windchill Servers in Global Engineering Data-Theft Campaign]]></title>
<description><![CDATA[Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments. Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by st...]]></description>
<link>https://tsecurity.de/de/3691630/it-security-nachrichten/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691630/it-security-nachrichten/cl0p-targets-internet-exposed-windchill-servers-in-global-engineering-data-theft-campaign/</guid>
<pubDate>Fri, 24 Jul 2026 15:10:53 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Cl0p ransomware affiliates are actively exploiting internet-exposed PTC Windchill and FlexPLM deployments in a global data-theft campaign targeting high-value engineering environments. Observed post-exploitation activity includes filesystem enumeration via files such as “flst.txt,” followed by staging and exfiltration of sensitive engineering and product design data. This chaining enables unauthenticated remote code execution, allowing attackers to deploy […]</p>
<p>The post <a href="https://gbhackers.com/cl0p-targets-internet-exposed-windchill/">Cl0p Targets Internet-Exposed Windchill Servers in Global Engineering Data-Theft Campaign</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Apache Syncope Release Patches for Multiple RCE and SQL Injection Vulnerabilities]]></title>
<description><![CDATA[Apache has issued critical security updates for its Syncope identity and access management (IAM) platform to address multiple vulnerabilities, including remote code execution (RCE), SQL injection, privilege escalation, server-side request forgery (SSRF), and information disclosure. These flaws af...]]></description>
<link>https://tsecurity.de/de/3691626/it-security-nachrichten/apache-syncope-release-patches-for-multiple-rce-and-sql-injection-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691626/it-security-nachrichten/apache-syncope-release-patches-for-multiple-rce-and-sql-injection-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 15:10:38 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Apache has issued critical security updates for its Syncope identity and access management (IAM) platform to address multiple vulnerabilities, including remote code execution (RCE), SQL injection, privilege escalation, server-side request forgery (SSRF), and information disclosure. These flaws affect various versions…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/apache-syncope-release-patches-for-multiple-rce-and-sql-injection-vulnerabilities/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/apache-syncope-release-patches-for-multiple-rce-and-sql-injection-vulnerabilities/">Apache Syncope Release Patches for Multiple RCE and SQL Injection Vulnerabilities</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[ChonkyChicken Malware Steals Chrome Credentials, Moves Laterally and Spies on Victims]]></title>
<description><![CDATA[ChonkyChicken is a newly identified remote access trojan designed to turn one infected Windows device into a platform for credential theft, network movement, and surveillance. The malware is part of the TAG-195, also called Golden Chickens or Venom Spider, malware-as-a-service…
Read more →
The po...]]></description>
<link>https://tsecurity.de/de/3691621/it-security-nachrichten/chonkychicken-malware-steals-chrome-credentials-moves-laterally-and-spies-on-victims/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691621/it-security-nachrichten/chonkychicken-malware-steals-chrome-credentials-moves-laterally-and-spies-on-victims/</guid>
<pubDate>Fri, 24 Jul 2026 15:10:27 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>ChonkyChicken is a newly identified remote access trojan designed to turn one infected Windows device into a platform for credential theft, network movement, and surveillance. The malware is part of the TAG-195, also called Golden Chickens or Venom Spider, malware-as-a-service…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/chonkychicken-malware-steals-chrome-credentials-moves-laterally-and-spies-on-victims/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/chonkychicken-malware-steals-chrome-credentials-moves-laterally-and-spies-on-victims/">ChonkyChicken Malware Steals Chrome Credentials, Moves Laterally and Spies on Victims</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[KnowBe4’s Unveils Custom AI Video Builder]]></title>
<description><![CDATA[KnowBe4, the global leader in digital workforce security, securing both AI agents and humans, today announced the launch of Custom AI Video Builder, a new capability that lets security admins create custom, AI-generated training videos and deploy them directly into…
Read more →
The post KnowBe4’s...]]></description>
<link>https://tsecurity.de/de/3691619/it-security-nachrichten/knowbe4s-unveils-custom-ai-video-builder/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691619/it-security-nachrichten/knowbe4s-unveils-custom-ai-video-builder/</guid>
<pubDate>Fri, 24 Jul 2026 15:10:25 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>KnowBe4, the global leader in digital workforce security, securing both AI agents and humans, today announced the launch of Custom AI Video Builder, a new capability that lets security admins create custom, AI-generated training videos and deploy them directly into…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/knowbe4s-unveils-custom-ai-video-builder/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/knowbe4s-unveils-custom-ai-video-builder/">KnowBe4’s Unveils Custom AI Video Builder</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[The biggest indie "friendslop" game of 2026 appears to be delivering malware via Steam Workshop — How to protect your PC (and what to do next)]]></title>
<description><![CDATA[The Steam Workshop is one of the PC gaming platform's biggest assets, but it's increasingly becoming a place where bad actors can spread malware to unsuspecting victims. The latest allegations involve indie smash-hit Meccha Chameleon. Here's what you need to know.]]></description>
<link>https://tsecurity.de/de/3691614/windows-tipps/the-biggest-indie-friendslop-game-of-2026-appears-to-be-delivering-malware-via-steam-workshop-how-to-protect-your-pc-and-what-to-do-next/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691614/windows-tipps/the-biggest-indie-friendslop-game-of-2026-appears-to-be-delivering-malware-via-steam-workshop-how-to-protect-your-pc-and-what-to-do-next/</guid>
<pubDate>Fri, 24 Jul 2026 15:04:18 +0200</pubDate>
<category>🪟 Windows Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[The Steam Workshop is one of the PC gaming platform's biggest assets, but it's increasingly becoming a place where bad actors can spread malware to unsuspecting victims. The latest allegations involve indie smash-hit Meccha Chameleon. Here's what you need to know.]]></content:encoded>
</item>
<item>
<title><![CDATA[Russian hackers exploit unpatched Zimbra servers to steal emails]]></title>
<description><![CDATA[Russian state-backed hacker group Laundry Bear has been breaking into government and commercial networks for at least a year by exploiting a vulnerability in the Zimbra Collaboration Suite (ZCS) webmail platform. Laundry Bear (also known as Void Blizzard, CL-STA-1114, and…
Read more →
The post Ru...]]></description>
<link>https://tsecurity.de/de/3691580/it-security-nachrichten/russian-hackers-exploit-unpatched-zimbra-servers-to-steal-emails/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691580/it-security-nachrichten/russian-hackers-exploit-unpatched-zimbra-servers-to-steal-emails/</guid>
<pubDate>Fri, 24 Jul 2026 14:58:47 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Russian state-backed hacker group Laundry Bear has been breaking into government and commercial networks for at least a year by exploiting a vulnerability in the Zimbra Collaboration Suite (ZCS) webmail platform. Laundry Bear (also known as Void Blizzard, CL-STA-1114, and…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/russian-hackers-exploit-unpatched-zimbra-servers-to-steal-emails/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/russian-hackers-exploit-unpatched-zimbra-servers-to-steal-emails/">Russian hackers exploit unpatched Zimbra servers to steal emails</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[KnowBe4’s Unveils Custom AI Video Builder]]></title>
<description><![CDATA[KnowBe4, the global leader in digital workforce security, securing both AI agents and humans, today announced the launch of Custom AI Video Builder, a new capability that lets security admins create custom, AI-generated training videos and deploy them directly into their security awareness traini...]]></description>
<link>https://tsecurity.de/de/3691570/it-security-nachrichten/knowbe4s-unveils-custom-ai-video-builder/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691570/it-security-nachrichten/knowbe4s-unveils-custom-ai-video-builder/</guid>
<pubDate>Fri, 24 Jul 2026 14:58:29 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>KnowBe4, the global leader in digital workforce security, securing both AI agents and humans, today announced the launch of Custom AI Video Builder, a new capability that lets security admins create custom, AI-generated training videos and deploy them directly into their security awareness training (SAT) programs in minutes. The innovation is the latest addition to […]</p>
<p>The post <a href="https://www.itsecurityguru.org/2026/07/24/knowbe4s-unveils-custom-ai-video-builder/">KnowBe4’s Unveils Custom AI Video Builder</a> appeared first on <a href="https://www.itsecurityguru.org/">IT Security Guru</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Russian hackers exploit unpatched Zimbra servers to steal emails]]></title>
<description><![CDATA[Russian state-backed hacker group Laundry Bear has been breaking into government and commercial networks for at least a year by exploiting a vulnerability in the Zimbra Collaboration Suite (ZCS) webmail platform. Laundry Bear (also known as Void Blizzard, CL-STA-1114, and TA488) has been running ...]]></description>
<link>https://tsecurity.de/de/3691544/it-security-nachrichten/russian-hackers-exploit-unpatched-zimbra-servers-to-steal-emails/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691544/it-security-nachrichten/russian-hackers-exploit-unpatched-zimbra-servers-to-steal-emails/</guid>
<pubDate>Fri, 24 Jul 2026 14:39:47 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Russian state-backed hacker group Laundry Bear has been breaking into government and commercial networks for at least a year by exploiting a vulnerability in the Zimbra Collaboration Suite (ZCS) webmail platform. Laundry Bear (also known as Void Blizzard, CL-STA-1114, and TA488) has been running the campaign since July 2025, according to a joint advisory from the NSA, FBI, CISA, and cybersecurity agencies from the Netherlands, UK, Australia, Canada, and a dozen other countries. “Laundry Bear’s … <a href="https://www.helpnetsecurity.com/2026/07/24/laundry-bear-zimbra-vulnerability-cve-2025-66376/" rel="nofollow">More <span class="meta-nav">→</span></a></p>
<p>The post <a href="https://www.helpnetsecurity.com/2026/07/24/laundry-bear-zimbra-vulnerability-cve-2025-66376/">Russian hackers exploit unpatched Zimbra servers to steal emails</a> appeared first on <a href="https://www.helpnetsecurity.com/">Help Net Security</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8604-1: Linux kernel (Azure) vulnerabilities]]></title>
<description><![CDATA[Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - Foo-over-UDP (FOU);
  - ARM64 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic AP...]]></description>
<link>https://tsecurity.de/de/3691501/unix-server/usn-8604-1-linux-kernel-azure-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691501/unix-server/usn-8604-1-linux-kernel-azure-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:46 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - Foo-over-UDP (FOU);
  - ARM64 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Drivers core;
  - Null block device driver;
  - Bluetooth drivers;
  - Counter interface drivers;
  - DMA engine subsystem;
  - DPLL subsystem;
  - GPIO subsystem;
  - GPU drivers;
  - I2C subsystem;
  - IIO ADC drivers;
  - IIO subsystem;
  - InfiniBand drivers;
  - On-Chip Interconnect management framework;
  - IOMMU subsystem;
  - IRQ chip drivers;
  - Modular ISDN driver;
  - LED subsystem;
  - Multiple devices driver;
  - UACCE accelerator framework;
  - MMC subsystem;
  - Ethernet bonding driver;
  - Network drivers;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PHY drivers;
  - x86 platform drivers;
  - i.MX PM domains;
  - SCSI subsystem;
  - SLIMbus drivers;
  - SPI subsystem;
  - TTY drivers;
  - USB Host Controller drivers;
  - USB over IP driver;
  - W1 Dallas's 1-wire bus driver;
  - Xen hypervisor drivers;
  - BTRFS file system;
  - File systems infrastructure;
  - EFI Variable file system;
  - Ext4 file system;
  - FUSE (File system in Userspace);
  - Network file systems library;
  - Network file system (NFS) client;
  - Network file system (NFS) server daemon;
  - SMB network file system;
  - Memory Management;
  - Kernel thread helper (kthread);
  - Memory management;
  - Scheduler infrastructure;
  - Tracing infrastructure;
  - IPv6 networking;
  - Netfilter;
  - NFC subsystem;
  - io_uring subsystem;
  - Perf events;
  - Kernel exit() syscall;
  - Hibernation control;
  - Timer subsystem;
  - BPF subsystem;
  - Floating proportions library;
  - Scatterlist API;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAN network layer;
  - Ceph Core library;
  - Networking core;
  - IPv4 networking;
  - L2TP protocol;
  - MAC80211 subsystem;
  - Multipath TCP;
  - NET/ROM layer;
  - RxRPC session sockets;
  - Network traffic control;
  - SCTP protocol;
  - SMC sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - ALSA AC97 driver;
  - Creative Sound Blaster X-Fi driver;
  - Texas InstrumentS Audio (ASoC/HDA) drivers;
  - USB sound devices;
(CVE-2025-71158, CVE-2025-71160, CVE-2025-71161, CVE-2025-71162,
CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183,
CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71187,
CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,
CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195,
CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199,
CVE-2025-71200, CVE-2025-71201, CVE-2026-22976, CVE-2026-22977,
CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22981,
CVE-2026-22982, CVE-2026-22984, CVE-2026-22985, CVE-2026-22986,
CVE-2026-22987, CVE-2026-22989, CVE-2026-22990, CVE-2026-22991,
CVE-2026-22992, CVE-2026-22993, CVE-2026-22994, CVE-2026-22996,
CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,
CVE-2026-23001, CVE-2026-23002, CVE-2026-23003, CVE-2026-23004,
CVE-2026-23005, CVE-2026-23006, CVE-2026-23007, CVE-2026-23008,
CVE-2026-23009, CVE-2026-23010, CVE-2026-23011, CVE-2026-23012,
CVE-2026-23013, CVE-2026-23014, CVE-2026-23015, CVE-2026-23017,
CVE-2026-23018, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021,
CVE-2026-23022, CVE-2026-23023, CVE-2026-23024, CVE-2026-23025,
CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032,
CVE-2026-23033, CVE-2026-23034, CVE-2026-23035, CVE-2026-23036,
CVE-2026-23037, CVE-2026-23038, CVE-2026-23042, CVE-2026-23044,
CVE-2026-23045, CVE-2026-23046, CVE-2026-23047, CVE-2026-23049,
CVE-2026-23050, CVE-2026-23051, CVE-2026-23052, CVE-2026-23053,
CVE-2026-23054, CVE-2026-23055, CVE-2026-23056, CVE-2026-23057,
CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062,
CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23066,
CVE-2026-23067, CVE-2026-23068, CVE-2026-23069, CVE-2026-23070,
CVE-2026-23071, CVE-2026-23072, CVE-2026-23073, CVE-2026-23075,
CVE-2026-23076, CVE-2026-23077, CVE-2026-23078, CVE-2026-23079,
CVE-2026-23080, CVE-2026-23081, CVE-2026-23083, CVE-2026-23084,
CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088,
CVE-2026-23089, CVE-2026-23090, CVE-2026-23092, CVE-2026-23093,
CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097,
CVE-2026-23098, CVE-2026-23099, CVE-2026-23100, CVE-2026-23101,
CVE-2026-23102, CVE-2026-23103, CVE-2026-23104, CVE-2026-23105,
CVE-2026-23106, CVE-2026-23107, CVE-2026-23108, CVE-2026-23109,
CVE-2026-23110, CVE-2026-23113, CVE-2026-23114, CVE-2026-23115,
CVE-2026-23116, CVE-2026-23118, CVE-2026-23119, CVE-2026-23120,
CVE-2026-23121, CVE-2026-23122, CVE-2026-23123, CVE-2026-23124,
CVE-2026-23125, CVE-2026-23126, CVE-2026-23128, CVE-2026-23129,
CVE-2026-23130, CVE-2026-23131, CVE-2026-23133, CVE-2026-23135,
CVE-2026-23136, CVE-2026-23137, CVE-2026-23138, CVE-2026-23139,
CVE-2026-23140, CVE-2026-23141, CVE-2026-23142, CVE-2026-23143,
CVE-2026-23144, CVE-2026-23145, CVE-2026-23146, CVE-2026-23147,
CVE-2026-23148, CVE-2026-23150, CVE-2026-23151, CVE-2026-23152,
CVE-2026-23154, CVE-2026-23156, CVE-2026-23157, CVE-2026-23158,
CVE-2026-23159, CVE-2026-23160, CVE-2026-23161, CVE-2026-23162,
CVE-2026-23163, CVE-2026-23164, CVE-2026-23165, CVE-2026-23166,
CVE-2026-23167, CVE-2026-23168, CVE-2026-23169, CVE-2026-23170,
CVE-2026-23171, CVE-2026-23172, CVE-2026-23173, CVE-2026-23212,
CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23427,
CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402,
CVE-2026-31418, CVE-2026-31436, CVE-2026-31448, CVE-2026-31478,
CVE-2026-31607, CVE-2026-31635, CVE-2026-31637, CVE-2026-31649,
CVE-2026-31657, CVE-2026-31659, CVE-2026-31668, CVE-2026-31669,
CVE-2026-31682, CVE-2026-31685, CVE-2026-31718, CVE-2026-43011,
CVE-2026-43037, CVE-2026-43038, CVE-2026-43071, CVE-2026-43083,
CVE-2026-43114, CVE-2026-43117, CVE-2026-43125, CVE-2026-43185,
CVE-2026-43186, CVE-2026-43197, CVE-2026-43304, CVE-2026-43341,
CVE-2026-43376, CVE-2026-43378, CVE-2026-43383, CVE-2026-43384,
CVE-2026-43402, CVE-2026-43406, CVE-2026-43407, CVE-2026-43414,
CVE-2026-43493, CVE-2026-43501, CVE-2026-45898, CVE-2026-45988,
CVE-2026-46039, CVE-2026-46043, CVE-2026-46084, CVE-2026-46115,
CVE-2026-46119, CVE-2026-46135, CVE-2026-46185, CVE-2026-46195,
CVE-2026-46243, CVE-2026-46244, CVE-2026-46266, CVE-2026-46289,
CVE-2026-46290, CVE-2026-46316, CVE-2026-46317, CVE-2026-46325,
CVE-2026-53277, CVE-2026-64018, CVE-2026-64034)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8605-1: Linux kernel (Azure CVM) vulnerabilities]]></title>
<description><![CDATA[Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - Foo-over-UDP (FOU);
  - ARM64 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic AP...]]></description>
<link>https://tsecurity.de/de/3691500/unix-server/usn-8605-1-linux-kernel-azure-cvm-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691500/unix-server/usn-8605-1-linux-kernel-azure-cvm-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:44 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - Foo-over-UDP (FOU);
  - ARM64 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Drivers core;
  - Null block device driver;
  - Bluetooth drivers;
  - Counter interface drivers;
  - DMA engine subsystem;
  - DPLL subsystem;
  - GPIO subsystem;
  - GPU drivers;
  - I2C subsystem;
  - IIO ADC drivers;
  - IIO subsystem;
  - InfiniBand drivers;
  - On-Chip Interconnect management framework;
  - IOMMU subsystem;
  - IRQ chip drivers;
  - Modular ISDN driver;
  - LED subsystem;
  - Multiple devices driver;
  - UACCE accelerator framework;
  - MMC subsystem;
  - Ethernet bonding driver;
  - Network drivers;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PHY drivers;
  - x86 platform drivers;
  - i.MX PM domains;
  - SCSI subsystem;
  - SLIMbus drivers;
  - SPI subsystem;
  - TTY drivers;
  - USB Host Controller drivers;
  - USB over IP driver;
  - W1 Dallas's 1-wire bus driver;
  - Xen hypervisor drivers;
  - BTRFS file system;
  - File systems infrastructure;
  - EFI Variable file system;
  - Ext4 file system;
  - FUSE (File system in Userspace);
  - Network file systems library;
  - Network file system (NFS) client;
  - Network file system (NFS) server daemon;
  - SMB network file system;
  - Memory Management;
  - Kernel thread helper (kthread);
  - Memory management;
  - Scheduler infrastructure;
  - Tracing infrastructure;
  - IPv6 networking;
  - Netfilter;
  - NFC subsystem;
  - io_uring subsystem;
  - Perf events;
  - Kernel exit() syscall;
  - Hibernation control;
  - Timer subsystem;
  - BPF subsystem;
  - Floating proportions library;
  - Scatterlist API;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAN network layer;
  - Ceph Core library;
  - Networking core;
  - IPv4 networking;
  - L2TP protocol;
  - MAC80211 subsystem;
  - Multipath TCP;
  - NET/ROM layer;
  - RxRPC session sockets;
  - Network traffic control;
  - SCTP protocol;
  - SMC sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - ALSA AC97 driver;
  - Creative Sound Blaster X-Fi driver;
  - Texas InstrumentS Audio (ASoC/HDA) drivers;
  - USB sound devices;
(CVE-2025-71158, CVE-2025-71160, CVE-2025-71161, CVE-2025-71162,
CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183,
CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71187,
CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191,
CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195,
CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199,
CVE-2025-71200, CVE-2025-71201, CVE-2026-22976, CVE-2026-22977,
CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22981,
CVE-2026-22982, CVE-2026-22984, CVE-2026-22985, CVE-2026-22986,
CVE-2026-22987, CVE-2026-22989, CVE-2026-22990, CVE-2026-22991,
CVE-2026-22992, CVE-2026-22993, CVE-2026-22994, CVE-2026-22996,
CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000,
CVE-2026-23001, CVE-2026-23002, CVE-2026-23003, CVE-2026-23004,
CVE-2026-23005, CVE-2026-23006, CVE-2026-23007, CVE-2026-23008,
CVE-2026-23009, CVE-2026-23010, CVE-2026-23011, CVE-2026-23012,
CVE-2026-23013, CVE-2026-23014, CVE-2026-23015, CVE-2026-23017,
CVE-2026-23018, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021,
CVE-2026-23022, CVE-2026-23023, CVE-2026-23024, CVE-2026-23025,
CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032,
CVE-2026-23033, CVE-2026-23034, CVE-2026-23035, CVE-2026-23036,
CVE-2026-23037, CVE-2026-23038, CVE-2026-23042, CVE-2026-23044,
CVE-2026-23045, CVE-2026-23046, CVE-2026-23047, CVE-2026-23049,
CVE-2026-23050, CVE-2026-23051, CVE-2026-23052, CVE-2026-23053,
CVE-2026-23054, CVE-2026-23055, CVE-2026-23056, CVE-2026-23057,
CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062,
CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23066,
CVE-2026-23067, CVE-2026-23068, CVE-2026-23069, CVE-2026-23070,
CVE-2026-23071, CVE-2026-23072, CVE-2026-23073, CVE-2026-23075,
CVE-2026-23076, CVE-2026-23077, CVE-2026-23078, CVE-2026-23080,
CVE-2026-23081, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085,
CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089,
CVE-2026-23090, CVE-2026-23092, CVE-2026-23093, CVE-2026-23094,
CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098,
CVE-2026-23099, CVE-2026-23100, CVE-2026-23101, CVE-2026-23102,
CVE-2026-23103, CVE-2026-23104, CVE-2026-23105, CVE-2026-23106,
CVE-2026-23107, CVE-2026-23108, CVE-2026-23109, CVE-2026-23110,
CVE-2026-23113, CVE-2026-23114, CVE-2026-23115, CVE-2026-23116,
CVE-2026-23118, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121,
CVE-2026-23122, CVE-2026-23123, CVE-2026-23124, CVE-2026-23125,
CVE-2026-23126, CVE-2026-23128, CVE-2026-23129, CVE-2026-23130,
CVE-2026-23131, CVE-2026-23133, CVE-2026-23135, CVE-2026-23136,
CVE-2026-23137, CVE-2026-23138, CVE-2026-23139, CVE-2026-23140,
CVE-2026-23141, CVE-2026-23142, CVE-2026-23143, CVE-2026-23144,
CVE-2026-23145, CVE-2026-23146, CVE-2026-23147, CVE-2026-23148,
CVE-2026-23150, CVE-2026-23151, CVE-2026-23152, CVE-2026-23154,
CVE-2026-23156, CVE-2026-23157, CVE-2026-23158, CVE-2026-23159,
CVE-2026-23160, CVE-2026-23161, CVE-2026-23162, CVE-2026-23163,
CVE-2026-23164, CVE-2026-23165, CVE-2026-23166, CVE-2026-23167,
CVE-2026-23168, CVE-2026-23169, CVE-2026-23170, CVE-2026-23171,
CVE-2026-23172, CVE-2026-23173, CVE-2026-23212, CVE-2026-23272,
CVE-2026-23278, CVE-2026-23392, CVE-2026-23427, CVE-2026-23428,
CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31418,
CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607,
CVE-2026-31635, CVE-2026-31637, CVE-2026-31649, CVE-2026-31657,
CVE-2026-31659, CVE-2026-31668, CVE-2026-31669, CVE-2026-31682,
CVE-2026-31685, CVE-2026-31718, CVE-2026-43011, CVE-2026-43037,
CVE-2026-43038, CVE-2026-43071, CVE-2026-43083, CVE-2026-43114,
CVE-2026-43117, CVE-2026-43125, CVE-2026-43185, CVE-2026-43186,
CVE-2026-43197, CVE-2026-43304, CVE-2026-43341, CVE-2026-43376,
CVE-2026-43378, CVE-2026-43383, CVE-2026-43384, CVE-2026-43402,
CVE-2026-43406, CVE-2026-43407, CVE-2026-43414, CVE-2026-43493,
CVE-2026-43501, CVE-2026-45898, CVE-2026-45988, CVE-2026-46039,
CVE-2026-46043, CVE-2026-46084, CVE-2026-46115, CVE-2026-46119,
CVE-2026-46135, CVE-2026-46185, CVE-2026-46195, CVE-2026-46243,
CVE-2026-46244, CVE-2026-46266, CVE-2026-46289, CVE-2026-46290,
CVE-2026-46316, CVE-2026-46317, CVE-2026-46325, CVE-2026-53277,
CVE-2026-64018, CVE-2026-64034)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8595-2: Linux kernel (AWS) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691499/unix-server/usn-8595-2-linux-kernel-aws-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691499/unix-server/usn-8595-2-linux-kernel-aws-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:43 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM64 architecture;
  - RISC-V architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Serial ATA and Parallel ATA drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - Clock framework and drivers;
  - Data acquisition framework and drivers;
  - Counter interface drivers;
  - CPU frequency scaling framework;
  - Hardware crypto device drivers;
  - CXL (Compute Express Link) drivers;
  - DMA engine subsystem;
  - EDAC drivers;
  - EFI core;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO ADC drivers;
  - IIO subsystem;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IRQ chip drivers;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Fastrpc Driver;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Ethernet team driver;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PCI subsystem;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Generic PM domains;
  - i.MX PM domains;
  - Remote Processor subsystem;
  - S/390 drivers;
  - SCSI subsystem;
  - SLIMbus drivers;
  - Freescale SoC drivers;
  - Microchip PolarFire SoC system controller driver;
  - SPI subsystem;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - USB Type-C Connector System Software Interface driver;
  - VFIO drivers;
  - Framebuffer layer;
  - TSM TDX Guest driver;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - Journaling layer for block devices (JBD2);
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - Kernel CPU control infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Memory Management;
  - Integrity Measurement Architecture(IMA) framework;
  - KVM subsystem;
  - Memory management;
  - Networking core;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Tracing infrastructure;
  - Network traffic control;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IP tunnels definitions;
  - MAC80211 subsystem;
  - Netfilter;
  - User-space API (UAPI);
  - io_uring subsystem;
  - Audit subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Perf events;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - KProbes tracing;
  - Locking primitives;
  - Kernel module support;
  - Padata parallel execution mechanism;
  - Cryptographic library;
  - Heterogeneous memory management;
  - KASAN memory debugging framework;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - IPv6 networking;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - Landlock security;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - Samsung ASoC drivers;
  - SoC audio core drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,
CVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,
CVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,
CVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,
CVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,
CVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,
CVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,
CVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,
CVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,
CVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,
CVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,
CVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,
CVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,
CVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,
CVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,
CVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,
CVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,
CVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,
CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,
CVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,
CVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,
CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,
CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,
CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,
CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,
CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,
CVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,
CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,
CVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,
CVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,
CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,
CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,
CVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,
CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,
CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,
CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,
CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,
CVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,
CVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,
CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,
CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,
CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,
CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,
CVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,
CVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,
CVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,
CVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,
CVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,
CVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,
CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,
CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,
CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,
CVE-2026-31505, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509,
CVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515,
CVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520,
CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524,
CVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530,
CVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545,
CVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550,
CVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555,
CVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565,
CVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576,
CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581,
CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585,
CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590,
CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597,
CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603,
CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31610,
CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31615,
CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,
CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,
CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629,
CVE-2026-31634, CVE-2026-31638, CVE-2026-31639, CVE-2026-31642,
CVE-2026-31645, CVE-2026-31646, CVE-2026-31648, CVE-2026-31651,
CVE-2026-31655, CVE-2026-31656, CVE-2026-31658, CVE-2026-31660,
CVE-2026-31661, CVE-2026-31662, CVE-2026-31664, CVE-2026-31665,
CVE-2026-31667, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,
CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,
CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,
CVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31689,
CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,
CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,
CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,
CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,
CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,
CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,
CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,
CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,
CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,
CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,
CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,
CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,
CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,
CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,
CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43012,
CVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016,
CVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020,
CVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026,
CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032,
CVE-2026-43035, CVE-2026-43036, CVE-2026-43040, CVE-2026-43041,
CVE-2026-43043, CVE-2026-43044, CVE-2026-43046, CVE-2026-43047,
CVE-2026-43049, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052,
CVE-2026-43054, CVE-2026-43056, CVE-2026-43057, CVE-2026-43058,
CVE-2026-43059, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062,
CVE-2026-43064, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068,
CVE-2026-43069, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,
CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,
CVE-2026-43081, CVE-2026-43082, CVE-2026-43084, CVE-2026-43085,
CVE-2026-43086, CVE-2026-43088, CVE-2026-43089, CVE-2026-43091,
CVE-2026-43092, CVE-2026-43093, CVE-2026-43094, CVE-2026-43098,
CVE-2026-43099, CVE-2026-43103, CVE-2026-43104, CVE-2026-43105,
CVE-2026-43107, CVE-2026-43109, CVE-2026-43110, CVE-2026-43111,
CVE-2026-43112, CVE-2026-43113, CVE-2026-43119, CVE-2026-43120,
CVE-2026-43129, CVE-2026-43162, CVE-2026-43245, CVE-2026-43252,
CVE-2026-43265, CVE-2026-43281, CVE-2026-43324, CVE-2026-43327,
CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,
CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,
CVE-2026-43339, CVE-2026-43340, CVE-2026-43342, CVE-2026-43343,
CVE-2026-43345, CVE-2026-43350, CVE-2026-43355, CVE-2026-43357,
CVE-2026-43359, CVE-2026-43360, CVE-2026-43361, CVE-2026-43362,
CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,
CVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373,
CVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,
CVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397,
CVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,
CVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419,
CVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425,
CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,
CVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437,
CVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448,
CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,
CVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457,
CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467,
CVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472,
CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480,
CVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490,
CVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496,
CVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834,
CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,
CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,
CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855,
CVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920,
CVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956,
CVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987,
CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,
CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,
CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,
CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,
CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,
CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,
CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,
CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044,
CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,
CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,
CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,
CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,
CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,
CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,
CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,
CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,
CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,
CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,
CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,
CVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121,
CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125,
CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129,
CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136,
CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,
CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,
CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,
CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,
CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,
CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,
CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,
CVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187,
CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,
CVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198,
CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204,
CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208,
CVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214,
CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225,
CVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230,
CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234,
CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241,
CVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282,
CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291,
CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,
CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,
CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,
CVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,
CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,
CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,
CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,
CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,
CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,
CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,
CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,
CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,
CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,
CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,
CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,
CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,
CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,
CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,
CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,
CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,
CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,
CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,
CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,
CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,
CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,
CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,
CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,
CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,
CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,
CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,
CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,
CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,
CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,
CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,
CVE-2026-64164)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8606-1: Linux kernel (Azure) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691498/unix-server/usn-8606-1-linux-kernel-azure-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691498/unix-server/usn-8606-1-linux-kernel-azure-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:41 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - RISC-V architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Serial ATA and Parallel ATA drivers;
  - ATM drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - RNBD block device driver;
  - Ublk userspace block driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clock framework and drivers;
  - Clocksource drivers;
  - Data acquisition framework and drivers;
  - Counter interface drivers;
  - CPU frequency scaling framework;
  - CPU idle management framework;
  - Hardware crypto device drivers;
  - CXL (Compute Express Link) drivers;
  - DMA engine subsystem;
  - EDAC drivers;
  - EFI core;
  - GPIO subsystem;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO subsystem;
  - IIO ADC drivers;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IOMMU subsystem;
  - IRQ chip drivers;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Multifunction device drivers;
  - Broadcom VK accelerator driver;
  - Fastrpc Driver;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MOST (Media Oriented Systems Transport) drivers;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Ethernet team driver;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PCI subsystem;
  - Performance monitor drivers;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Generic PM domains;
  - i.MX PM domains;
  - Power supply drivers;
  - RapidIO drivers;
  - RAS (Reliability, Availability, Serviceability) subsystem;
  - Remote Processor subsystem;
  - RPMSG subsystem;
  - S/390 drivers;
  - SCSI subsystem;
  - SLIMbus drivers;
  - Freescale SoC drivers;
  - MediaTek SoC drivers;
  - Microchip PolarFire SoC system controller driver;
  - Texas Instruments SoC drivers;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - ChipIdea USB driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - DesignWare USB3 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - USB Type-C Connector System Software Interface driver;
  - USB over IP driver;
  - vDPA drivers;
  - VFIO drivers;
  - Virtio Host (VHOST) subsystem;
  - Framebuffer layer;
  - TSM TDX Guest driver;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FAT file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - Journaling layer for block devices (JBD2);
  - JFS file system;
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Proc file system;
  - Pstore file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - Audit subsystem;
  - Kernel CPU control infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Memory Management;
  - Integrity Measurement Architecture(IMA) framework;
  - KVM subsystem;
  - Memory management;
  - Networking core;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Tracing infrastructure;
  - Network traffic control;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IPv6 networking;
  - IP tunnels definitions;
  - MAC80211 subsystem;
  - Netfilter;
  - User-space API (UAPI);
  - io_uring subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Perf events;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - Kernel kexec() syscall;
  - KProbes tracing;
  - Locking primitives;
  - Kernel module support;
  - Padata parallel execution mechanism;
  - RCU subsystem;
  - Scheduler infrastructure;
  - Cryptographic library;
  - Scatterlist API;
  - Heterogeneous memory management;
  - KASAN memory debugging framework;
  - 9P file system network protocol;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - KCM (Kernel Connection Multiplexor) sockets driver;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - AppArmor security module;
  - Landlock security;
  - Simplified Mandatory Access Control Kernel framework;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - Samsung ASoC drivers;
  - SoC audio core drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,
CVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175,
CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152,
CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229,
CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,
CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,
CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269,
CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,
CVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292,
CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,
CVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,
CVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104,
CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157,
CVE-2026-23169, CVE-2026-23171, CVE-2026-23207, CVE-2026-23220,
CVE-2026-23221, CVE-2026-23222, CVE-2026-23226, CVE-2026-23227,
CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233,
CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237,
CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243,
CVE-2026-23244, CVE-2026-23245, CVE-2026-23246, CVE-2026-23249,
CVE-2026-23253, CVE-2026-23255, CVE-2026-23266, CVE-2026-23267,
CVE-2026-23270, CVE-2026-23271, CVE-2026-23272, CVE-2026-23276,
CVE-2026-23277, CVE-2026-23278, CVE-2026-23279, CVE-2026-23281,
CVE-2026-23284, CVE-2026-23285, CVE-2026-23286, CVE-2026-23287,
CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23292,
CVE-2026-23293, CVE-2026-23296, CVE-2026-23298, CVE-2026-23300,
CVE-2026-23302, CVE-2026-23303, CVE-2026-23304, CVE-2026-23306,
CVE-2026-23307, CVE-2026-23308, CVE-2026-23310, CVE-2026-23312,
CVE-2026-23313, CVE-2026-23315, CVE-2026-23317, CVE-2026-23318,
CVE-2026-23319, CVE-2026-23321, CVE-2026-23324, CVE-2026-23325,
CVE-2026-23330, CVE-2026-23334, CVE-2026-23335, CVE-2026-23336,
CVE-2026-23339, CVE-2026-23340, CVE-2026-23343, CVE-2026-23347,
CVE-2026-23352, CVE-2026-23356, CVE-2026-23357, CVE-2026-23359,
CVE-2026-23360, CVE-2026-23361, CVE-2026-23362, CVE-2026-23363,
CVE-2026-23364, CVE-2026-23365, CVE-2026-23367, CVE-2026-23368,
CVE-2026-23369, CVE-2026-23370, CVE-2026-23372, CVE-2026-23374,
CVE-2026-23375, CVE-2026-23378, CVE-2026-23379, CVE-2026-23381,
CVE-2026-23382, CVE-2026-23383, CVE-2026-23386, CVE-2026-23387,
CVE-2026-23388, CVE-2026-23389, CVE-2026-23391, CVE-2026-23392,
CVE-2026-23395, CVE-2026-23396, CVE-2026-23397, CVE-2026-23398,
CVE-2026-23399, CVE-2026-23401, CVE-2026-23412, CVE-2026-23413,
CVE-2026-23414, CVE-2026-23418, CVE-2026-23419, CVE-2026-23420,
CVE-2026-23426, CVE-2026-23428, CVE-2026-23434, CVE-2026-23438,
CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,
CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,
CVE-2026-23449, CVE-2026-23450, CVE-2026-23452, CVE-2026-23454,
CVE-2026-23455, CVE-2026-23456, CVE-2026-23457, CVE-2026-23458,
CVE-2026-23460, CVE-2026-23461, CVE-2026-23462, CVE-2026-23463,
CVE-2026-23464, CVE-2026-23465, CVE-2026-23468, CVE-2026-23470,
CVE-2026-23474, CVE-2026-23475, CVE-2026-31389, CVE-2026-31391,
CVE-2026-31392, CVE-2026-31393, CVE-2026-31394, CVE-2026-31396,
CVE-2026-31399, CVE-2026-31400, CVE-2026-31402, CVE-2026-31403,
CVE-2026-31405, CVE-2026-31407, CVE-2026-31408, CVE-2026-31409,
CVE-2026-31411, CVE-2026-31412, CVE-2026-31414, CVE-2026-31415,
CVE-2026-31416, CVE-2026-31417, CVE-2026-31418, CVE-2026-31421,
CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,
CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,
CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,
CVE-2026-31436, CVE-2026-31438, CVE-2026-31439, CVE-2026-31440,
CVE-2026-31441, CVE-2026-31446, CVE-2026-31447, CVE-2026-31448,
CVE-2026-31449, CVE-2026-31450, CVE-2026-31451, CVE-2026-31452,
CVE-2026-31453, CVE-2026-31454, CVE-2026-31455, CVE-2026-31458,
CVE-2026-31464, CVE-2026-31466, CVE-2026-31467, CVE-2026-31469,
CVE-2026-31470, CVE-2026-31473, CVE-2026-31474, CVE-2026-31476,
CVE-2026-31477, CVE-2026-31478, CVE-2026-31480, CVE-2026-31482,
CVE-2026-31483, CVE-2026-31485, CVE-2026-31487, CVE-2026-31488,
CVE-2026-31489, CVE-2026-31492, CVE-2026-31494, CVE-2026-31495,
CVE-2026-31496, CVE-2026-31497, CVE-2026-31498, CVE-2026-31499,
CVE-2026-31500, CVE-2026-31502, CVE-2026-31503, CVE-2026-31505,
CVE-2026-31506, CVE-2026-31507, CVE-2026-31508, CVE-2026-31509,
CVE-2026-31510, CVE-2026-31511, CVE-2026-31512, CVE-2026-31515,
CVE-2026-31516, CVE-2026-31518, CVE-2026-31519, CVE-2026-31520,
CVE-2026-31521, CVE-2026-31522, CVE-2026-31523, CVE-2026-31524,
CVE-2026-31525, CVE-2026-31527, CVE-2026-31528, CVE-2026-31530,
CVE-2026-31532, CVE-2026-31540, CVE-2026-31542, CVE-2026-31545,
CVE-2026-31546, CVE-2026-31548, CVE-2026-31549, CVE-2026-31550,
CVE-2026-31551, CVE-2026-31552, CVE-2026-31554, CVE-2026-31555,
CVE-2026-31556, CVE-2026-31557, CVE-2026-31563, CVE-2026-31565,
CVE-2026-31566, CVE-2026-31570, CVE-2026-31575, CVE-2026-31576,
CVE-2026-31577, CVE-2026-31578, CVE-2026-31580, CVE-2026-31581,
CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585,
CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31590,
CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597,
CVE-2026-31598, CVE-2026-31599, CVE-2026-31602, CVE-2026-31603,
CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607,
CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,
CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618,
CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,
CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,
CVE-2026-31629, CVE-2026-31634, CVE-2026-31637, CVE-2026-31638,
CVE-2026-31639, CVE-2026-31642, CVE-2026-31645, CVE-2026-31646,
CVE-2026-31648, CVE-2026-31649, CVE-2026-31651, CVE-2026-31655,
CVE-2026-31656, CVE-2026-31657, CVE-2026-31658, CVE-2026-31659,
CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664,
CVE-2026-31665, CVE-2026-31667, CVE-2026-31668, CVE-2026-31669,
CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673,
CVE-2026-31674, CVE-2026-31675, CVE-2026-31677, CVE-2026-31678,
CVE-2026-31679, CVE-2026-31680, CVE-2026-31681, CVE-2026-31682,
CVE-2026-31683, CVE-2026-31684, CVE-2026-31685, CVE-2026-31686,
CVE-2026-31687, CVE-2026-31689, CVE-2026-31693, CVE-2026-31694,
CVE-2026-31695, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698,
CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702,
CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707,
CVE-2026-31708, CVE-2026-31709, CVE-2026-31711, CVE-2026-31712,
CVE-2026-31714, CVE-2026-31715, CVE-2026-31716, CVE-2026-31720,
CVE-2026-31721, CVE-2026-31722, CVE-2026-31723, CVE-2026-31724,
CVE-2026-31725, CVE-2026-31726, CVE-2026-31728, CVE-2026-31729,
CVE-2026-31730, CVE-2026-31731, CVE-2026-31737, CVE-2026-31738,
CVE-2026-31740, CVE-2026-31741, CVE-2026-31747, CVE-2026-31748,
CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754,
CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759,
CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31767,
CVE-2026-31768, CVE-2026-31770, CVE-2026-31772, CVE-2026-31773,
CVE-2026-31778, CVE-2026-31779, CVE-2026-31780, CVE-2026-31781,
CVE-2026-31788, CVE-2026-43007, CVE-2026-43011, CVE-2026-43012,
CVE-2026-43013, CVE-2026-43014, CVE-2026-43015, CVE-2026-43016,
CVE-2026-43017, CVE-2026-43018, CVE-2026-43019, CVE-2026-43020,
CVE-2026-43023, CVE-2026-43024, CVE-2026-43025, CVE-2026-43026,
CVE-2026-43027, CVE-2026-43028, CVE-2026-43030, CVE-2026-43032,
CVE-2026-43035, CVE-2026-43036, CVE-2026-43037, CVE-2026-43038,
CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43044,
CVE-2026-43046, CVE-2026-43047, CVE-2026-43049, CVE-2026-43050,
CVE-2026-43051, CVE-2026-43052, CVE-2026-43054, CVE-2026-43056,
CVE-2026-43057, CVE-2026-43058, CVE-2026-43059, CVE-2026-43060,
CVE-2026-43061, CVE-2026-43062, CVE-2026-43064, CVE-2026-43065,
CVE-2026-43066, CVE-2026-43068, CVE-2026-43069, CVE-2026-43071,
CVE-2026-43072, CVE-2026-43073, CVE-2026-43074, CVE-2026-43075,
CVE-2026-43076, CVE-2026-43079, CVE-2026-43080, CVE-2026-43081,
CVE-2026-43082, CVE-2026-43085, CVE-2026-43086, CVE-2026-43088,
CVE-2026-43089, CVE-2026-43091, CVE-2026-43092, CVE-2026-43093,
CVE-2026-43094, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103,
CVE-2026-43104, CVE-2026-43105, CVE-2026-43107, CVE-2026-43109,
CVE-2026-43110, CVE-2026-43111, CVE-2026-43112, CVE-2026-43113,
CVE-2026-43114, CVE-2026-43117, CVE-2026-43119, CVE-2026-43120,
CVE-2026-43123, CVE-2026-43124, CVE-2026-43128, CVE-2026-43129,
CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134,
CVE-2026-43135, CVE-2026-43136, CVE-2026-43137, CVE-2026-43139,
CVE-2026-43140, CVE-2026-43141, CVE-2026-43143, CVE-2026-43145,
CVE-2026-43147, CVE-2026-43148, CVE-2026-43149, CVE-2026-43150,
CVE-2026-43152, CVE-2026-43153, CVE-2026-43156, CVE-2026-43157,
CVE-2026-43158, CVE-2026-43159, CVE-2026-43162, CVE-2026-43163,
CVE-2026-43167, CVE-2026-43168, CVE-2026-43169, CVE-2026-43170,
CVE-2026-43171, CVE-2026-43173, CVE-2026-43175, CVE-2026-43180,
CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43185,
CVE-2026-43186, CVE-2026-43187, CVE-2026-43189, CVE-2026-43190,
CVE-2026-43194, CVE-2026-43196, CVE-2026-43199, CVE-2026-43200,
CVE-2026-43201, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205,
CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211,
CVE-2026-43212, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,
CVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225,
CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231,
CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,
CVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244,
CVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,
CVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253,
CVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43258,
CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43265,
CVE-2026-43266, CVE-2026-43268, CVE-2026-43269, CVE-2026-43270,
CVE-2026-43271, CVE-2026-43273, CVE-2026-43275, CVE-2026-43277,
CVE-2026-43278, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283,
CVE-2026-43287, CVE-2026-43288, CVE-2026-43289, CVE-2026-43291,
CVE-2026-43295, CVE-2026-43296, CVE-2026-43297, CVE-2026-43300,
CVE-2026-43302, CVE-2026-43304, CVE-2026-43312, CVE-2026-43313,
CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43317,
CVE-2026-43318, CVE-2026-43319, CVE-2026-43320, CVE-2026-43324,
CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330,
CVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336,
CVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43341,
CVE-2026-43342, CVE-2026-43343, CVE-2026-43345, CVE-2026-43350,
CVE-2026-43355, CVE-2026-43357, CVE-2026-43359, CVE-2026-43360,
CVE-2026-43361, CVE-2026-43363, CVE-2026-43365, CVE-2026-43366,
CVE-2026-43368, CVE-2026-43370, CVE-2026-43372, CVE-2026-43373,
CVE-2026-43377, CVE-2026-43378, CVE-2026-43380, CVE-2026-43381,
CVE-2026-43382, CVE-2026-43383, CVE-2026-43384, CVE-2026-43386,
CVE-2026-43387, CVE-2026-43395, CVE-2026-43397, CVE-2026-43405,
CVE-2026-43406, CVE-2026-43407, CVE-2026-43408, CVE-2026-43409,
CVE-2026-43411, CVE-2026-43412, CVE-2026-43413, CVE-2026-43414,
CVE-2026-43415, CVE-2026-43419, CVE-2026-43420, CVE-2026-43421,
CVE-2026-43424, CVE-2026-43425, CVE-2026-43426, CVE-2026-43427,
CVE-2026-43428, CVE-2026-43429, CVE-2026-43430, CVE-2026-43432,
CVE-2026-43436, CVE-2026-43437, CVE-2026-43439, CVE-2026-43441,
CVE-2026-43445, CVE-2026-43448, CVE-2026-43449, CVE-2026-43450,
CVE-2026-43451, CVE-2026-43452, CVE-2026-43453, CVE-2026-43455,
CVE-2026-43456, CVE-2026-43457, CVE-2026-43458, CVE-2026-43459,
CVE-2026-43466, CVE-2026-43467, CVE-2026-43468, CVE-2026-43469,
CVE-2026-43471, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475,
CVE-2026-43476, CVE-2026-43480, CVE-2026-43483, CVE-2026-43484,
CVE-2026-43488, CVE-2026-43490, CVE-2026-43491, CVE-2026-43492,
CVE-2026-43493, CVE-2026-43495, CVE-2026-43496, CVE-2026-43497,
CVE-2026-43499, CVE-2026-43501, CVE-2026-43502, CVE-2026-45834,
CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,
CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,
CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45847,
CVE-2026-45848, CVE-2026-45849, CVE-2026-45851, CVE-2026-45852,
CVE-2026-45855, CVE-2026-45856, CVE-2026-45857, CVE-2026-45858,
CVE-2026-45859, CVE-2026-45860, CVE-2026-45861, CVE-2026-45862,
CVE-2026-45864, CVE-2026-45865, CVE-2026-45866, CVE-2026-45867,
CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871,
CVE-2026-45872, CVE-2026-45873, CVE-2026-45875, CVE-2026-45877,
CVE-2026-45878, CVE-2026-45879, CVE-2026-45880, CVE-2026-45881,
CVE-2026-45882, CVE-2026-45883, CVE-2026-45884, CVE-2026-45885,
CVE-2026-45886, CVE-2026-45890, CVE-2026-45891, CVE-2026-45893,
CVE-2026-45895, CVE-2026-45899, CVE-2026-45902, CVE-2026-45904,
CVE-2026-45905, CVE-2026-45910, CVE-2026-45911, CVE-2026-45912,
CVE-2026-45913, CVE-2026-45914, CVE-2026-45915, CVE-2026-45916,
CVE-2026-45917, CVE-2026-45919, CVE-2026-45920, CVE-2026-45921,
CVE-2026-45923, CVE-2026-45924, CVE-2026-45928, CVE-2026-45935,
CVE-2026-45936, CVE-2026-45938, CVE-2026-45941, CVE-2026-45942,
CVE-2026-45943, CVE-2026-45946, CVE-2026-45947, CVE-2026-45948,
CVE-2026-45954, CVE-2026-45956, CVE-2026-45957, CVE-2026-45958,
CVE-2026-45960, CVE-2026-45962, CVE-2026-45964, CVE-2026-45965,
CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45972,
CVE-2026-45973, CVE-2026-45974, CVE-2026-45976, CVE-2026-45978,
CVE-2026-45981, CVE-2026-45982, CVE-2026-45983, CVE-2026-45984,
CVE-2026-45985, CVE-2026-45986, CVE-2026-45987, CVE-2026-45988,
CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,
CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,
CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,
CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,
CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,
CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,
CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,
CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46043,
CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049,
CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053,
CVE-2026-46056, CVE-2026-46058, CVE-2026-46061, CVE-2026-46062,
CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46068,
CVE-2026-46069, CVE-2026-46070, CVE-2026-46072, CVE-2026-46073,
CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078,
CVE-2026-46079, CVE-2026-46080, CVE-2026-46082, CVE-2026-46083,
CVE-2026-46084, CVE-2026-46086, CVE-2026-46088, CVE-2026-46089,
CVE-2026-46090, CVE-2026-46091, CVE-2026-46092, CVE-2026-46094,
CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102,
CVE-2026-46103, CVE-2026-46106, CVE-2026-46107, CVE-2026-46108,
CVE-2026-46110, CVE-2026-46111, CVE-2026-46112, CVE-2026-46113,
CVE-2026-46114, CVE-2026-46115, CVE-2026-46116, CVE-2026-46117,
CVE-2026-46119, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122,
CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126,
CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46131,
CVE-2026-46132, CVE-2026-46133, CVE-2026-46135, CVE-2026-46136,
CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,
CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,
CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,
CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,
CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,
CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,
CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,
CVE-2026-46180, CVE-2026-46184, CVE-2026-46185, CVE-2026-46186,
CVE-2026-46187, CVE-2026-46189, CVE-2026-46190, CVE-2026-46191,
CVE-2026-46193, CVE-2026-46194, CVE-2026-46195, CVE-2026-46196,
CVE-2026-46197, CVE-2026-46198, CVE-2026-46199, CVE-2026-46200,
CVE-2026-46201, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206,
CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46211,
CVE-2026-46212, CVE-2026-46214, CVE-2026-46218, CVE-2026-46219,
CVE-2026-46220, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227,
CVE-2026-46229, CVE-2026-46230, CVE-2026-46231, CVE-2026-46232,
CVE-2026-46233, CVE-2026-46234, CVE-2026-46235, CVE-2026-46236,
CVE-2026-46238, CVE-2026-46241, CVE-2026-46243, CVE-2026-46244,
CVE-2026-46246, CVE-2026-46247, CVE-2026-46249, CVE-2026-46250,
CVE-2026-46251, CVE-2026-46253, CVE-2026-46254, CVE-2026-46255,
CVE-2026-46259, CVE-2026-46260, CVE-2026-46261, CVE-2026-46265,
CVE-2026-46266, CVE-2026-46267, CVE-2026-46270, CVE-2026-46273,
CVE-2026-46274, CVE-2026-46280, CVE-2026-46282, CVE-2026-46285,
CVE-2026-46286, CVE-2026-46287, CVE-2026-46289, CVE-2026-46291,
CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,
CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,
CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,
CVE-2026-46319, CVE-2026-46328, CVE-2026-52911, CVE-2026-52920,
CVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52951,
CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958,
CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964,
CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970,
CVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981,
CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986,
CVE-2026-52989, CVE-2026-52990, CVE-2026-52992, CVE-2026-52993,
CVE-2026-52995, CVE-2026-52998, CVE-2026-52999, CVE-2026-53001,
CVE-2026-53002, CVE-2026-53003, CVE-2026-53004, CVE-2026-53006,
CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014,
CVE-2026-53015, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022,
CVE-2026-53023, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034,
CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53039,
CVE-2026-53040, CVE-2026-53041, CVE-2026-53043, CVE-2026-53045,
CVE-2026-53046, CVE-2026-53047, CVE-2026-53048, CVE-2026-53049,
CVE-2026-53050, CVE-2026-53052, CVE-2026-53056, CVE-2026-53058,
CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062,
CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066,
CVE-2026-53068, CVE-2026-53069, CVE-2026-53071, CVE-2026-53072,
CVE-2026-53073, CVE-2026-53074, CVE-2026-53075, CVE-2026-53076,
CVE-2026-53077, CVE-2026-53082, CVE-2026-53083, CVE-2026-53084,
CVE-2026-53085, CVE-2026-53086, CVE-2026-53088, CVE-2026-53093,
CVE-2026-53094, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098,
CVE-2026-53110, CVE-2026-53111, CVE-2026-53112, CVE-2026-53115,
CVE-2026-53117, CVE-2026-53122, CVE-2026-53123, CVE-2026-53126,
CVE-2026-53128, CVE-2026-53130, CVE-2026-53279, CVE-2026-53287,
CVE-2026-53289, CVE-2026-53291, CVE-2026-53293, CVE-2026-53294,
CVE-2026-53295, CVE-2026-53296, CVE-2026-53303, CVE-2026-53304,
CVE-2026-53306, CVE-2026-53309, CVE-2026-53314, CVE-2026-53320,
CVE-2026-53369, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376,
CVE-2026-53379, CVE-2026-63838, CVE-2026-63843, CVE-2026-63844,
CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848,
CVE-2026-63851, CVE-2026-63852, CVE-2026-63854, CVE-2026-63855,
CVE-2026-63856, CVE-2026-63860, CVE-2026-63861, CVE-2026-63862,
CVE-2026-63865, CVE-2026-64018, CVE-2026-64034)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8607-1: Linux kernel (Azure CVM) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691497/unix-server/usn-8607-1-linux-kernel-azure-cvm-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691497/unix-server/usn-8607-1-linux-kernel-azure-cvm-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:40 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - RISC-V architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Serial ATA and Parallel ATA drivers;
  - ATM drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - RNBD block device driver;
  - Ublk userspace block driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clock framework and drivers;
  - Clocksource drivers;
  - Data acquisition framework and drivers;
  - Counter interface drivers;
  - CPU frequency scaling framework;
  - CPU idle management framework;
  - Hardware crypto device drivers;
  - CXL (Compute Express Link) drivers;
  - DMA engine subsystem;
  - EDAC drivers;
  - EFI core;
  - GPIO subsystem;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO subsystem;
  - IIO ADC drivers;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IOMMU subsystem;
  - IRQ chip drivers;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Multifunction device drivers;
  - Broadcom VK accelerator driver;
  - Fastrpc Driver;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MOST (Media Oriented Systems Transport) drivers;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Ethernet team driver;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PCI subsystem;
  - Performance monitor drivers;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Generic PM domains;
  - i.MX PM domains;
  - Power supply drivers;
  - RapidIO drivers;
  - RAS (Reliability, Availability, Serviceability) subsystem;
  - Remote Processor subsystem;
  - RPMSG subsystem;
  - S/390 drivers;
  - SCSI subsystem;
  - SLIMbus drivers;
  - Freescale SoC drivers;
  - MediaTek SoC drivers;
  - Microchip PolarFire SoC system controller driver;
  - Texas Instruments SoC drivers;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - ChipIdea USB driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - DesignWare USB3 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - USB Type-C Connector System Software Interface driver;
  - USB over IP driver;
  - vDPA drivers;
  - VFIO drivers;
  - Virtio Host (VHOST) subsystem;
  - Framebuffer layer;
  - TSM TDX Guest driver;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FAT file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - Journaling layer for block devices (JBD2);
  - JFS file system;
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Proc file system;
  - Pstore file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - Audit subsystem;
  - Kernel CPU control infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Memory Management;
  - Integrity Measurement Architecture(IMA) framework;
  - KVM subsystem;
  - Memory management;
  - Networking core;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Tracing infrastructure;
  - Network traffic control;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IPv6 networking;
  - IP tunnels definitions;
  - MAC80211 subsystem;
  - Netfilter;
  - User-space API (UAPI);
  - io_uring subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Perf events;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - Kernel kexec() syscall;
  - KProbes tracing;
  - Locking primitives;
  - Kernel module support;
  - Padata parallel execution mechanism;
  - RCU subsystem;
  - Scheduler infrastructure;
  - Cryptographic library;
  - Scatterlist API;
  - Heterogeneous memory management;
  - KASAN memory debugging framework;
  - 9P file system network protocol;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - KCM (Kernel Connection Multiplexor) sockets driver;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - AppArmor security module;
  - Landlock security;
  - Simplified Mandatory Access Control Kernel framework;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - Samsung ASoC drivers;
  - SoC audio core drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,
CVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175,
CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152,
CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229,
CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,
CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,
CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269,
CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,
CVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292,
CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,
CVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,
CVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104,
CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157,
CVE-2026-23169, CVE-2026-23171, CVE-2026-23220, CVE-2026-23221,
CVE-2026-23222, CVE-2026-23226, CVE-2026-23227, CVE-2026-23228,
CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234,
CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238,
CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23244,
CVE-2026-23245, CVE-2026-23246, CVE-2026-23249, CVE-2026-23253,
CVE-2026-23255, CVE-2026-23266, CVE-2026-23267, CVE-2026-23270,
CVE-2026-23271, CVE-2026-23272, CVE-2026-23276, CVE-2026-23277,
CVE-2026-23278, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284,
CVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289,
CVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293,
CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302,
CVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307,
CVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313,
CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319,
CVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330,
CVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339,
CVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352,
CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23361,
CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,
CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,
CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,
CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,
CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,
CVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396,
CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401,
CVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418,
CVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23428,
CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440,
CVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446,
CVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23450,
CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456,
CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,
CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,
CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,
CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,
CVE-2026-31402, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407,
CVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31412,
CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417,
CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423,
CVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427,
CVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432,
CVE-2026-31433, CVE-2026-31436, CVE-2026-31438, CVE-2026-31439,
CVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447,
CVE-2026-31448, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451,
CVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455,
CVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467,
CVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474,
CVE-2026-31476, CVE-2026-31477, CVE-2026-31478, CVE-2026-31480,
CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,
CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,
CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,
CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,
CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,
CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,
CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,
CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,
CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,
CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,
CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,
CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,
CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,
CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,
CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,
CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,
CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,
CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,
CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,
CVE-2026-31607, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612,
CVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617,
CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623,
CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627,
CVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31637,
CVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645,
CVE-2026-31646, CVE-2026-31648, CVE-2026-31649, CVE-2026-31651,
CVE-2026-31655, CVE-2026-31656, CVE-2026-31657, CVE-2026-31658,
CVE-2026-31659, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662,
CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31668,
CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,
CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,
CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,
CVE-2026-31682, CVE-2026-31683, CVE-2026-31684, CVE-2026-31685,
CVE-2026-31686, CVE-2026-31687, CVE-2026-31689, CVE-2026-31693,
CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,
CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,
CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,
CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,
CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,
CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,
CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,
CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,
CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,
CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,
CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,
CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,
CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,
CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,
CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43011,
CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,
CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,
CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,
CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,
CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43037,
CVE-2026-43038, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043,
CVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049,
CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054,
CVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059,
CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064,
CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069,
CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,
CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,
CVE-2026-43081, CVE-2026-43082, CVE-2026-43085, CVE-2026-43086,
CVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092,
CVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099,
CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107,
CVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112,
CVE-2026-43113, CVE-2026-43114, CVE-2026-43117, CVE-2026-43119,
CVE-2026-43120, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128,
CVE-2026-43129, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133,
CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137,
CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143,
CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149,
CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156,
CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43162,
CVE-2026-43163, CVE-2026-43167, CVE-2026-43168, CVE-2026-43169,
CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175,
CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184,
CVE-2026-43185, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189,
CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199,
CVE-2026-43200, CVE-2026-43201, CVE-2026-43202, CVE-2026-43203,
CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209,
CVE-2026-43211, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,
CVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225,
CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231,
CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,
CVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244,
CVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,
CVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253,
CVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43261,
CVE-2026-43262, CVE-2026-43264, CVE-2026-43265, CVE-2026-43266,
CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43271,
CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43278,
CVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287,
CVE-2026-43288, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295,
CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302,
CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314,
CVE-2026-43315, CVE-2026-43316, CVE-2026-43317, CVE-2026-43318,
CVE-2026-43319, CVE-2026-43320, CVE-2026-43324, CVE-2026-43327,
CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,
CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,
CVE-2026-43339, CVE-2026-43340, CVE-2026-43341, CVE-2026-43342,
CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,
CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,
CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,
CVE-2026-43370, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377,
CVE-2026-43378, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,
CVE-2026-43383, CVE-2026-43384, CVE-2026-43386, CVE-2026-43387,
CVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43406,
CVE-2026-43407, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,
CVE-2026-43412, CVE-2026-43413, CVE-2026-43414, CVE-2026-43415,
CVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424,
CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,
CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436,
CVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445,
CVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,
CVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456,
CVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,
CVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471,
CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476,
CVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488,
CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43493,
CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499,
CVE-2026-43501, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835,
CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840,
CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844,
CVE-2026-45845, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848,
CVE-2026-45849, CVE-2026-45851, CVE-2026-45852, CVE-2026-45855,
CVE-2026-45856, CVE-2026-45857, CVE-2026-45858, CVE-2026-45859,
CVE-2026-45860, CVE-2026-45861, CVE-2026-45862, CVE-2026-45864,
CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868,
CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45872,
CVE-2026-45873, CVE-2026-45875, CVE-2026-45877, CVE-2026-45878,
CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882,
CVE-2026-45883, CVE-2026-45884, CVE-2026-45885, CVE-2026-45886,
CVE-2026-45890, CVE-2026-45891, CVE-2026-45893, CVE-2026-45895,
CVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905,
CVE-2026-45910, CVE-2026-45911, CVE-2026-45912, CVE-2026-45913,
CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917,
CVE-2026-45919, CVE-2026-45920, CVE-2026-45921, CVE-2026-45923,
CVE-2026-45924, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936,
CVE-2026-45938, CVE-2026-45941, CVE-2026-45942, CVE-2026-45943,
CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954,
CVE-2026-45956, CVE-2026-45957, CVE-2026-45958, CVE-2026-45960,
CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968,
CVE-2026-45969, CVE-2026-45970, CVE-2026-45972, CVE-2026-45973,
CVE-2026-45974, CVE-2026-45976, CVE-2026-45978, CVE-2026-45981,
CVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985,
CVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989,
CVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997,
CVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004,
CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009,
CVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016,
CVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022,
CVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027,
CVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038,
CVE-2026-46040, CVE-2026-46041, CVE-2026-46043, CVE-2026-46044,
CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,
CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,
CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,
CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,
CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,
CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,
CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,
CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,
CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,
CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,
CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,
CVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46119,
CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123,
CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127,
CVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132,
CVE-2026-46133, CVE-2026-46135, CVE-2026-46136, CVE-2026-46137,
CVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143,
CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149,
CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157,
CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163,
CVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169,
CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176,
CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180,
CVE-2026-46184, CVE-2026-46185, CVE-2026-46186, CVE-2026-46187,
CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,
CVE-2026-46194, CVE-2026-46195, CVE-2026-46196, CVE-2026-46197,
CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201,
CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207,
CVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212,
CVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220,
CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229,
CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233,
CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238,
CVE-2026-46241, CVE-2026-46243, CVE-2026-46244, CVE-2026-46246,
CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251,
CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259,
CVE-2026-46260, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266,
CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274,
CVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286,
CVE-2026-46287, CVE-2026-46289, CVE-2026-46291, CVE-2026-46292,
CVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299,
CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306,
CVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319,
CVE-2026-46328, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,
CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,
CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,
CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,
CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,
CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,
CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,
CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,
CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,
CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,
CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,
CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,
CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,
CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,
CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,
CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,
CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,
CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,
CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,
CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,
CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,
CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,
CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,
CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,
CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,
CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,
CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,
CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,
CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,
CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,
CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,
CVE-2026-64018, CVE-2026-64034)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8608-1: Linux kernel (Azure FIPS) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691496/unix-server/usn-8608-1-linux-kernel-azure-fips-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691496/unix-server/usn-8608-1-linux-kernel-azure-fips-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:38 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM64 architecture;
  - RISC-V architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Serial ATA and Parallel ATA drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - Clock framework and drivers;
  - Data acquisition framework and drivers;
  - Counter interface drivers;
  - CPU frequency scaling framework;
  - Hardware crypto device drivers;
  - CXL (Compute Express Link) drivers;
  - DMA engine subsystem;
  - EDAC drivers;
  - EFI core;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO ADC drivers;
  - IIO subsystem;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IRQ chip drivers;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Fastrpc Driver;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Ethernet team driver;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PCI subsystem;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Generic PM domains;
  - i.MX PM domains;
  - Remote Processor subsystem;
  - S/390 drivers;
  - SCSI subsystem;
  - SLIMbus drivers;
  - Freescale SoC drivers;
  - Microchip PolarFire SoC system controller driver;
  - SPI subsystem;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - USB Type-C Connector System Software Interface driver;
  - VFIO drivers;
  - Framebuffer layer;
  - TSM TDX Guest driver;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - Journaling layer for block devices (JBD2);
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - Kernel CPU control infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Memory Management;
  - Integrity Measurement Architecture(IMA) framework;
  - KVM subsystem;
  - Memory management;
  - Networking core;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Tracing infrastructure;
  - Network traffic control;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IP tunnels definitions;
  - MAC80211 subsystem;
  - Netfilter;
  - User-space API (UAPI);
  - io_uring subsystem;
  - Audit subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Perf events;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - KProbes tracing;
  - Locking primitives;
  - Kernel module support;
  - Padata parallel execution mechanism;
  - Cryptographic library;
  - Heterogeneous memory management;
  - KASAN memory debugging framework;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - IPv6 networking;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - Landlock security;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - Samsung ASoC drivers;
  - SoC audio core drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,
CVE-2025-40135, CVE-2025-40150, CVE-2025-68175, CVE-2025-68239,
CVE-2025-68334, CVE-2025-68736, CVE-2025-71152, CVE-2025-71161,
CVE-2025-71203, CVE-2025-71221, CVE-2025-71269, CVE-2025-71287,
CVE-2025-71288, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,
CVE-2026-23004, CVE-2026-23066, CVE-2026-23104, CVE-2026-23118,
CVE-2026-23138, CVE-2026-23154, CVE-2026-23157, CVE-2026-23171,
CVE-2026-23207, CVE-2026-23226, CVE-2026-23227, CVE-2026-23244,
CVE-2026-23245, CVE-2026-23246, CVE-2026-23253, CVE-2026-23255,
CVE-2026-23270, CVE-2026-23271, CVE-2026-23276, CVE-2026-23277,
CVE-2026-23279, CVE-2026-23281, CVE-2026-23284, CVE-2026-23285,
CVE-2026-23286, CVE-2026-23287, CVE-2026-23289, CVE-2026-23290,
CVE-2026-23291, CVE-2026-23292, CVE-2026-23293, CVE-2026-23296,
CVE-2026-23298, CVE-2026-23300, CVE-2026-23302, CVE-2026-23303,
CVE-2026-23304, CVE-2026-23306, CVE-2026-23307, CVE-2026-23308,
CVE-2026-23310, CVE-2026-23312, CVE-2026-23313, CVE-2026-23315,
CVE-2026-23317, CVE-2026-23318, CVE-2026-23319, CVE-2026-23321,
CVE-2026-23324, CVE-2026-23325, CVE-2026-23330, CVE-2026-23334,
CVE-2026-23335, CVE-2026-23336, CVE-2026-23339, CVE-2026-23340,
CVE-2026-23343, CVE-2026-23347, CVE-2026-23352, CVE-2026-23356,
CVE-2026-23357, CVE-2026-23359, CVE-2026-23360, CVE-2026-23361,
CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,
CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,
CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,
CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,
CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,
CVE-2026-23391, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,
CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23412,
CVE-2026-23413, CVE-2026-23414, CVE-2026-23418, CVE-2026-23419,
CVE-2026-23420, CVE-2026-23426, CVE-2026-23434, CVE-2026-23438,
CVE-2026-23439, CVE-2026-23440, CVE-2026-23441, CVE-2026-23442,
CVE-2026-23444, CVE-2026-23446, CVE-2026-23447, CVE-2026-23448,
CVE-2026-23449, CVE-2026-23452, CVE-2026-23454, CVE-2026-23456,
CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,
CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,
CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,
CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,
CVE-2026-31403, CVE-2026-31405, CVE-2026-31407, CVE-2026-31408,
CVE-2026-31409, CVE-2026-31412, CVE-2026-31413, CVE-2026-31414,
CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,
CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,
CVE-2026-31426, CVE-2026-31427, CVE-2026-31428, CVE-2026-31429,
CVE-2026-31430, CVE-2026-31432, CVE-2026-31433, CVE-2026-31434,
CVE-2026-31438, CVE-2026-31439, CVE-2026-31440, CVE-2026-31441,
CVE-2026-31446, CVE-2026-31447, CVE-2026-31449, CVE-2026-31450,
CVE-2026-31451, CVE-2026-31452, CVE-2026-31453, CVE-2026-31454,
CVE-2026-31455, CVE-2026-31458, CVE-2026-31464, CVE-2026-31466,
CVE-2026-31467, CVE-2026-31469, CVE-2026-31470, CVE-2026-31473,
CVE-2026-31474, CVE-2026-31476, CVE-2026-31477, CVE-2026-31480,
CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,
CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,
CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,
CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,
CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,
CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,
CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,
CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,
CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,
CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,
CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,
CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,
CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,
CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,
CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,
CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,
CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,
CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,
CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,
CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613,
CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618,
CVE-2026-31619, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,
CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,
CVE-2026-31629, CVE-2026-31634, CVE-2026-31638, CVE-2026-31639,
CVE-2026-31642, CVE-2026-31645, CVE-2026-31646, CVE-2026-31648,
CVE-2026-31651, CVE-2026-31655, CVE-2026-31656, CVE-2026-31658,
CVE-2026-31660, CVE-2026-31661, CVE-2026-31662, CVE-2026-31664,
CVE-2026-31665, CVE-2026-31667, CVE-2026-31670, CVE-2026-31671,
CVE-2026-31672, CVE-2026-31673, CVE-2026-31674, CVE-2026-31675,
CVE-2026-31677, CVE-2026-31678, CVE-2026-31679, CVE-2026-31680,
CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686,
CVE-2026-31689, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696,
CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700,
CVE-2026-31701, CVE-2026-31702, CVE-2026-31704, CVE-2026-31705,
CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709,
CVE-2026-31711, CVE-2026-31712, CVE-2026-31714, CVE-2026-31715,
CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31722,
CVE-2026-31723, CVE-2026-31724, CVE-2026-31725, CVE-2026-31726,
CVE-2026-31728, CVE-2026-31729, CVE-2026-31730, CVE-2026-31731,
CVE-2026-31737, CVE-2026-31738, CVE-2026-31740, CVE-2026-31741,
CVE-2026-31747, CVE-2026-31748, CVE-2026-31749, CVE-2026-31751,
CVE-2026-31752, CVE-2026-31754, CVE-2026-31755, CVE-2026-31756,
CVE-2026-31758, CVE-2026-31759, CVE-2026-31761, CVE-2026-31762,
CVE-2026-31763, CVE-2026-31767, CVE-2026-31768, CVE-2026-31770,
CVE-2026-31772, CVE-2026-31773, CVE-2026-31778, CVE-2026-31779,
CVE-2026-31780, CVE-2026-31781, CVE-2026-31788, CVE-2026-43007,
CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,
CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,
CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,
CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,
CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43040,
CVE-2026-43041, CVE-2026-43043, CVE-2026-43044, CVE-2026-43046,
CVE-2026-43047, CVE-2026-43049, CVE-2026-43050, CVE-2026-43051,
CVE-2026-43052, CVE-2026-43054, CVE-2026-43056, CVE-2026-43057,
CVE-2026-43058, CVE-2026-43059, CVE-2026-43060, CVE-2026-43061,
CVE-2026-43062, CVE-2026-43064, CVE-2026-43065, CVE-2026-43066,
CVE-2026-43068, CVE-2026-43069, CVE-2026-43072, CVE-2026-43073,
CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079,
CVE-2026-43080, CVE-2026-43081, CVE-2026-43082, CVE-2026-43084,
CVE-2026-43085, CVE-2026-43086, CVE-2026-43088, CVE-2026-43089,
CVE-2026-43091, CVE-2026-43092, CVE-2026-43093, CVE-2026-43094,
CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104,
CVE-2026-43105, CVE-2026-43107, CVE-2026-43109, CVE-2026-43110,
CVE-2026-43111, CVE-2026-43112, CVE-2026-43113, CVE-2026-43119,
CVE-2026-43120, CVE-2026-43129, CVE-2026-43162, CVE-2026-43245,
CVE-2026-43252, CVE-2026-43265, CVE-2026-43281, CVE-2026-43324,
CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43330,
CVE-2026-43332, CVE-2026-43333, CVE-2026-43334, CVE-2026-43336,
CVE-2026-43338, CVE-2026-43339, CVE-2026-43340, CVE-2026-43342,
CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,
CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,
CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,
CVE-2026-43370, CVE-2026-43371, CVE-2026-43372, CVE-2026-43373,
CVE-2026-43377, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,
CVE-2026-43386, CVE-2026-43387, CVE-2026-43395, CVE-2026-43397,
CVE-2026-43405, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,
CVE-2026-43412, CVE-2026-43413, CVE-2026-43415, CVE-2026-43419,
CVE-2026-43420, CVE-2026-43421, CVE-2026-43424, CVE-2026-43425,
CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,
CVE-2026-43430, CVE-2026-43432, CVE-2026-43436, CVE-2026-43437,
CVE-2026-43439, CVE-2026-43441, CVE-2026-43445, CVE-2026-43448,
CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,
CVE-2026-43453, CVE-2026-43455, CVE-2026-43456, CVE-2026-43457,
CVE-2026-43458, CVE-2026-43459, CVE-2026-43466, CVE-2026-43467,
CVE-2026-43468, CVE-2026-43469, CVE-2026-43471, CVE-2026-43472,
CVE-2026-43473, CVE-2026-43475, CVE-2026-43476, CVE-2026-43480,
CVE-2026-43483, CVE-2026-43484, CVE-2026-43488, CVE-2026-43490,
CVE-2026-43491, CVE-2026-43492, CVE-2026-43495, CVE-2026-43496,
CVE-2026-43497, CVE-2026-43499, CVE-2026-43502, CVE-2026-45834,
CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,
CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,
CVE-2026-45844, CVE-2026-45845, CVE-2026-45846, CVE-2026-45855,
CVE-2026-45858, CVE-2026-45899, CVE-2026-45911, CVE-2026-45920,
CVE-2026-45924, CVE-2026-45942, CVE-2026-45943, CVE-2026-45956,
CVE-2026-45958, CVE-2026-45985, CVE-2026-45986, CVE-2026-45987,
CVE-2026-45989, CVE-2026-45991, CVE-2026-45994, CVE-2026-45996,
CVE-2026-45997, CVE-2026-45999, CVE-2026-46002, CVE-2026-46003,
CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,
CVE-2026-46009, CVE-2026-46011, CVE-2026-46012, CVE-2026-46015,
CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46021,
CVE-2026-46022, CVE-2026-46023, CVE-2026-46024, CVE-2026-46026,
CVE-2026-46027, CVE-2026-46031, CVE-2026-46033, CVE-2026-46037,
CVE-2026-46038, CVE-2026-46040, CVE-2026-46041, CVE-2026-46044,
CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,
CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,
CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,
CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,
CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,
CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,
CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,
CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,
CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,
CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,
CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,
CVE-2026-46116, CVE-2026-46117, CVE-2026-46120, CVE-2026-46121,
CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46125,
CVE-2026-46126, CVE-2026-46127, CVE-2026-46128, CVE-2026-46129,
CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46136,
CVE-2026-46137, CVE-2026-46138, CVE-2026-46139, CVE-2026-46142,
CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,
CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46152,
CVE-2026-46157, CVE-2026-46159, CVE-2026-46160, CVE-2026-46161,
CVE-2026-46163, CVE-2026-46164, CVE-2026-46167, CVE-2026-46168,
CVE-2026-46169, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,
CVE-2026-46176, CVE-2026-46177, CVE-2026-46178, CVE-2026-46179,
CVE-2026-46180, CVE-2026-46184, CVE-2026-46186, CVE-2026-46187,
CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,
CVE-2026-46194, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198,
CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46204,
CVE-2026-46205, CVE-2026-46206, CVE-2026-46207, CVE-2026-46208,
CVE-2026-46209, CVE-2026-46211, CVE-2026-46212, CVE-2026-46214,
CVE-2026-46218, CVE-2026-46219, CVE-2026-46220, CVE-2026-46225,
CVE-2026-46226, CVE-2026-46227, CVE-2026-46229, CVE-2026-46230,
CVE-2026-46231, CVE-2026-46232, CVE-2026-46233, CVE-2026-46234,
CVE-2026-46235, CVE-2026-46236, CVE-2026-46238, CVE-2026-46241,
CVE-2026-46273, CVE-2026-46274, CVE-2026-46280, CVE-2026-46282,
CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46291,
CVE-2026-46292, CVE-2026-46293, CVE-2026-46294, CVE-2026-46296,
CVE-2026-46299, CVE-2026-46301, CVE-2026-46303, CVE-2026-46304,
CVE-2026-46306, CVE-2026-46307, CVE-2026-46312, CVE-2026-46314,
CVE-2026-46319, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,
CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,
CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,
CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,
CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,
CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,
CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,
CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,
CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,
CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,
CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,
CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,
CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,
CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,
CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,
CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,
CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,
CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,
CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,
CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,
CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,
CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,
CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,
CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,
CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,
CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,
CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,
CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,
CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,
CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,
CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,
CVE-2026-64018, CVE-2026-64034, CVE-2026-64164)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8609-1: Linux kernel (Azure CVM) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691495/unix-server/usn-8609-1-linux-kernel-azure-cvm-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691495/unix-server/usn-8609-1-linux-kernel-azure-cvm-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:37 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacker could
possibly use this issue to influence the values returned by the RDSEED
instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - RISC-V architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Serial ATA and Parallel ATA drivers;
  - ATM drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - RNBD block device driver;
  - Ublk userspace block driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clock framework and drivers;
  - Clocksource drivers;
  - Data acquisition framework and drivers;
  - Counter interface drivers;
  - CPU frequency scaling framework;
  - CPU idle management framework;
  - Hardware crypto device drivers;
  - CXL (Compute Express Link) drivers;
  - DMA engine subsystem;
  - EDAC drivers;
  - EFI core;
  - GPIO subsystem;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO subsystem;
  - IIO ADC drivers;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IOMMU subsystem;
  - IRQ chip drivers;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Multifunction device drivers;
  - Broadcom VK accelerator driver;
  - Fastrpc Driver;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MOST (Media Oriented Systems Transport) drivers;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Ethernet team driver;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - Device tree and open firmware driver;
  - PCI subsystem;
  - Performance monitor drivers;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Generic PM domains;
  - i.MX PM domains;
  - Power supply drivers;
  - RapidIO drivers;
  - RAS (Reliability, Availability, Serviceability) subsystem;
  - Remote Processor subsystem;
  - RPMSG subsystem;
  - S/390 drivers;
  - SCSI subsystem;
  - SLIMbus drivers;
  - Freescale SoC drivers;
  - MediaTek SoC drivers;
  - Microchip PolarFire SoC system controller driver;
  - Texas Instruments SoC drivers;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - ChipIdea USB driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - DesignWare USB3 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - USB Type-C Connector System Software Interface driver;
  - USB over IP driver;
  - vDPA drivers;
  - VFIO drivers;
  - Virtio Host (VHOST) subsystem;
  - Framebuffer layer;
  - TSM TDX Guest driver;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FAT file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - Journaling layer for block devices (JBD2);
  - JFS file system;
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Proc file system;
  - Pstore file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - Audit subsystem;
  - Kernel CPU control infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Memory Management;
  - Integrity Measurement Architecture(IMA) framework;
  - KVM subsystem;
  - Memory management;
  - Networking core;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Tracing infrastructure;
  - Network traffic control;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IPv6 networking;
  - IP tunnels definitions;
  - MAC80211 subsystem;
  - Netfilter;
  - User-space API (UAPI);
  - io_uring subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Perf events;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - Kernel kexec() syscall;
  - KProbes tracing;
  - Locking primitives;
  - Kernel module support;
  - Padata parallel execution mechanism;
  - RCU subsystem;
  - Scheduler infrastructure;
  - Cryptographic library;
  - Scatterlist API;
  - Heterogeneous memory management;
  - KASAN memory debugging framework;
  - 9P file system network protocol;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Bluetooth subsystem;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - KCM (Kernel Connection Multiplexor) sockets driver;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - AppArmor security module;
  - Landlock security;
  - Simplified Mandatory Access Control Kernel framework;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - Samsung ASoC drivers;
  - SoC audio core drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2025-21709, CVE-2025-22116, CVE-2025-38426, CVE-2025-39764,
CVE-2025-40005, CVE-2025-40135, CVE-2025-40150, CVE-2025-68175,
CVE-2025-68239, CVE-2025-68334, CVE-2025-68736, CVE-2025-71152,
CVE-2025-71161, CVE-2025-71203, CVE-2025-71221, CVE-2025-71229,
CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,
CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,
CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71269,
CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286,
CVE-2025-71287, CVE-2025-71288, CVE-2025-71291, CVE-2025-71292,
CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304,
CVE-2025-71305, CVE-2026-22981, CVE-2026-22985, CVE-2026-22993,
CVE-2026-23004, CVE-2026-23066, CVE-2026-23100, CVE-2026-23104,
CVE-2026-23118, CVE-2026-23138, CVE-2026-23154, CVE-2026-23157,
CVE-2026-23169, CVE-2026-23171, CVE-2026-23220, CVE-2026-23221,
CVE-2026-23222, CVE-2026-23226, CVE-2026-23227, CVE-2026-23228,
CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234,
CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238,
CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23244,
CVE-2026-23245, CVE-2026-23246, CVE-2026-23249, CVE-2026-23253,
CVE-2026-23255, CVE-2026-23266, CVE-2026-23267, CVE-2026-23270,
CVE-2026-23271, CVE-2026-23272, CVE-2026-23276, CVE-2026-23277,
CVE-2026-23278, CVE-2026-23279, CVE-2026-23281, CVE-2026-23284,
CVE-2026-23285, CVE-2026-23286, CVE-2026-23287, CVE-2026-23289,
CVE-2026-23290, CVE-2026-23291, CVE-2026-23292, CVE-2026-23293,
CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23302,
CVE-2026-23303, CVE-2026-23304, CVE-2026-23306, CVE-2026-23307,
CVE-2026-23308, CVE-2026-23310, CVE-2026-23312, CVE-2026-23313,
CVE-2026-23315, CVE-2026-23317, CVE-2026-23318, CVE-2026-23319,
CVE-2026-23321, CVE-2026-23324, CVE-2026-23325, CVE-2026-23330,
CVE-2026-23334, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339,
CVE-2026-23340, CVE-2026-23343, CVE-2026-23347, CVE-2026-23352,
CVE-2026-23356, CVE-2026-23357, CVE-2026-23359, CVE-2026-23361,
CVE-2026-23362, CVE-2026-23363, CVE-2026-23364, CVE-2026-23365,
CVE-2026-23367, CVE-2026-23368, CVE-2026-23369, CVE-2026-23370,
CVE-2026-23372, CVE-2026-23374, CVE-2026-23375, CVE-2026-23378,
CVE-2026-23379, CVE-2026-23381, CVE-2026-23382, CVE-2026-23383,
CVE-2026-23386, CVE-2026-23387, CVE-2026-23388, CVE-2026-23389,
CVE-2026-23391, CVE-2026-23392, CVE-2026-23395, CVE-2026-23396,
CVE-2026-23397, CVE-2026-23398, CVE-2026-23399, CVE-2026-23401,
CVE-2026-23412, CVE-2026-23413, CVE-2026-23414, CVE-2026-23418,
CVE-2026-23419, CVE-2026-23420, CVE-2026-23426, CVE-2026-23428,
CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23440,
CVE-2026-23441, CVE-2026-23442, CVE-2026-23444, CVE-2026-23446,
CVE-2026-23447, CVE-2026-23448, CVE-2026-23449, CVE-2026-23450,
CVE-2026-23452, CVE-2026-23454, CVE-2026-23455, CVE-2026-23456,
CVE-2026-23457, CVE-2026-23458, CVE-2026-23460, CVE-2026-23461,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23464, CVE-2026-23465,
CVE-2026-23468, CVE-2026-23470, CVE-2026-23474, CVE-2026-23475,
CVE-2026-31389, CVE-2026-31391, CVE-2026-31392, CVE-2026-31393,
CVE-2026-31394, CVE-2026-31396, CVE-2026-31399, CVE-2026-31400,
CVE-2026-31402, CVE-2026-31403, CVE-2026-31405, CVE-2026-31407,
CVE-2026-31408, CVE-2026-31409, CVE-2026-31411, CVE-2026-31412,
CVE-2026-31414, CVE-2026-31415, CVE-2026-31416, CVE-2026-31417,
CVE-2026-31418, CVE-2026-31421, CVE-2026-31422, CVE-2026-31423,
CVE-2026-31424, CVE-2026-31425, CVE-2026-31426, CVE-2026-31427,
CVE-2026-31428, CVE-2026-31429, CVE-2026-31430, CVE-2026-31432,
CVE-2026-31433, CVE-2026-31436, CVE-2026-31438, CVE-2026-31439,
CVE-2026-31440, CVE-2026-31441, CVE-2026-31446, CVE-2026-31447,
CVE-2026-31448, CVE-2026-31449, CVE-2026-31450, CVE-2026-31451,
CVE-2026-31452, CVE-2026-31453, CVE-2026-31454, CVE-2026-31455,
CVE-2026-31458, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467,
CVE-2026-31469, CVE-2026-31470, CVE-2026-31473, CVE-2026-31474,
CVE-2026-31476, CVE-2026-31477, CVE-2026-31478, CVE-2026-31480,
CVE-2026-31482, CVE-2026-31483, CVE-2026-31485, CVE-2026-31487,
CVE-2026-31488, CVE-2026-31489, CVE-2026-31492, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31496, CVE-2026-31497, CVE-2026-31498,
CVE-2026-31499, CVE-2026-31500, CVE-2026-31502, CVE-2026-31503,
CVE-2026-31505, CVE-2026-31506, CVE-2026-31507, CVE-2026-31508,
CVE-2026-31509, CVE-2026-31510, CVE-2026-31511, CVE-2026-31512,
CVE-2026-31515, CVE-2026-31516, CVE-2026-31518, CVE-2026-31519,
CVE-2026-31520, CVE-2026-31521, CVE-2026-31522, CVE-2026-31523,
CVE-2026-31524, CVE-2026-31525, CVE-2026-31527, CVE-2026-31528,
CVE-2026-31530, CVE-2026-31532, CVE-2026-31540, CVE-2026-31542,
CVE-2026-31545, CVE-2026-31546, CVE-2026-31548, CVE-2026-31549,
CVE-2026-31550, CVE-2026-31551, CVE-2026-31552, CVE-2026-31554,
CVE-2026-31555, CVE-2026-31556, CVE-2026-31557, CVE-2026-31563,
CVE-2026-31565, CVE-2026-31566, CVE-2026-31570, CVE-2026-31575,
CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,
CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,
CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,
CVE-2026-31590, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,
CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,
CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606,
CVE-2026-31607, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612,
CVE-2026-31613, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617,
CVE-2026-31618, CVE-2026-31619, CVE-2026-31622, CVE-2026-31623,
CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627,
CVE-2026-31628, CVE-2026-31629, CVE-2026-31634, CVE-2026-31637,
CVE-2026-31638, CVE-2026-31639, CVE-2026-31642, CVE-2026-31645,
CVE-2026-31646, CVE-2026-31648, CVE-2026-31649, CVE-2026-31651,
CVE-2026-31655, CVE-2026-31656, CVE-2026-31657, CVE-2026-31658,
CVE-2026-31659, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662,
CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31668,
CVE-2026-31669, CVE-2026-31670, CVE-2026-31671, CVE-2026-31672,
CVE-2026-31673, CVE-2026-31674, CVE-2026-31675, CVE-2026-31677,
CVE-2026-31678, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,
CVE-2026-31682, CVE-2026-31683, CVE-2026-31684, CVE-2026-31685,
CVE-2026-31686, CVE-2026-31687, CVE-2026-31689, CVE-2026-31693,
CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,
CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701,
CVE-2026-31702, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706,
CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31711,
CVE-2026-31712, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,
CVE-2026-31720, CVE-2026-31721, CVE-2026-31722, CVE-2026-31723,
CVE-2026-31724, CVE-2026-31725, CVE-2026-31726, CVE-2026-31728,
CVE-2026-31729, CVE-2026-31730, CVE-2026-31731, CVE-2026-31737,
CVE-2026-31738, CVE-2026-31740, CVE-2026-31741, CVE-2026-31747,
CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,
CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,
CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,
CVE-2026-31767, CVE-2026-31768, CVE-2026-31770, CVE-2026-31772,
CVE-2026-31773, CVE-2026-31778, CVE-2026-31779, CVE-2026-31780,
CVE-2026-31781, CVE-2026-31788, CVE-2026-43007, CVE-2026-43011,
CVE-2026-43012, CVE-2026-43013, CVE-2026-43014, CVE-2026-43015,
CVE-2026-43016, CVE-2026-43017, CVE-2026-43018, CVE-2026-43019,
CVE-2026-43020, CVE-2026-43023, CVE-2026-43024, CVE-2026-43025,
CVE-2026-43026, CVE-2026-43027, CVE-2026-43028, CVE-2026-43030,
CVE-2026-43032, CVE-2026-43035, CVE-2026-43036, CVE-2026-43037,
CVE-2026-43038, CVE-2026-43040, CVE-2026-43041, CVE-2026-43043,
CVE-2026-43044, CVE-2026-43046, CVE-2026-43047, CVE-2026-43049,
CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054,
CVE-2026-43056, CVE-2026-43057, CVE-2026-43058, CVE-2026-43059,
CVE-2026-43060, CVE-2026-43061, CVE-2026-43062, CVE-2026-43064,
CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069,
CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43074,
CVE-2026-43075, CVE-2026-43076, CVE-2026-43079, CVE-2026-43080,
CVE-2026-43081, CVE-2026-43082, CVE-2026-43085, CVE-2026-43086,
CVE-2026-43088, CVE-2026-43089, CVE-2026-43091, CVE-2026-43092,
CVE-2026-43093, CVE-2026-43094, CVE-2026-43098, CVE-2026-43099,
CVE-2026-43103, CVE-2026-43104, CVE-2026-43105, CVE-2026-43107,
CVE-2026-43109, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112,
CVE-2026-43113, CVE-2026-43114, CVE-2026-43117, CVE-2026-43119,
CVE-2026-43120, CVE-2026-43123, CVE-2026-43124, CVE-2026-43128,
CVE-2026-43129, CVE-2026-43130, CVE-2026-43132, CVE-2026-43133,
CVE-2026-43134, CVE-2026-43135, CVE-2026-43136, CVE-2026-43137,
CVE-2026-43139, CVE-2026-43140, CVE-2026-43141, CVE-2026-43143,
CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149,
CVE-2026-43150, CVE-2026-43152, CVE-2026-43153, CVE-2026-43156,
CVE-2026-43157, CVE-2026-43158, CVE-2026-43159, CVE-2026-43162,
CVE-2026-43163, CVE-2026-43167, CVE-2026-43168, CVE-2026-43169,
CVE-2026-43170, CVE-2026-43171, CVE-2026-43173, CVE-2026-43175,
CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184,
CVE-2026-43185, CVE-2026-43186, CVE-2026-43187, CVE-2026-43189,
CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43199,
CVE-2026-43200, CVE-2026-43201, CVE-2026-43202, CVE-2026-43203,
CVE-2026-43205, CVE-2026-43206, CVE-2026-43207, CVE-2026-43209,
CVE-2026-43211, CVE-2026-43214, CVE-2026-43215, CVE-2026-43218,
CVE-2026-43221, CVE-2026-43222, CVE-2026-43223, CVE-2026-43225,
CVE-2026-43226, CVE-2026-43227, CVE-2026-43230, CVE-2026-43231,
CVE-2026-43232, CVE-2026-43233, CVE-2026-43236, CVE-2026-43238,
CVE-2026-43239, CVE-2026-43241, CVE-2026-43242, CVE-2026-43244,
CVE-2026-43245, CVE-2026-43246, CVE-2026-43248, CVE-2026-43249,
CVE-2026-43250, CVE-2026-43251, CVE-2026-43252, CVE-2026-43253,
CVE-2026-43255, CVE-2026-43256, CVE-2026-43257, CVE-2026-43261,
CVE-2026-43262, CVE-2026-43264, CVE-2026-43265, CVE-2026-43266,
CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43271,
CVE-2026-43273, CVE-2026-43275, CVE-2026-43277, CVE-2026-43278,
CVE-2026-43279, CVE-2026-43281, CVE-2026-43283, CVE-2026-43287,
CVE-2026-43288, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295,
CVE-2026-43296, CVE-2026-43297, CVE-2026-43300, CVE-2026-43302,
CVE-2026-43304, CVE-2026-43312, CVE-2026-43313, CVE-2026-43314,
CVE-2026-43315, CVE-2026-43316, CVE-2026-43317, CVE-2026-43318,
CVE-2026-43319, CVE-2026-43320, CVE-2026-43324, CVE-2026-43327,
CVE-2026-43328, CVE-2026-43329, CVE-2026-43330, CVE-2026-43332,
CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43338,
CVE-2026-43339, CVE-2026-43340, CVE-2026-43341, CVE-2026-43342,
CVE-2026-43343, CVE-2026-43345, CVE-2026-43350, CVE-2026-43355,
CVE-2026-43357, CVE-2026-43359, CVE-2026-43360, CVE-2026-43361,
CVE-2026-43363, CVE-2026-43365, CVE-2026-43366, CVE-2026-43368,
CVE-2026-43370, CVE-2026-43372, CVE-2026-43373, CVE-2026-43377,
CVE-2026-43378, CVE-2026-43380, CVE-2026-43381, CVE-2026-43382,
CVE-2026-43383, CVE-2026-43384, CVE-2026-43386, CVE-2026-43387,
CVE-2026-43395, CVE-2026-43397, CVE-2026-43405, CVE-2026-43406,
CVE-2026-43407, CVE-2026-43408, CVE-2026-43409, CVE-2026-43411,
CVE-2026-43412, CVE-2026-43413, CVE-2026-43414, CVE-2026-43415,
CVE-2026-43419, CVE-2026-43420, CVE-2026-43421, CVE-2026-43424,
CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,
CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43436,
CVE-2026-43437, CVE-2026-43439, CVE-2026-43441, CVE-2026-43445,
CVE-2026-43448, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,
CVE-2026-43452, CVE-2026-43453, CVE-2026-43455, CVE-2026-43456,
CVE-2026-43457, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,
CVE-2026-43467, CVE-2026-43468, CVE-2026-43469, CVE-2026-43471,
CVE-2026-43472, CVE-2026-43473, CVE-2026-43475, CVE-2026-43476,
CVE-2026-43480, CVE-2026-43483, CVE-2026-43484, CVE-2026-43488,
CVE-2026-43490, CVE-2026-43491, CVE-2026-43492, CVE-2026-43493,
CVE-2026-43495, CVE-2026-43496, CVE-2026-43497, CVE-2026-43499,
CVE-2026-43501, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835,
CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840,
CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844,
CVE-2026-45845, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848,
CVE-2026-45849, CVE-2026-45851, CVE-2026-45852, CVE-2026-45855,
CVE-2026-45856, CVE-2026-45857, CVE-2026-45858, CVE-2026-45859,
CVE-2026-45860, CVE-2026-45861, CVE-2026-45862, CVE-2026-45864,
CVE-2026-45865, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868,
CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45872,
CVE-2026-45873, CVE-2026-45875, CVE-2026-45877, CVE-2026-45878,
CVE-2026-45879, CVE-2026-45880, CVE-2026-45881, CVE-2026-45882,
CVE-2026-45883, CVE-2026-45884, CVE-2026-45885, CVE-2026-45886,
CVE-2026-45890, CVE-2026-45891, CVE-2026-45893, CVE-2026-45895,
CVE-2026-45899, CVE-2026-45902, CVE-2026-45904, CVE-2026-45905,
CVE-2026-45910, CVE-2026-45911, CVE-2026-45912, CVE-2026-45913,
CVE-2026-45914, CVE-2026-45915, CVE-2026-45916, CVE-2026-45917,
CVE-2026-45919, CVE-2026-45920, CVE-2026-45921, CVE-2026-45923,
CVE-2026-45924, CVE-2026-45928, CVE-2026-45935, CVE-2026-45936,
CVE-2026-45938, CVE-2026-45941, CVE-2026-45942, CVE-2026-45943,
CVE-2026-45946, CVE-2026-45947, CVE-2026-45948, CVE-2026-45954,
CVE-2026-45956, CVE-2026-45957, CVE-2026-45958, CVE-2026-45960,
CVE-2026-45962, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968,
CVE-2026-45969, CVE-2026-45970, CVE-2026-45972, CVE-2026-45973,
CVE-2026-45974, CVE-2026-45976, CVE-2026-45978, CVE-2026-45981,
CVE-2026-45982, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985,
CVE-2026-45986, CVE-2026-45987, CVE-2026-45988, CVE-2026-45989,
CVE-2026-45991, CVE-2026-45994, CVE-2026-45996, CVE-2026-45997,
CVE-2026-45999, CVE-2026-46002, CVE-2026-46003, CVE-2026-46004,
CVE-2026-46005, CVE-2026-46006, CVE-2026-46007, CVE-2026-46009,
CVE-2026-46011, CVE-2026-46012, CVE-2026-46015, CVE-2026-46016,
CVE-2026-46018, CVE-2026-46019, CVE-2026-46021, CVE-2026-46022,
CVE-2026-46023, CVE-2026-46024, CVE-2026-46026, CVE-2026-46027,
CVE-2026-46031, CVE-2026-46033, CVE-2026-46037, CVE-2026-46038,
CVE-2026-46040, CVE-2026-46041, CVE-2026-46043, CVE-2026-46044,
CVE-2026-46046, CVE-2026-46047, CVE-2026-46049, CVE-2026-46050,
CVE-2026-46051, CVE-2026-46052, CVE-2026-46053, CVE-2026-46056,
CVE-2026-46058, CVE-2026-46061, CVE-2026-46062, CVE-2026-46063,
CVE-2026-46064, CVE-2026-46065, CVE-2026-46068, CVE-2026-46069,
CVE-2026-46070, CVE-2026-46072, CVE-2026-46073, CVE-2026-46075,
CVE-2026-46076, CVE-2026-46077, CVE-2026-46078, CVE-2026-46079,
CVE-2026-46080, CVE-2026-46082, CVE-2026-46083, CVE-2026-46084,
CVE-2026-46086, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,
CVE-2026-46091, CVE-2026-46092, CVE-2026-46094, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46103,
CVE-2026-46106, CVE-2026-46107, CVE-2026-46108, CVE-2026-46110,
CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,
CVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46119,
CVE-2026-46120, CVE-2026-46121, CVE-2026-46122, CVE-2026-46123,
CVE-2026-46124, CVE-2026-46125, CVE-2026-46126, CVE-2026-46127,
CVE-2026-46128, CVE-2026-46129, CVE-2026-46131, CVE-2026-46132,
CVE-2026-46133, CVE-2026-46135, CVE-2026-46136, CVE-2026-46137,
CVE-2026-46138, CVE-2026-46139, CVE-2026-46142, CVE-2026-46143,
CVE-2026-46144, CVE-2026-46145, CVE-2026-46146, CVE-2026-46149,
CVE-2026-46150, CVE-2026-46151, CVE-2026-46152, CVE-2026-46157,
CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46163,
CVE-2026-46164, CVE-2026-46167, CVE-2026-46168, CVE-2026-46169,
CVE-2026-46172, CVE-2026-46173, CVE-2026-46174, CVE-2026-46176,
CVE-2026-46177, CVE-2026-46178, CVE-2026-46179, CVE-2026-46180,
CVE-2026-46184, CVE-2026-46185, CVE-2026-46186, CVE-2026-46187,
CVE-2026-46189, CVE-2026-46190, CVE-2026-46191, CVE-2026-46193,
CVE-2026-46194, CVE-2026-46195, CVE-2026-46196, CVE-2026-46197,
CVE-2026-46198, CVE-2026-46199, CVE-2026-46200, CVE-2026-46201,
CVE-2026-46204, CVE-2026-46205, CVE-2026-46206, CVE-2026-46207,
CVE-2026-46208, CVE-2026-46209, CVE-2026-46211, CVE-2026-46212,
CVE-2026-46214, CVE-2026-46218, CVE-2026-46219, CVE-2026-46220,
CVE-2026-46225, CVE-2026-46226, CVE-2026-46227, CVE-2026-46229,
CVE-2026-46230, CVE-2026-46231, CVE-2026-46232, CVE-2026-46233,
CVE-2026-46234, CVE-2026-46235, CVE-2026-46236, CVE-2026-46238,
CVE-2026-46241, CVE-2026-46243, CVE-2026-46244, CVE-2026-46246,
CVE-2026-46247, CVE-2026-46249, CVE-2026-46250, CVE-2026-46251,
CVE-2026-46253, CVE-2026-46254, CVE-2026-46255, CVE-2026-46259,
CVE-2026-46260, CVE-2026-46261, CVE-2026-46265, CVE-2026-46266,
CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274,
CVE-2026-46280, CVE-2026-46282, CVE-2026-46285, CVE-2026-46286,
CVE-2026-46287, CVE-2026-46289, CVE-2026-46291, CVE-2026-46292,
CVE-2026-46293, CVE-2026-46294, CVE-2026-46296, CVE-2026-46299,
CVE-2026-46301, CVE-2026-46303, CVE-2026-46304, CVE-2026-46306,
CVE-2026-46307, CVE-2026-46312, CVE-2026-46314, CVE-2026-46319,
CVE-2026-46328, CVE-2026-52911, CVE-2026-52920, CVE-2026-52925,
CVE-2026-52933, CVE-2026-52936, CVE-2026-52951, CVE-2026-52954,
CVE-2026-52955, CVE-2026-52957, CVE-2026-52958, CVE-2026-52961,
CVE-2026-52962, CVE-2026-52963, CVE-2026-52964, CVE-2026-52967,
CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52974,
CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982,
CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989,
CVE-2026-52990, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,
CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,
CVE-2026-53012, CVE-2026-53013, CVE-2026-53014, CVE-2026-53015,
CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,
CVE-2026-53032, CVE-2026-53033, CVE-2026-53034, CVE-2026-53035,
CVE-2026-53036, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,
CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53052, CVE-2026-53056, CVE-2026-53058, CVE-2026-53059,
CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53063,
CVE-2026-53064, CVE-2026-53065, CVE-2026-53066, CVE-2026-53068,
CVE-2026-53069, CVE-2026-53071, CVE-2026-53072, CVE-2026-53073,
CVE-2026-53074, CVE-2026-53075, CVE-2026-53076, CVE-2026-53077,
CVE-2026-53082, CVE-2026-53083, CVE-2026-53084, CVE-2026-53085,
CVE-2026-53086, CVE-2026-53088, CVE-2026-53093, CVE-2026-53094,
CVE-2026-53096, CVE-2026-53097, CVE-2026-53098, CVE-2026-53110,
CVE-2026-53111, CVE-2026-53112, CVE-2026-53115, CVE-2026-53117,
CVE-2026-53122, CVE-2026-53123, CVE-2026-53126, CVE-2026-53128,
CVE-2026-53130, CVE-2026-53279, CVE-2026-53287, CVE-2026-53289,
CVE-2026-53291, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53303, CVE-2026-53304, CVE-2026-53306,
CVE-2026-53309, CVE-2026-53314, CVE-2026-53320, CVE-2026-53369,
CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53379,
CVE-2026-63838, CVE-2026-63843, CVE-2026-63844, CVE-2026-63845,
CVE-2026-63846, CVE-2026-63847, CVE-2026-63848, CVE-2026-63851,
CVE-2026-63852, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,
CVE-2026-63860, CVE-2026-63861, CVE-2026-63862, CVE-2026-63865,
CVE-2026-64018, CVE-2026-64034, CVE-2026-64164)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8575-3: Linux kernel vulnerabilities]]></title>
<description><![CDATA[Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose...]]></description>
<link>https://tsecurity.de/de/3691494/unix-server/usn-8575-3-linux-kernel-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691494/unix-server/usn-8575-3-linux-kernel-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:35 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM32 architecture;
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - ACPI drivers;
  - ATM drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - RNBD block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clocksource drivers;
  - Data acquisition framework and drivers;
  - CPU frequency scaling framework;
  - CPU idle management framework;
  - Hardware crypto device drivers;
  - DMA engine subsystem;
  - Arm Firmware Framework for ARMv8-A(FFA);
  - EFI core;
  - GPIO subsystem;
  - GPU drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO subsystem;
  - IIO ADC drivers;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IOMMU subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Multifunction device drivers;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - PCI subsystem;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Power supply drivers;
  - RapidIO drivers;
  - Remote Processor subsystem;
  - RPMSG subsystem;
  - SCSI subsystem;
  - Freescale SoC drivers;
  - Texas Instruments SoC drivers;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - Framebuffer layer;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FAT file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - JFS file system;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Proc file system;
  - Pstore file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - UDF file system;
  - XFS file system;
  - Audit subsystem;
  - RAS (Reliability, Availability, Serviceability) subsystem;
  - Memory Management;
  - KVM subsystem;
  - Memory management;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Network traffic control;
  - Bluetooth subsystem;
  - MAC80211 subsystem;
  - Netfilter;
  - IP tunnels definitions;
  - Tracing infrastructure;
  - User-space API (UAPI);
  - io_uring subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - Kernel kexec() syscall;
  - Kernel module support;
  - Scheduler infrastructure;
  - Cryptographic library;
  - KASAN memory debugging framework;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - Networking core;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IPv6 networking;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Phonet protocol;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - AppArmor security module;
  - Simplified Mandatory Access Control Kernel framework;
  - ALSA framework;
  - FireWire sound drivers;
  - HD-audio driver;
  - AudioScience HPI driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - SoC audio core drivers;
  - STI ASoC drivers;
  - USB sound devices;
(CVE-2022-49803, CVE-2022-49961, CVE-2022-50073, CVE-2022-50116,
CVE-2022-50552, CVE-2023-52682, CVE-2023-52737, CVE-2023-53545,
CVE-2023-53596, CVE-2023-53629, CVE-2024-27389, CVE-2024-35865,
CVE-2024-36898, CVE-2024-36922, CVE-2024-41079, CVE-2024-46715,
CVE-2024-46770, CVE-2024-47809, CVE-2024-50012, CVE-2024-53221,
CVE-2024-56557, CVE-2024-56584, CVE-2024-56657, CVE-2024-56719,
CVE-2024-56727, CVE-2025-21712, CVE-2025-21739, CVE-2025-21863,
CVE-2025-22107, CVE-2025-23141, CVE-2025-37786, CVE-2025-38006,
CVE-2025-38105, CVE-2025-38192, CVE-2025-38250, CVE-2025-38562,
CVE-2025-38626, CVE-2025-38659, CVE-2025-38710, CVE-2025-39748,
CVE-2025-39764, CVE-2025-40005, CVE-2025-40016, CVE-2025-40103,
CVE-2025-40323, CVE-2025-68206, CVE-2025-68239, CVE-2025-68256,
CVE-2025-68307, CVE-2025-68358, CVE-2025-71150, CVE-2025-71161,
CVE-2025-71221, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,
CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,
CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71274,
CVE-2025-71287, CVE-2025-71292, CVE-2025-71304, CVE-2026-23031,
CVE-2026-23066, CVE-2026-23100, CVE-2026-23113, CVE-2026-23141,
CVE-2026-23157, CVE-2026-23169, CVE-2026-23204, CVE-2026-23220,
CVE-2026-23221, CVE-2026-23222, CVE-2026-23227, CVE-2026-23228,
CVE-2026-23229, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236,
CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242,
CVE-2026-23243, CVE-2026-23253, CVE-2026-23266, CVE-2026-23270,
CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23286,
CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23293,
CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23303,
CVE-2026-23304, CVE-2026-23307, CVE-2026-23312, CVE-2026-23318,
CVE-2026-23324, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339,
CVE-2026-23340, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357,
CVE-2026-23359, CVE-2026-23362, CVE-2026-23365, CVE-2026-23367,
CVE-2026-23368, CVE-2026-23370, CVE-2026-23372, CVE-2026-23379,
CVE-2026-23381, CVE-2026-23382, CVE-2026-23388, CVE-2026-23391,
CVE-2026-23392, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,
CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23420,
CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23442,
CVE-2026-23444, CVE-2026-23446, CVE-2026-23452, CVE-2026-23454,
CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23474, CVE-2026-31393,
CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31405,
CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31411,
CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,
CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,
CVE-2026-31427, CVE-2026-31428, CVE-2026-31433, CVE-2026-31446,
CVE-2026-31447, CVE-2026-31450, CVE-2026-31452, CVE-2026-31454,
CVE-2026-31455, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467,
CVE-2026-31469, CVE-2026-31473, CVE-2026-31476, CVE-2026-31480,
CVE-2026-31483, CVE-2026-31485, CVE-2026-31489, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31497, CVE-2026-31498, CVE-2026-31507,
CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31512,
CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31522,
CVE-2026-31523, CVE-2026-31524, CVE-2026-31532, CVE-2026-31540,
CVE-2026-31545, CVE-2026-31546, CVE-2026-31549, CVE-2026-31550,
CVE-2026-31551, CVE-2026-31552, CVE-2026-31555, CVE-2026-31565,
CVE-2026-31570, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578,
CVE-2026-31580, CVE-2026-31581, CVE-2026-31583, CVE-2026-31585,
CVE-2026-31586, CVE-2026-31588, CVE-2026-31590, CVE-2026-31594,
CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599,
CVE-2026-31602, CVE-2026-31603, CVE-2026-31605, CVE-2026-31615,
CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619,
CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625,
CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629,
CVE-2026-31630, CVE-2026-31634, CVE-2026-31642, CVE-2026-31651,
CVE-2026-31656, CVE-2026-31658, CVE-2026-31660, CVE-2026-31661,
CVE-2026-31662, CVE-2026-31664, CVE-2026-31665, CVE-2026-31667,
CVE-2026-31670, CVE-2026-31671, CVE-2026-31672, CVE-2026-31673,
CVE-2026-31674, CVE-2026-31676, CVE-2026-31679, CVE-2026-31680,
CVE-2026-31681, CVE-2026-31683, CVE-2026-31684, CVE-2026-31686,
CVE-2026-31687, CVE-2026-31694, CVE-2026-31695, CVE-2026-31696,
CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31701,
CVE-2026-31716, CVE-2026-31720, CVE-2026-31721, CVE-2026-31726,
CVE-2026-31728, CVE-2026-31737, CVE-2026-31738, CVE-2026-31747,
CVE-2026-31748, CVE-2026-31749, CVE-2026-31751, CVE-2026-31752,
CVE-2026-31754, CVE-2026-31755, CVE-2026-31756, CVE-2026-31758,
CVE-2026-31759, CVE-2026-31761, CVE-2026-31762, CVE-2026-31763,
CVE-2026-31770, CVE-2026-31773, CVE-2026-31778, CVE-2026-31780,
CVE-2026-31781, CVE-2026-31788, CVE-2026-43014, CVE-2026-43015,
CVE-2026-43020, CVE-2026-43024, CVE-2026-43026, CVE-2026-43027,
CVE-2026-43028, CVE-2026-43030, CVE-2026-43032, CVE-2026-43035,
CVE-2026-43040, CVE-2026-43041, CVE-2026-43043, CVE-2026-43046,
CVE-2026-43047, CVE-2026-43050, CVE-2026-43051, CVE-2026-43052,
CVE-2026-43054, CVE-2026-43058, CVE-2026-43060, CVE-2026-43061,
CVE-2026-43062, CVE-2026-43065, CVE-2026-43066, CVE-2026-43068,
CVE-2026-43069, CVE-2026-43074, CVE-2026-43075, CVE-2026-43076,
CVE-2026-43079, CVE-2026-43080, CVE-2026-43085, CVE-2026-43089,
CVE-2026-43093, CVE-2026-43098, CVE-2026-43099, CVE-2026-43103,
CVE-2026-43104, CVE-2026-43105, CVE-2026-43110, CVE-2026-43111,
CVE-2026-43112, CVE-2026-43113, CVE-2026-43123, CVE-2026-43124,
CVE-2026-43130, CVE-2026-43132, CVE-2026-43133, CVE-2026-43134,
CVE-2026-43135, CVE-2026-43136, CVE-2026-43139, CVE-2026-43140,
CVE-2026-43141, CVE-2026-43145, CVE-2026-43147, CVE-2026-43148,
CVE-2026-43149, CVE-2026-43152, CVE-2026-43156, CVE-2026-43158,
CVE-2026-43159, CVE-2026-43163, CVE-2026-43168, CVE-2026-43171,
CVE-2026-43180, CVE-2026-43182, CVE-2026-43183, CVE-2026-43184,
CVE-2026-43187, CVE-2026-43190, CVE-2026-43194, CVE-2026-43196,
CVE-2026-43200, CVE-2026-43202, CVE-2026-43203, CVE-2026-43205,
CVE-2026-43206, CVE-2026-43207, CVE-2026-43209, CVE-2026-43211,
CVE-2026-43218, CVE-2026-43223, CVE-2026-43225, CVE-2026-43226,
CVE-2026-43227, CVE-2026-43230, CVE-2026-43231, CVE-2026-43232,
CVE-2026-43233, CVE-2026-43236, CVE-2026-43241, CVE-2026-43242,
CVE-2026-43246, CVE-2026-43251, CVE-2026-43255, CVE-2026-43257,
CVE-2026-43261, CVE-2026-43262, CVE-2026-43264, CVE-2026-43266,
CVE-2026-43268, CVE-2026-43269, CVE-2026-43270, CVE-2026-43273,
CVE-2026-43275, CVE-2026-43277, CVE-2026-43279, CVE-2026-43281,
CVE-2026-43283, CVE-2026-43287, CVE-2026-43289, CVE-2026-43291,
CVE-2026-43295, CVE-2026-43296, CVE-2026-43302, CVE-2026-43312,
CVE-2026-43313, CVE-2026-43314, CVE-2026-43315, CVE-2026-43316,
CVE-2026-43324, CVE-2026-43327, CVE-2026-43328, CVE-2026-43329,
CVE-2026-43333, CVE-2026-43334, CVE-2026-43336, CVE-2026-43339,
CVE-2026-43340, CVE-2026-43342, CVE-2026-43343, CVE-2026-43357,
CVE-2026-43363, CVE-2026-43365, CVE-2026-43370, CVE-2026-43373,
CVE-2026-43380, CVE-2026-43381, CVE-2026-43382, CVE-2026-43386,
CVE-2026-43387, CVE-2026-43405, CVE-2026-43411, CVE-2026-43420,
CVE-2026-43425, CVE-2026-43426, CVE-2026-43427, CVE-2026-43428,
CVE-2026-43429, CVE-2026-43430, CVE-2026-43432, CVE-2026-43439,
CVE-2026-43445, CVE-2026-43449, CVE-2026-43450, CVE-2026-43451,
CVE-2026-43452, CVE-2026-43453, CVE-2026-43458, CVE-2026-43459,
CVE-2026-43466, CVE-2026-43469, CVE-2026-43472, CVE-2026-43473,
CVE-2026-43475, CVE-2026-43476, CVE-2026-43480, CVE-2026-43484,
CVE-2026-43496, CVE-2026-43497, CVE-2026-43502, CVE-2026-45834,
CVE-2026-45835, CVE-2026-45836, CVE-2026-45838, CVE-2026-45839,
CVE-2026-45840, CVE-2026-45841, CVE-2026-45842, CVE-2026-45843,
CVE-2026-45844, CVE-2026-45846, CVE-2026-45847, CVE-2026-45848,
CVE-2026-45852, CVE-2026-45856, CVE-2026-45857, CVE-2026-45860,
CVE-2026-45862, CVE-2026-45864, CVE-2026-45866, CVE-2026-45867,
CVE-2026-45868, CVE-2026-45869, CVE-2026-45870, CVE-2026-45871,
CVE-2026-45873, CVE-2026-45875, CVE-2026-45879, CVE-2026-45883,
CVE-2026-45885, CVE-2026-45890, CVE-2026-45891, CVE-2026-45899,
CVE-2026-45902, CVE-2026-45904, CVE-2026-45911, CVE-2026-45912,
CVE-2026-45915, CVE-2026-45916, CVE-2026-45919, CVE-2026-45920,
CVE-2026-45924, CVE-2026-45935, CVE-2026-45936, CVE-2026-45941,
CVE-2026-45946, CVE-2026-45948, CVE-2026-45954, CVE-2026-45956,
CVE-2026-45958, CVE-2026-45960, CVE-2026-45964, CVE-2026-45965,
CVE-2026-45968, CVE-2026-45969, CVE-2026-45970, CVE-2026-45974,
CVE-2026-45978, CVE-2026-45983, CVE-2026-45984, CVE-2026-45985,
CVE-2026-45986, CVE-2026-45987, CVE-2026-45994, CVE-2026-46002,
CVE-2026-46004, CVE-2026-46006, CVE-2026-46009, CVE-2026-46015,
CVE-2026-46018, CVE-2026-46019, CVE-2026-46022, CVE-2026-46023,
CVE-2026-46024, CVE-2026-46027, CVE-2026-46033, CVE-2026-46037,
CVE-2026-46040, CVE-2026-46044, CVE-2026-46046, CVE-2026-46047,
CVE-2026-46049, CVE-2026-46050, CVE-2026-46051, CVE-2026-46053,
CVE-2026-46062, CVE-2026-46064, CVE-2026-46070, CVE-2026-46072,
CVE-2026-46077, CVE-2026-46080, CVE-2026-46082, CVE-2026-46088,
CVE-2026-46098, CVE-2026-46099, CVE-2026-46101, CVE-2026-46102,
CVE-2026-46107, CVE-2026-46108, CVE-2026-46112, CVE-2026-46120,
CVE-2026-46122, CVE-2026-46123, CVE-2026-46124, CVE-2026-46127,
CVE-2026-46128, CVE-2026-46132, CVE-2026-46133, CVE-2026-46137,
CVE-2026-46146, CVE-2026-46149, CVE-2026-46150, CVE-2026-46151,
CVE-2026-46161, CVE-2026-46163, CVE-2026-46167, CVE-2026-46168,
CVE-2026-46172, CVE-2026-46174, CVE-2026-46177, CVE-2026-46178,
CVE-2026-46184, CVE-2026-46186, CVE-2026-46187, CVE-2026-46189,
CVE-2026-46197, CVE-2026-46198, CVE-2026-46205, CVE-2026-46206,
CVE-2026-46209, CVE-2026-46212, CVE-2026-46214, CVE-2026-46219,
CVE-2026-46220, CVE-2026-46227, CVE-2026-46230, CVE-2026-46231,
CVE-2026-46233, CVE-2026-46234, CVE-2026-46236, CVE-2026-46238,
CVE-2026-46249, CVE-2026-46250, CVE-2026-46253, CVE-2026-46259,
CVE-2026-46267, CVE-2026-46270, CVE-2026-46273, CVE-2026-46274,
CVE-2026-46275, CVE-2026-46285, CVE-2026-46294, CVE-2026-46301,
CVE-2026-46303, CVE-2026-46304, CVE-2026-46307, CVE-2026-46319,
CVE-2026-46328, CVE-2026-52911, CVE-2026-52912, CVE-2026-52914,
CVE-2026-52915, CVE-2026-52916, CVE-2026-52919, CVE-2026-52920,
CVE-2026-52921, CVE-2026-52922, CVE-2026-52925, CVE-2026-52926,
CVE-2026-52931, CVE-2026-52954, CVE-2026-52955, CVE-2026-52957,
CVE-2026-52958, CVE-2026-52962, CVE-2026-52963, CVE-2026-52969,
CVE-2026-52970, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985,
CVE-2026-52986, CVE-2026-52992, CVE-2026-52993, CVE-2026-52995,
CVE-2026-52998, CVE-2026-52999, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53006, CVE-2026-53011,
CVE-2026-53012, CVE-2026-53016, CVE-2026-53021, CVE-2026-53022,
CVE-2026-53023, CVE-2026-53037, CVE-2026-53039, CVE-2026-53040,
CVE-2026-53041, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062,
CVE-2026-53064, CVE-2026-53065, CVE-2026-53068, CVE-2026-53069,
CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074,
CVE-2026-53075, CVE-2026-53077, CVE-2026-53082, CVE-2026-53088,
CVE-2026-53093, CVE-2026-53096, CVE-2026-53112, CVE-2026-53128,
CVE-2026-53130, CVE-2026-53287, CVE-2026-53291, CVE-2026-53294,
CVE-2026-53295, CVE-2026-53296, CVE-2026-53304, CVE-2026-53306,
CVE-2026-53309, CVE-2026-53320, CVE-2026-53369, CVE-2026-53379,
CVE-2026-63860, CVE-2026-63865, CVE-2026-64018, CVE-2026-64032,
CVE-2026-64033, CVE-2026-64034, CVE-2026-64039, CVE-2026-64046,
CVE-2026-64047, CVE-2026-64055, CVE-2026-64056, CVE-2026-64083,
CVE-2026-64084, CVE-2026-64085, CVE-2026-64086, CVE-2026-64087,
CVE-2026-64088, CVE-2026-64089, CVE-2026-64096, CVE-2026-64102,
CVE-2026-64103, CVE-2026-64113, CVE-2026-64114, CVE-2026-64115,
CVE-2026-64125, CVE-2026-64133, CVE-2026-64135, CVE-2026-64153,
CVE-2026-64155, CVE-2026-64164, CVE-2026-64165, CVE-2026-64166,
CVE-2026-64168, CVE-2026-64173, CVE-2026-64174, CVE-2026-64177,
CVE-2026-64178, CVE-2026-64179, CVE-2026-64185)]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8610-1: Linux kernel (Azure CVM) vulnerabilities]]></title>
<description><![CDATA[Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose...]]></description>
<link>https://tsecurity.de/de/3691493/unix-server/usn-8610-1-linux-kernel-azure-cvm-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691493/unix-server/usn-8610-1-linux-kernel-azure-cvm-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:17:33 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Maxim Suhanov discovered that the NTFS file system implementation in the
Linux kernel did not properly validate file name length in certain
situations, leading to an out-of-bounds read. An attacker could use this to
construct a malicious NTFS image that, when mounted and operated on, could
expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - ARM32 architecture;
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - S390 architecture;
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - ACPI drivers;
  - ATM drivers;
  - Drivers core;
  - Power management core;
  - DRBD Distributed Replicated Block Device drivers;
  - RNBD block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clocksource drivers;
  - Data acquisition framework and drivers;
  - CPU frequency scaling framework;
  - CPU idle management framework;
  - Hardware crypto device drivers;
  - DMA engine subsystem;
  - Arm Firmware Framework for ARMv8-A(FFA);
  - EFI core;
  - GPIO subsystem;
  - GPU drivers;
  - HID subsystem;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - IIO subsystem;
  - IIO ADC drivers;
  - InfiniBand drivers;
  - Input Device (Miscellaneous) drivers;
  - IOMMU subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - MediaTek SMI driver;
  - NVIDIA Tegra memory controller driver;
  - Multifunction device drivers;
  - IBM Advanced System Management driver;
  - MMC subsystem;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - MediaTek network drivers;
  - Near Field Communication (NFC) drivers;
  - NTB driver;
  - NVDIMM (Non-Volatile Memory Device) drivers;
  - NVME drivers;
  - PCI subsystem;
  - Pin controllers subsystem;
  - x86 platform drivers;
  - Broadcom BCM2835 power domain driver;
  - Power supply drivers;
  - RapidIO drivers;
  - Remote Processor subsystem;
  - RPMSG subsystem;
  - SCSI subsystem;
  - Freescale SoC drivers;
  - Texas Instruments SoC drivers;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - TTY drivers;
  - UFS subsystem;
  - Cadence USB3 driver;
  - USB Device Class drivers;
  - ULPI bus;
  - USB core drivers;
  - DesignWare USB2 driver;
  - USB Gadget drivers;
  - USB Host Controller drivers;
  - Mustek MDC800 USB digital camera driver;
  - USB YUREX driver;
  - Renesas USBHS Controller drivers;
  - Framebuffer layer;
  - Xen hypervisor drivers;
  - File systems infrastructure;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FAT file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - JFS file system;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Proc file system;
  - Pstore file system;
  - Diskquota system;
  - SMB network file system;
  - SquashFS file system;
  - UDF file system;
  - XFS file system;
  - Audit subsystem;
  - RAS (Reliability, Availability, Serviceability) subsystem;
  - Memory Management;
  - KVM subsystem;
  - Memory management;
  - PPP protocol drivers and compressors;
  - Linux Security Modules (LSM) Framework;
  - Network traffic control;
  - Bluetooth subsystem;
  - MAC80211 subsystem;
  - Netfilter;
  - IP tunnels definitions;
  - Tracing infrastructure;
  - User-space API (UAPI);
  - io_uring subsystem;
  - BPF subsystem;
  - Control group (cgroup);
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - Kernel kexec() syscall;
  - Kernel module support;
  - Scheduler infrastructure;
  - Cryptographic library;
  - KASAN memory debugging framework;
  - Asynchronous Transfer Mode (ATM) subsystem;
  - B.A.T.M.A.N. meshing protocol;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - Networking core;
  - Distributed Switch Architecture;
  - IPv4 networking;
  - IPv6 networking;
  - XFRM subsystem;
  - L2TP protocol;
  - Management Component Transport Protocol (MCTP);
  - Multipath TCP;
  - NCSI (Network Controller Sideband Interface) driver;
  - NFC subsystem;
  - Open vSwitch;
  - Phonet protocol;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RF switch subsystem;
  - Rose network layer;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - Sun RPC protocol;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - X.25 network layer;
  - eXpress Data Path;
  - AppArmor security module;
  - Simplified Mandatory Access Control Kernel framework;
  - ALSA framework;
  - FireWire sound drivers;
  - HD-audio driver;
  - AudioScience HPI driver;
  - Creative Sound Blaster X-Fi driver;
  - AMD SoC Alsa drivers;
  - SoC audio core drivers;
  - STI ASoC drivers;
  - USB sound devices;
(CVE-2022-49803, CVE-2022-49961, CVE-2022-50073, CVE-2022-50116,
CVE-2022-50552, CVE-2023-52682, CVE-2023-52737, CVE-2023-53545,
CVE-2023-53596, CVE-2023-53629, CVE-2024-27389, CVE-2024-35865,
CVE-2024-36898, CVE-2024-36922, CVE-2024-41079, CVE-2024-46715,
CVE-2024-46770, CVE-2024-47809, CVE-2024-50012, CVE-2024-53221,
CVE-2024-56557, CVE-2024-56584, CVE-2024-56657, CVE-2024-56719,
CVE-2024-56727, CVE-2025-21712, CVE-2025-21739, CVE-2025-21863,
CVE-2025-22107, CVE-2025-23141, CVE-2025-37786, CVE-2025-38006,
CVE-2025-38105, CVE-2025-38192, CVE-2025-38250, CVE-2025-38562,
CVE-2025-38626, CVE-2025-38659, CVE-2025-38710, CVE-2025-39748,
CVE-2025-39764, CVE-2025-40005, CVE-2025-40016, CVE-2025-40103,
CVE-2025-40323, CVE-2025-68206, CVE-2025-68239, CVE-2025-68256,
CVE-2025-68307, CVE-2025-68358, CVE-2025-71150, CVE-2025-71161,
CVE-2025-71221, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235,
CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239,
CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71274,
CVE-2025-71287, CVE-2025-71292, CVE-2025-71304, CVE-2026-23031,
CVE-2026-23066, CVE-2026-23100, CVE-2026-23113, CVE-2026-23141,
CVE-2026-23157, CVE-2026-23169, CVE-2026-23204, CVE-2026-23220,
CVE-2026-23221, CVE-2026-23222, CVE-2026-23227, CVE-2026-23228,
CVE-2026-23229, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236,
CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242,
CVE-2026-23243, CVE-2026-23253, CVE-2026-23266, CVE-2026-23270,
CVE-2026-23277, CVE-2026-23279, CVE-2026-23281, CVE-2026-23286,
CVE-2026-23289, CVE-2026-23290, CVE-2026-23291, CVE-2026-23293,
CVE-2026-23296, CVE-2026-23298, CVE-2026-23300, CVE-2026-23303,
CVE-2026-23304, CVE-2026-23307, CVE-2026-23312, CVE-2026-23318,
CVE-2026-23324, CVE-2026-23335, CVE-2026-23336, CVE-2026-23339,
CVE-2026-23340, CVE-2026-23352, CVE-2026-23356, CVE-2026-23357,
CVE-2026-23359, CVE-2026-23362, CVE-2026-23365, CVE-2026-23367,
CVE-2026-23368, CVE-2026-23370, CVE-2026-23372, CVE-2026-23379,
CVE-2026-23381, CVE-2026-23382, CVE-2026-23388, CVE-2026-23391,
CVE-2026-23392, CVE-2026-23395, CVE-2026-23396, CVE-2026-23397,
CVE-2026-23398, CVE-2026-23399, CVE-2026-23401, CVE-2026-23420,
CVE-2026-23434, CVE-2026-23438, CVE-2026-23439, CVE-2026-23442,
CVE-2026-23444, CVE-2026-23446, CVE-2026-23452, CVE-2026-23454,
CVE-2026-23456, CVE-2026-23457, CVE-2026-23458, CVE-2026-23460,
CVE-2026-23462, CVE-2026-23463, CVE-2026-23474, CVE-2026-31393,
CVE-2026-31396, CVE-2026-31399, CVE-2026-31400, CVE-2026-31405,
CVE-2026-31407, CVE-2026-31408, CVE-2026-31409, CVE-2026-31411,
CVE-2026-31415, CVE-2026-31416, CVE-2026-31417, CVE-2026-31421,
CVE-2026-31422, CVE-2026-31423, CVE-2026-31424, CVE-2026-31425,
CVE-2026-31427, CVE-2026-31428, CVE-2026-31433, CVE-2026-31446,
CVE-2026-31447, CVE-2026-31450, CVE-2026-31452, CVE-2026-31454,
CVE-2026-31455, CVE-2026-31464, CVE-2026-31466, CVE-2026-31467,
CVE-2026-31469, CVE-2026-31473, CVE-2026-31476, CVE-2026-31480,
CVE-2026-31483, CVE-2026-31485, CVE-2026-31489, CVE-2026-31494,
CVE-2026-31495, CVE-2026-31497, CVE-2026-31498, CVE-2026-31507,
CVE-2026-31508, CVE-2026-31509, CVE-2026-31510, CVE-2026-31512,
CVE-2026-31515, CVE-2026-31518, CVE-2026-31521, CVE-2026-31522,
CVE-2026-31523, CVE-2026-31524, CVE-2026-31532, CVE-2026-31540,
CVE-2026-31545, CVE-2026-31546, CVE-2026-31549, CVE-2026-31550,
CVE-2026-31551, CVE-2026-31555, CVE-2026-31565, CVE-2026-31570,
CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31580,
CVE-2026-31581, CVE-2026-31583, CVE-2026-31585, CVE-2026-31586,
CVE-2026-31588, CVE-2026-31590, CVE-2026-31594, CVE-2026-31596,
CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31602,
CVE-2026-31603, CVE-2026-31605, CVE-2026-31615, CVE-2026-31616,
CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31622,
CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626,
CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31630,
CVE-2026-31634, CVE-2026-31642, CVE-2026-31651, CVE-2026-31656,
CVE-2026-31658, CVE-2026-31660, CVE-2026-31661, CVE-2026-31662,
CVE-2026-31664, CVE-2026-31665, CVE-2026-31667, CVE-2026-31670,
CVE-2026-31671, CVE-2026-31672, CVE-2026-31673, CVE-2026-31674,
CVE-2026-31676, CVE-2026-31679, CVE-2026-31680, CVE-2026-31681,
CVE-2026-31683, CVE-2026-31684, CVE-2026-31686, CVE-2026-31687,
CVE-2026-31694, CVE-2026-31695, CVE-2026-31696, CVE-2026-31697,
CVE-2026-31698, CVE-2026-31699, CVE-2026-31701, CVE-2026-31716,
CVE-2026-31720, CVE-2026-31721, CVE-2026-31726, CVE-2026-31728,
CVE-2026-31737, CVE-2026-31738, CVE-2026-31747, CVE-2026-31748,
CVE-2026-31749, CVE-2026-31751, CVE-2026-31752, CVE-2026-31754,
CVE-2026-31755, CVE-2026-31756, CVE-2026-31758, CVE-2026-31759,
CVE-2026-31761, CVE-2026-31762, CVE-2026-31763, CVE-2026-31770,
CVE-2026-31773, CVE-2026-31778, CVE-2026-31780, CVE-2026-31781,
CVE-2026-31788, CVE-2026-43014, CVE-2026-43015, CVE-2026-43020,
CVE-2026-43024, CVE-2026-43026, CVE-2026-43027, CVE-2026-43028,
CVE-2026-43030, CVE-2026-43032, CVE-2026-43035, CVE-2026-43040,
CVE-2026-43041, CVE-2026-43043, CVE-2026-43046, CVE-2026-43047,
CVE-2026-43050, CVE-2026-43051, CVE-2026-43052, CVE-2026-43054,
CVE-2026-43058, CVE-2026-43060, CVE-2026-43061, CVE-2026-43062,
CVE-2026-43065, CVE-2026-43066, CVE-2026-43068, CVE-2026-43069,
CVE-2026-43074, CVE-2026-43075, CVE-2026-43076, CVE-2026-43079,
CVE-2026-43080, CVE-2026-43085, CVE-2026-43089, CVE-2026-43093,
CVE-2026-43098, CVE-2026-43099, CVE-2026-43103, CVE-2026-43104,
CVE-2026-43105, CVE-2026-43110, CVE-2026-43111, CVE-2026-43112,
CVE-2026-43113, CVE-2026-43123, CVE-2026-43124, CVE-2026-43130,
CVE-2026-43132, CVE-2026-43133, CVE-2026-43134, CVE-2026-43135,
CVE-2026-43136, CVE-2026-43139, CVE-2026-43140, CVE-2026-43141,
CVE-2026-43145, CVE-2026-43147, CVE-2026-43148, CVE-2026-43149,
CVE-2026-43152, CVE-2026-43156, CVE-2026-43158, CVE-2026-43159,
CVE-2026-43163, CVE-2026-43168, CVE-2026-43171, CVE-2026-43180,
CVE-2026-43182, CVE-2026-43183, CVE-2026-43184, CVE-2026-43187,
CVE-2026-43190, CVE-2026-43194, CVE-2026-43196, CVE-2026-43200,
CVE-2026-43202, CVE-2026-43203, CVE-2026-43205, CVE-2026-43206,
CVE-2026-43207, CVE-2026-43209, CVE-2026-43211, CVE-2026-43218,
CVE-2026-43223, CVE-2026-43225, CVE-2026-43226, CVE-2026-43227,
CVE-2026-43230, CVE-2026-43231, CVE-2026-43232, CVE-2026-43233,
CVE-2026-43236, CVE-2026-43241, CVE-2026-43242, CVE-2026-43246,
CVE-2026-43251, CVE-2026-43255, CVE-2026-43257, CVE-2026-43261,
CVE-2026-43262, CVE-2026-43264, CVE-2026-43266, CVE-2026-43268,
CVE-2026-43269, CVE-2026-43270, CVE-2026-43273, CVE-2026-43275,
CVE-2026-43277, CVE-2026-43279, CVE-2026-43281, CVE-2026-43283,
CVE-2026-43287, CVE-2026-43289, CVE-2026-43291, CVE-2026-43295,
CVE-2026-43296, CVE-2026-43302, CVE-2026-43312, CVE-2026-43313,
CVE-2026-43314, CVE-2026-43315, CVE-2026-43316, CVE-2026-43324,
CVE-2026-43327, CVE-2026-43328, CVE-2026-43329, CVE-2026-43333,
CVE-2026-43334, CVE-2026-43336, CVE-2026-43339, CVE-2026-43340,
CVE-2026-43342, CVE-2026-43343, CVE-2026-43357, CVE-2026-43363,
CVE-2026-43365, CVE-2026-43370, CVE-2026-43373, CVE-2026-43380,
CVE-2026-43381, CVE-2026-43382, CVE-2026-43386, CVE-2026-43387,
CVE-2026-43405, CVE-2026-43411, CVE-2026-43420, CVE-2026-43425,
CVE-2026-43426, CVE-2026-43427, CVE-2026-43428, CVE-2026-43429,
CVE-2026-43430, CVE-2026-43432, CVE-2026-43439, CVE-2026-43445,
CVE-2026-43449, CVE-2026-43450, CVE-2026-43451, CVE-2026-43452,
CVE-2026-43453, CVE-2026-43458, CVE-2026-43459, CVE-2026-43466,
CVE-2026-43469, CVE-2026-43472, CVE-2026-43473, CVE-2026-43475,
CVE-2026-43476, CVE-2026-43480, CVE-2026-43484, CVE-2026-43496,
CVE-2026-43497, CVE-2026-43502, CVE-2026-45834, CVE-2026-45835,
CVE-2026-45836, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840,
CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844,
CVE-2026-45846, CVE-2026-45847, CVE-2026-45848, CVE-2026-45852,
CVE-2026-45856, CVE-2026-45857, CVE-2026-45860, CVE-2026-45862,
CVE-2026-45864, CVE-2026-45866, CVE-2026-45867, CVE-2026-45868,
CVE-2026-45869, CVE-2026-45870, CVE-2026-45871, CVE-2026-45873,
CVE-2026-45875, CVE-2026-45879, CVE-2026-45883, CVE-2026-45885,
CVE-2026-45890, CVE-2026-45891, CVE-2026-45899, CVE-2026-45902,
CVE-2026-45904, CVE-2026-45911, CVE-2026-45912, CVE-2026-45915,
CVE-2026-45916, CVE-2026-45919, CVE-2026-45920, CVE-2026-45924,
CVE-2026-45935, CVE-2026-45936, CVE-2026-45941, CVE-2026-45946,
CVE-2026-45948, CVE-2026-45954, CVE-2026-45956, CVE-2026-45958,
CVE-2026-45960, CVE-2026-45964, CVE-2026-45965, CVE-2026-45968,
CVE-2026-45969, CVE-2026-45970, CVE-2026-45974, CVE-2026-45978,
CVE-2026-45983, CVE-2026-45984, CVE-2026-45985, CVE-2026-45986,
CVE-2026-45987, CVE-2026-45994, CVE-2026-46002, CVE-2026-46004,
CVE-2026-46006, CVE-2026-46009, CVE-2026-46015, CVE-2026-46018,
CVE-2026-46019, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024,
CVE-2026-46027, CVE-2026-46033, CVE-2026-46037, CVE-2026-46040,
CVE-2026-46044, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049,
CVE-2026-46050, CVE-2026-46051, CVE-2026-46053, CVE-2026-46062,
CVE-2026-46064, CVE-2026-46070, CVE-2026-46072, CVE-2026-46077,
CVE-2026-46080, CVE-2026-46082, CVE-2026-46088, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46101, CVE-2026-46102, CVE-2026-46107,
CVE-2026-46108, CVE-2026-46112, CVE-2026-46120, CVE-2026-46122,
CVE-2026-46123, CVE-2026-46124, CVE-2026-46127, CVE-2026-46128,
CVE-2026-46132, CVE-2026-46133, CVE-2026-46137, CVE-2026-46146,
CVE-2026-46149, CVE-2026-46150, CVE-2026-46151, CVE-2026-46161,
CVE-2026-46163, CVE-2026-46167, CVE-2026-46168, CVE-2026-46172,
CVE-2026-46174, CVE-2026-46177, CVE-2026-46178, CVE-2026-46184,
CVE-2026-46186, CVE-2026-46187, CVE-2026-46189, CVE-2026-46197,
CVE-2026-46198, CVE-2026-46205, CVE-2026-46206, CVE-2026-46209,
CVE-2026-46212, CVE-2026-46214, CVE-2026-46219, CVE-2026-46220,
CVE-2026-46227, CVE-2026-46230, CVE-2026-46231, CVE-2026-46233,
CVE-2026-46234, CVE-2026-46236, CVE-2026-46238, CVE-2026-46249,
CVE-2026-46250, CVE-2026-46253, CVE-2026-46259, CVE-2026-46267,
CVE-2026-46270, CVE-2026-46273, CVE-2026-46274, CVE-2026-46275,
CVE-2026-46285, CVE-2026-46294, CVE-2026-46301, CVE-2026-46303,
CVE-2026-46304, CVE-2026-46307, CVE-2026-46319, CVE-2026-46328,
CVE-2026-52911, CVE-2026-52912, CVE-2026-52914, CVE-2026-52915,
CVE-2026-52916, CVE-2026-52919, CVE-2026-52920, CVE-2026-52921,
CVE-2026-52922, CVE-2026-52925, CVE-2026-52926, CVE-2026-52931,
CVE-2026-52954, CVE-2026-52955, CVE-2026-52957, CVE-2026-52958,
CVE-2026-52962, CVE-2026-52963, CVE-2026-52969, CVE-2026-52970,
CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986,
CVE-2026-52992, CVE-2026-52993, CVE-2026-52995, CVE-2026-52998,
CVE-2026-52999, CVE-2026-53001, CVE-2026-53002, CVE-2026-53003,
CVE-2026-53004, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012,
CVE-2026-53016, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023,
CVE-2026-53037, CVE-2026-53039, CVE-2026-53040, CVE-2026-53041,
CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53047,
CVE-2026-53048, CVE-2026-53049, CVE-2026-53050, CVE-2026-53059,
CVE-2026-53060, CVE-2026-53061, CVE-2026-53062, CVE-2026-53064,
CVE-2026-53065, CVE-2026-53068, CVE-2026-53069, CVE-2026-53071,
CVE-2026-53072, CVE-2026-53073, CVE-2026-53074, CVE-2026-53075,
CVE-2026-53077, CVE-2026-53082, CVE-2026-53088, CVE-2026-53093,
CVE-2026-53096, CVE-2026-53112, CVE-2026-53128, CVE-2026-53130,
CVE-2026-53287, CVE-2026-53291, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53304, CVE-2026-53306, CVE-2026-53309,
CVE-2026-53320, CVE-2026-53369, CVE-2026-53379, CVE-2026-63860,
CVE-2026-63865, CVE-2026-64018, CVE-2026-64032, CVE-2026-64033,
CVE-2026-64034, CVE-2026-64039, CVE-2026-64046, CVE-2026-64047,
CVE-2026-64055, CVE-2026-64056, CVE-2026-64083, CVE-2026-64084,
CVE-2026-64085, CVE-2026-64086, CVE-2026-64087, CVE-2026-64088,
CVE-2026-64089, CVE-2026-64096, CVE-2026-64102, CVE-2026-64103,
CVE-2026-64113, CVE-2026-64114, CVE-2026-64115, CVE-2026-64125,
CVE-2026-64133, CVE-2026-64135, CVE-2026-64153, CVE-2026-64155,
CVE-2026-64164, CVE-2026-64165, CVE-2026-64166, CVE-2026-64168,
CVE-2026-64173, CVE-2026-64174, CVE-2026-64177, CVE-2026-64178,
CVE-2026-64179, CVE-2026-64185)]]></content:encoded>
</item>
<item>
<title><![CDATA[SectopRAT Gives Attackers Remote Access to Passwords, Credit Cards, Cookies and Corporate Files]]></title>
<description><![CDATA[SectopRAT is at the center of a highly targeted malvertising campaign abusing Anthropic’s Claude platform to deliver a stealthy, HVNC‑enabled RAT that gives attackers deep, persistent access to victims’ passwords, credit cards, cookies and corporate files. The artifact masqueraded as a genuine Cl...]]></description>
<link>https://tsecurity.de/de/3691482/it-security-nachrichten/sectoprat-gives-attackers-remote-access-to-passwords-credit-cards-cookies-and-corporate-files/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691482/it-security-nachrichten/sectoprat-gives-attackers-remote-access-to-passwords-credit-cards-cookies-and-corporate-files/</guid>
<pubDate>Fri, 24 Jul 2026 14:10:41 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>SectopRAT is at the center of a highly targeted malvertising campaign abusing Anthropic’s Claude platform to deliver a stealthy, HVNC‑enabled RAT that gives attackers deep, persistent access to victims’ passwords, credit cards, cookies and corporate files. The artifact masqueraded as a genuine Claude Desktop installer but redirected victims to claude.ai.download-app[.]us and then to downloading-api.it[.]com/html/claude/win, where […]</p>
<p>The post <a href="https://gbhackers.com/sectoprat-campaign/">SectopRAT Gives Attackers Remote Access to Passwords, Credit Cards, Cookies and Corporate Files</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Apache Syncope Release Patches for Multiple RCE and SQL Injection Vulnerabilities]]></title>
<description><![CDATA[Apache has issued critical security updates for its Syncope identity and access management (IAM) platform to address multiple vulnerabilities, including remote code execution (RCE), SQL injection, privilege escalation, server-side request forgery (SSRF), and information disclosure. These flaws af...]]></description>
<link>https://tsecurity.de/de/3691480/it-security-nachrichten/apache-syncope-release-patches-for-multiple-rce-and-sql-injection-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691480/it-security-nachrichten/apache-syncope-release-patches-for-multiple-rce-and-sql-injection-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 14:10:38 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Apache has issued critical security updates for its Syncope identity and access management (IAM) platform to address multiple vulnerabilities, including remote code execution (RCE), SQL injection, privilege escalation, server-side request forgery (SSRF), and information disclosure. These flaws affect various versions of Syncope, and administrators are strongly urged to upgrade promptly to the latest secure releases. […]</p>
<p>The post <a href="https://cybersecuritynews.com/apache-syncope-release-patches/">Apache Syncope Release Patches for Multiple RCE and SQL Injection Vulnerabilities</a> appeared first on <a href="https://cybersecuritynews.com/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[SectopRAT Gives Attackers Remote Access to Passwords, Credit Cards, Cookies and Corporate Files]]></title>
<description><![CDATA[SectopRAT is at the center of a highly targeted malvertising campaign abusing Anthropic’s Claude platform to deliver a stealthy, HVNC‑enabled RAT that gives attackers deep, persistent access to victims’ passwords, credit cards, cookies and corporate files. The artifact masqueraded as…
Read more →...]]></description>
<link>https://tsecurity.de/de/3691474/it-security-nachrichten/sectoprat-gives-attackers-remote-access-to-passwords-credit-cards-cookies-and-corporate-files/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691474/it-security-nachrichten/sectoprat-gives-attackers-remote-access-to-passwords-credit-cards-cookies-and-corporate-files/</guid>
<pubDate>Fri, 24 Jul 2026 14:10:28 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>SectopRAT is at the center of a highly targeted malvertising campaign abusing Anthropic’s Claude platform to deliver a stealthy, HVNC‑enabled RAT that gives attackers deep, persistent access to victims’ passwords, credit cards, cookies and corporate files. The artifact masqueraded as…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/sectoprat-gives-attackers-remote-access-to-passwords-credit-cards-cookies-and-corporate-files/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/sectoprat-gives-attackers-remote-access-to-passwords-credit-cards-cookies-and-corporate-files/">SectopRAT Gives Attackers Remote Access to Passwords, Credit Cards, Cookies and Corporate Files</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[TikTok’s protection of minors should not be opt-in, warns EU]]></title>
<description><![CDATA[TikTok has attracted the ire of the European Union over its protection of children who use the video sharing platform. The European Commission announced preliminary findings today under the Digital Services Act (DSA) that offer specific issues to address. The Commission suggests that TikTok shoul...]]></description>
<link>https://tsecurity.de/de/3691456/it-nachrichten/tiktoks-protection-of-minors-should-not-be-opt-in-warns-eu/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691456/it-nachrichten/tiktoks-protection-of-minors-should-not-be-opt-in-warns-eu/</guid>
<pubDate>Fri, 24 Jul 2026 14:04:52 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[TikTok has attracted the ire of the European Union over its protection of children who use the video sharing platform. The European Commission announced preliminary findings today under the Digital Services Act (DSA) that offer specific issues to address. The Commission suggests that TikTok should adjust the default settings of minors' "public" accounts so the […]]]></content:encoded>
</item>
<item>
<title><![CDATA[Meta launches a storefront platform through Facebook Marketplace]]></title>
<description><![CDATA[Facebook has introduced an app called Seller that effectively professionalizes Facebook Marketplace.]]></description>
<link>https://tsecurity.de/de/3691454/it-nachrichten/meta-launches-a-storefront-platform-through-facebook-marketplace/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691454/it-nachrichten/meta-launches-a-storefront-platform-through-facebook-marketplace/</guid>
<pubDate>Fri, 24 Jul 2026 14:04:48 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Facebook has introduced an app called Seller that effectively professionalizes Facebook Marketplace.]]></content:encoded>
</item>
<item>
<title><![CDATA[Getting a grip on shadow tokens and AI blowouts]]></title>
<description><![CDATA[Four months of Claude Code — that’s all it took for Uber to burn through its entire annual budget for AI. Token after token, engineers embraced the platform with few control mechanisms tying costs to outcomes. The result was a budget runaway and a clear case study in how limited oversight snowbal...]]></description>
<link>https://tsecurity.de/de/3691453/it-nachrichten/getting-a-grip-on-shadow-tokens-and-ai-blowouts/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691453/it-nachrichten/getting-a-grip-on-shadow-tokens-and-ai-blowouts/</guid>
<pubDate>Fri, 24 Jul 2026 14:04:46 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Four months of Claude Code — that’s all it took for Uber to burn through its entire annual budget for AI. Token after token, engineers embraced the platform with few control mechanisms tying costs to outcomes. The result was a budget runaway and <a href="https://www.forbes.com/sites/janakirammsv/2026/05/17/uber-burns-its-2026-ai-budget-in-four-months-on-claude-code/">a clear case study</a> in how limited oversight snowballs into an AI blowout.</p>



<p class="wp-block-paragraph">This is a phenomenon I like to call “shadow tokens” — AI credits paid for by the company but largely invisible to decision-makers. Too many engineers have the final say over how much they consume and, therefore, what it costs. This all-you-can-eat attitude is part of the reason why <a href="https://www.theverge.com/tech/930447/microsoft-claude-code-discontinued-notepad">Microsoft is reportedly</a> winding down many internal licenses across key engineering teams and why <a href="https://www.thestreet.com/investing/the-next-phase-of-ai-spending-is-already-underway">one in five organizations</a> is missing its AI spend forecast by more than 50%.</p>



<p class="wp-block-paragraph">And the trend is only accelerating. By 2028, <a href="https://www.cio.com/article/4189149/ai-coding-token-costs-are-on-track-to-rival-human-payroll.html">Gartner predicts</a> that AI coding costs (driven by this kind of ungoverned consumption) will be as much per developer as the salary companies pay that person.</p>



<p class="wp-block-paragraph">LLMs and agents introduce a new class of variable cost that scales with behavior rather than headcount, putting enterprises on the hook for tools that balloon with workload. I don’t see this as enterprises overspending because they’re reckless — it’s down to a lack of managerial oversight, budget alignment that demands a proven return on investment, and engineer education on how much is too much.</p>



<p class="wp-block-paragraph">Going forward, CIOs need to thread the AI needle between governance that encourages transparency and reasonable spend without stifling innovation.</p>



<h2 class="wp-block-heading">When shadow tokens result in real costs</h2>



<p class="wp-block-paragraph">The issue is that AI isn’t a traditional line item. Previously, enterprise leaders onboarded software-as-a-service (SaaS) with a good idea of the total cost. An allocated software seat or annual contract was a known quantity. The cloud added some variation (with fluctuations depending on hosting size), but instances were still modelable. AI flips this status quo on its head — the unit of consumption is behavior and the cost is exponential.</p>



<p class="wp-block-paragraph">And these specifics aren’t immediately apparent at pilot. Tools can appear inexpensive in controlled experiments yet unpredictably scale depending on session length, context window size, model selection and whether agents run in parallel. This is the fallacy of the $20-per-seat enterprise plan — tokens are charged separately at API rates with no ceiling. The final dollar value of any session is set by factors that finance can’t always model in advance, particularly when these decisions usually rest with the engineers themselves.</p>



<p class="wp-block-paragraph">According to <a href="https://www.deloitte.com/cz-sk/en/services/consulting/research/the-state-of-ai-in-the-enterprise.html">Deloitte</a>, only 21% of organizations deploying agents have a mature governance model, a real concern because they’re token-eating machines. This is what was happening at Uber — Claude Code in agentic mode was autonomously reading codebases, planning changes across dozens of files and opening pull requests. Each step quickly adds up, with Anthropic’s own documentation noting that agents consume approximately seven times as many tokens as standard sessions.</p>



<p class="wp-block-paragraph">This is shadow IT and shadow AI, evolved. This time, however, many leaders approved the tool in question without guardrails governing consumption. AI hype adds fuel to the fire and normalizes long sessions. Uber’s CTO, for example, <a href="https://x.com/praveenTweets/status/2033627282418655711">described</a> a company-wide shift toward “agentic software engineering” with employees “who are quietly experimenting, quietly shipping and quietly pushing things forward”. This is an exciting way to test the limits of what’s possible, certainly, but it’s also a position that goes a long way to explaining how the company spent its annual AI budget by April.</p>



<h2 class="wp-block-heading">Shifting the culture from usage to yield</h2>



<p class="wp-block-paragraph">Engineers haven’t done anything wrong here. In fact, they’re adopting and experimenting as instructed, with Uber creating leaderboards and ranking users by token consumption. More use led to a better ranking, reflecting a culture that lauds new ways of doing things. This behavior is known as “<a href="https://www.cio.com/article/4178320/tokenmaxxing-when-ai-adoption-metrics-go-bad.html">tokenmaxxing</a>,” and its principal knock-on effect is shadow tokens — quantity-over-quality processes that leaders struggle to control until they’re fully realized in the budget. Of course, if management treats adoption metrics as performance metrics, then engineers can’t be blamed for using more tokens. The tension is that the teams driving adoption aren’t the ones managing spend.</p>



<p class="wp-block-paragraph">None of this is meant to dismiss AI’s productivity possibilities and potential return on investment. Developers save <a href="https://getdx.com/blog/ai-assisted-engineering-q4-impact-report-2025/">3.6 hours</a> per week, achieve 60% higher pull request throughput and cut onboarding time in half with automation. Meanwhile, Uber shared that roughly 11% of live backend updates were written by agents with no human in the loop. However, these wins aren’t the problem — it’s that too many teams aren’t connecting input to output. I’ve spoken to admins who discovered their token spend had tripled in a single quarter after using heavier models or accidentally doubling up on agentic applications. Nobody knew until the financial damage was done.</p>



<p class="wp-block-paragraph">Automation needs to happen sustainably with an eye on the bottom line. In my view, a much better metric for achieving this is AI yield — the measurable business or engineering output generated per dollar spent on tokens. Otherwise, without a feedback loop, even genuinely productive teams are flying blind.</p>



<h2 class="wp-block-heading">Stopping token waste before an AI blowout</h2>



<p class="wp-block-paragraph">Creating that throughline between AI investment and token consumption starts with established financial metrics. This is possible via maximum spend limits (dictated by spend tagging, workload tiering and cost-per-output benchmarks) per team or project. Then, any additional allocation requires approval, closing the loop between the engineers spending the tokens and the leaders paying for them. AI isn’t cheap and teams should demonstrate a bang for their buck.</p>



<p class="wp-block-paragraph">This is something we do with our engineering team at Hexnode. Resource allocation for Claude Code and Cursor is tied directly to ROI rather than letting consumption run open-ended. Given the pay-as-you-go nature of these tools, a firm usage limit per team offers simple but essential control.</p>



<p class="wp-block-paragraph">Similarly, there’s room to apply some of the governance principles IT uses for device management. Things like policy enforcement, role-based access, real-time monitoring and automated alerts can flag usage behavior in advance. Uncovering such insights at the token layer works to identify power users and prevent excessive spending.</p>



<p class="wp-block-paragraph">We also need to encourage cultures that praise outputs that actually achieve efficiency. AI applications that result in shipping faster, reducing rework and cutting review cycles are gains that should be celebrated. If your company hosts leaderboards, frame unnecessary token burn as wasteful rather than valuable. The organizations creating healthier consumption habits work with their engineers to understand not just how to use AI, but what responsible use looks like and what it costs.</p>



<p class="wp-block-paragraph">This is a conversation teams need to have now. Anthropic <a href="https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan">just ended flat-rate pricing</a> for programmatic workloads from June 15. Now, agents, continuous integration pipelines and automated workflows draw from a dedicated monthly credit pool billed separately from the subscription. Once that pool is exhausted, agent tasks either stop entirely or overflow to extra billing. Work can either get very expensive or grind to a halt for teams that aren’t prepared.</p>



<p class="wp-block-paragraph">Getting a grip on shadow tokens means better rules and tools connecting spend to outcomes. Only by building the financial and cultural infrastructure that encourages sustainable adoption can leaders see what they’re spending, connect it to what they’re getting and course-correct before the costs become a crisis. Ultimately, shadow tokens are only invisible if we choose not to look.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Whack-a-drone]]></title>
<description><![CDATA[In Pasadena, California, there's a cute red brick courtyard where one storefront isn't like the rest. The glass doors open onto a sparse industrial hallway, which leads to a sunlit foyer with a large spiral staircase. Go up, and you'll see a typical coworking space: open tables, healthy snacks, a...]]></description>
<link>https://tsecurity.de/de/3691451/it-nachrichten/whack-a-drone/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691451/it-nachrichten/whack-a-drone/</guid>
<pubDate>Fri, 24 Jul 2026 14:04:43 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[In Pasadena, California, there's a cute red brick courtyard where one storefront isn't like the rest. The glass doors open onto a sparse industrial hallway, which leads to a sunlit foyer with a large spiral staircase. Go up, and you'll see a typical coworking space: open tables, healthy snacks, a collection of meeting rooms with […]]]></content:encoded>
</item>
<item>
<title><![CDATA[ChonkyChicken Malware Steals Chrome Credentials, Moves Laterally and Spies on Victims]]></title>
<description><![CDATA[ChonkyChicken is a newly identified remote access trojan designed to turn one infected Windows device into a platform for credential theft, network movement, and surveillance. The malware is part of the TAG-195, also called Golden Chickens or Venom Spider, malware-as-a-service ecosystem, which su...]]></description>
<link>https://tsecurity.de/de/3691427/it-security-nachrichten/chonkychicken-malware-steals-chrome-credentials-moves-laterally-and-spies-on-victims/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691427/it-security-nachrichten/chonkychicken-malware-steals-chrome-credentials-moves-laterally-and-spies-on-victims/</guid>
<pubDate>Fri, 24 Jul 2026 13:42:01 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>ChonkyChicken is a newly identified remote access trojan designed to turn one infected Windows device into a platform for credential theft, network movement, and surveillance. The malware is part of the TAG-195, also called Golden Chickens or Venom Spider, malware-as-a-service ecosystem, which supplies tooling to financially motivated criminal operators. Recent campaigns begin with ClickFix lures, […]</p>
<p>The post <a href="https://cybersecuritynews.com/chonkychicken-steals-chrome-credentials/">ChonkyChicken Malware Steals Chrome Credentials, Moves Laterally and Spies on Victims</a> appeared first on <a href="https://cybersecuritynews.com/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Atos launches sovereign cloud service to power comeback]]></title>
<description><![CDATA[Atos has launched a new sovereign cloud platform aimed squarely at European public sector bodies, healthcare providers and defense organizations. It’s the latest effort by European companies in their fight back against US dominance.



Atos Sovereign Cloud offers a range of controls for data mana...]]></description>
<link>https://tsecurity.de/de/3691386/it-security-nachrichten/atos-launches-sovereign-cloud-service-to-power-comeback/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691386/it-security-nachrichten/atos-launches-sovereign-cloud-service-to-power-comeback/</guid>
<pubDate>Fri, 24 Jul 2026 13:26:14 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Atos has launched a new sovereign cloud platform aimed squarely at European public sector bodies, healthcare providers and defense organizations. It’s the latest effort by European companies in their fight back against US dominance.</p>



<p class="wp-block-paragraph">Atos Sovereign Cloud offers a range of controls for data management, providing customers with resilience and full control over their data, complying with existing European legislation on data residency.</p>



<p class="wp-block-paragraph">“Digital sovereignty has become a global operational priority for organizations that need to manage dependencies, jurisdictional exposure and disruption risks across complex digital environments. Atos Sovereign Cloud gives customers a practical way to apply sovereign controls to their most critical workloads, while preserving flexibility, resilience and the ability to innovate securely,” said Michael Kollar, Atos Group digital sovereignty leader.</p>



<p class="wp-block-paragraph">There has been a concerted effort by <a href="https://www.computerworld.com/article/4121422/europe-votes-to-tackle-deep-dependence-on-us-tech-in-sovereignty-drive.html">European organizations to meet US competition</a> head-on. Earlier this month, <a href="https://www.networkworld.com/article/4192767/cloud-sovereignty-first-four-providers-sign-up-to-cispe-certification-program.html">four companies signed up to the certification program</a> introduced by the European cloud body, CISPE,</p>



<p class="wp-block-paragraph">This is the latest effort by Atos to get the company back on track. In April, <a href="https://www.networkworld.com/article/4154186/french-government-take-bull-by-horns-for-e404-million.html">it sold its supercomputer company, Bull</a> to the French government, after a previous attempt in 2024 to <a href="https://www.cio.com/article/1310376/atos-deal-to-sell-its-legacy-service-business-falls-through.html">sell off its computer services division</a> and <a href="https://www.cio.com/article/2086965/atos-staves-off-bankruptcy-casts-wider-net-for-refinancing.html">after a refinancing deal</a> in the same year.</p>



<p class="wp-block-paragraph">The company implemented a further round of refinancing this year and <a href="https://www.atosgroup.com/en/press/first-phase-refinancing-strategy-completed" target="_blank" rel="noreferrer noopener">in its half-yearly report</a> claimed that this was an “important milestone” in securing the company’s future. However, in its first-quarter results revenue showed an organic decline of 11 percent, so any projected growth may be some time in the future. Whether its Sovereign Cloud offering is the harbinger of the revival remains to be seen.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.cio.com/article/4201118/atos-launches-sovereign-cloud-service-to-power-comeback.html">CIO</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[New WARDEN Stealer Targets 330+ Apps and 200 Crypto Extensions on Windows]]></title>
<description><![CDATA[New malware-as-a-service (MaaS) offering “WARDEN” has emerged on cybercrime forums, pitching a Windows infostealer that blends credential theft, cryptocurrency hijacking, and payload delivery behind a single, feature-rich control panel. Marketed by the operator using the handle “WardenStealer,” t...]]></description>
<link>https://tsecurity.de/de/3691380/it-security-nachrichten/new-warden-stealer-targets-330-apps-and-200-crypto-extensions-on-windows/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691380/it-security-nachrichten/new-warden-stealer-targets-330-apps-and-200-crypto-extensions-on-windows/</guid>
<pubDate>Fri, 24 Jul 2026 13:26:06 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>New malware-as-a-service (MaaS) offering “WARDEN” has emerged on cybercrime forums, pitching a Windows infostealer that blends credential theft, cryptocurrency hijacking, and payload delivery behind a single, feature-rich control panel. Marketed by the operator using the handle “WardenStealer,” the platform appears aimed at traffickers and other financially motivated actors who want turnkey data-theft and monetization workflows […]</p>
<p>The post <a href="https://cyberpress.org/new-warden-stealer-targets-330-apps/">New WARDEN Stealer Targets 330+ Apps and 200 Crypto Extensions on Windows</a> appeared first on <a href="https://cyberpress.org/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Google’s anti-search-scraping lawsuit dismissed]]></title>
<description><![CDATA[A court has dismissed Google’s case against SerpApi over that company’s scraping of search results to train AI models.



The US District Court for the Northern District of California found that there was no indication that any copyright had been breached.



Google announced in December that it ...]]></description>
<link>https://tsecurity.de/de/3691374/it-nachrichten/googles-anti-search-scraping-lawsuit-dismissed/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691374/it-nachrichten/googles-anti-search-scraping-lawsuit-dismissed/</guid>
<pubDate>Fri, 24 Jul 2026 13:20:02 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">A court has dismissed <a href="https://storage.courtlistener.com/recap/gov.uscourts.cand.461513/gov.uscourts.cand.461513.42.0.pdf" target="_blank" rel="noreferrer noopener">Google’s case against SerpApi</a> over that company’s scraping of search results to train AI models.</p>



<p class="wp-block-paragraph">The US District Court for the Northern District of California found that there was no indication that any copyright had been breached.</p>



<p class="wp-block-paragraph"><a href="https://www.computerworld.com/article/4111155/google-says-no-to-training-ai-on-its-search-results.html">Google announced in December</a> that it was suing SerpApI for its alleged web scraping, claiming that it was protecting copyright holders. In February<a href="https://www.computerworld.com/article/4136288/serpapi-fights-back-against-google-lawsuit.html">, SerpApI fought back and asked the court</a> to dismiss Google’s case. And this week, Judge Yvonne Gonzalez Rogers agreed with SerpApi that Google’s case has no merit.</p>



<p class="wp-block-paragraph">Google’s argument was that SerpApi’s actions breached the US Digital Millennium Copyright Act (DCMA). It made two claims: first, that no person shall circumvent a technological measure that effectively controls access to a work protected under this title, and second that no person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, or component protected by the Act.</p>



<p class="wp-block-paragraph">SerpApi claimed that the URLs and other links that were being served by Google did not in themselves entail copyright and the judge agreed. In her judgment, she said that there was no indication that the copyright holders had authorized Google to take action against SerpApi.</p>



<p class="wp-block-paragraph">The case is not completely over as the judge has given Google 21 days to amend its complaint to demonstrate that it was acting on behalf of the copyright owners. It remains to be seen whether its war against the web scrapers is finally over.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Atos launches sovereign cloud service to power comeback]]></title>
<description><![CDATA[Atos has launched a new sovereign cloud platform aimed squarely at European public sector bodies, healthcare providers and defense organizations. It’s the latest effort by European companies in their fight back against US dominance.



Atos Sovereign Cloud offers a range of controls for data mana...]]></description>
<link>https://tsecurity.de/de/3691349/it-security-nachrichten/atos-launches-sovereign-cloud-service-to-power-comeback/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691349/it-security-nachrichten/atos-launches-sovereign-cloud-service-to-power-comeback/</guid>
<pubDate>Fri, 24 Jul 2026 13:12:35 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Atos has launched a new sovereign cloud platform aimed squarely at European public sector bodies, healthcare providers and defense organizations. It’s the latest effort by European companies in their fight back against US dominance.</p>



<p class="wp-block-paragraph">Atos Sovereign Cloud offers a range of controls for data management, providing customers with resilience and full control over their data, complying with existing European legislation on data residency.</p>



<p class="wp-block-paragraph">“Digital sovereignty has become a global operational priority for organizations that need to manage dependencies, jurisdictional exposure and disruption risks across complex digital environments. Atos Sovereign Cloud gives customers a practical way to apply sovereign controls to their most critical workloads, while preserving flexibility, resilience and the ability to innovate securely,” said Michael Kollar, Atos Group digital sovereignty leader.</p>



<p class="wp-block-paragraph">There has been a concerted effort by <a href="https://www.computerworld.com/article/4121422/europe-votes-to-tackle-deep-dependence-on-us-tech-in-sovereignty-drive.html">European organizations to meet US competition</a> head-on. Earlier this month, <a href="https://www.networkworld.com/article/4192767/cloud-sovereignty-first-four-providers-sign-up-to-cispe-certification-program.html">four companies signed up to the certification program</a> introduced by the European cloud body, CISPE,</p>



<p class="wp-block-paragraph">This is the latest effort by Atos to get the company back on track. In April, <a href="https://www.networkworld.com/article/4154186/french-government-take-bull-by-horns-for-e404-million.html">it sold its supercomputer company, Bull</a> to the French government, after a previous attempt in 2024 to <a href="https://www.cio.com/article/1310376/atos-deal-to-sell-its-legacy-service-business-falls-through.html">sell off its computer services division</a> and <a href="https://www.cio.com/article/2086965/atos-staves-off-bankruptcy-casts-wider-net-for-refinancing.html">after a refinancing deal</a> in the same year.</p>



<p class="wp-block-paragraph">The company implemented a further round of refinancing this year and <a href="https://www.atosgroup.com/en/press/first-phase-refinancing-strategy-completed" target="_blank" rel="noreferrer noopener">in its half-yearly report</a> claimed that this was an “important milestone” in securing the company’s future. However, in its first-quarter results revenue showed an organic decline of 11 percent, so any projected growth may be some time in the future. Whether its Sovereign Cloud offering is the harbinger of the revival remains to be seen.</p>



<p class="wp-block-paragraph"></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Facebook considers giving up and becoming TikTok]]></title>
<description><![CDATA[Facebook is planning some big changes to try and keep its users from jumping to rival social platforms like TikTok - changes that sound dubiously similar to becoming a TikTok clone. Facebook head Tom Alison announced today that the platform will begin testing a "reimagined experience" later this ...]]></description>
<link>https://tsecurity.de/de/3691323/it-nachrichten/facebook-considers-giving-up-and-becoming-tiktok/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691323/it-nachrichten/facebook-considers-giving-up-and-becoming-tiktok/</guid>
<pubDate>Fri, 24 Jul 2026 13:04:11 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Facebook is planning some big changes to try and keep its users from jumping to rival social platforms like TikTok - changes that sound dubiously similar to becoming a TikTok clone. Facebook head Tom Alison announced today that the platform will begin testing a "reimagined experience" later this year that will put a subset of […]]]></content:encoded>
</item>
<item>
<title><![CDATA[USN-8603-1: Linux kernel (Azure) vulnerabilities]]></title>
<description><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shar...]]></description>
<link>https://tsecurity.de/de/3691319/unix-server/usn-8603-1-linux-kernel-azure-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691319/unix-server/usn-8603-1-linux-kernel-azure-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 13:02:31 +0200</pubDate>
<category>🐧 Unix Server</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
  - x86 platform drivers;
  - PSP security protocol;
  - ARM32 architecture;
  - ARM64 architecture;
  - MIPS architecture;
  - PowerPC architecture;
  - RISC-V architecture;
  - S390 architecture;
  - User-Mode Linux (UML);
  - x86 architecture;
  - Block layer subsystem;
  - Cryptographic API;
  - Intel NPU Driver;
  - Compute Acceleration Framework;
  - ACPI drivers;
  - Auxiliary display drivers;
  - Drivers core;
  - DRBD Distributed Replicated Block Device drivers;
  - Rados block device (RBD) driver;
  - Ublk userspace block driver;
  - Compressed RAM block device driver;
  - Bluetooth drivers;
  - Bus devices;
  - Character device driver;
  - TPM device driver;
  - Clock framework and drivers;
  - CPU frequency scaling framework;
  - Hardware crypto device drivers;
  - Buffer Sharing and Synchronization framework;
  - DPLL subsystem;
  - EDAC drivers;
  - Arm Firmware Framework for ARMv8-A(FFA);
  - EFI core;
  - FWCTL subsystem;
  - GPIO subsystem;
  - GPU drivers;
  - Greybus drivers;
  - HID subsystem;
  - Microsoft Hyper-V drivers;
  - Hardware monitoring drivers;
  - I2C subsystem;
  - I3C subsystem;
  - IIO ADC drivers;
  - IIO subsystem;
  - InfiniBand drivers;
  - Input Device core drivers;
  - IOMMU subsystem;
  - LED subsystem;
  - Mailbox framework;
  - Multiple devices driver;
  - Media drivers;
  - NVIDIA Tegra memory controller driver;
  - IBM Advanced System Management driver;
  - MTD block device drivers;
  - Network drivers;
  - Ethernet bonding driver;
  - Mellanox network drivers;
  - Microsoft Azure Network Adapter (MANA) driver;
  - STMicroelectronics network drivers;
  - Texas Instruments network drivers;
  - MediaTek network drivers;
  - NTB driver;
  - NVME drivers;
  - Device tree and open firmware driver;
  - Parport drivers;
  - PCI subsystem;
  - Pin controllers subsystem;
  - Chrome hardware platform drivers;
  - ACPI WMI driver;
  - Generic PM domains;
  - MediaTek PM domains;
  - Power supply drivers;
  - Remote Processor subsystem;
  - MPAM driver;
  - Amlogic Meson reset controller drivers;
  - S/390 drivers;
  - SCSI subsystem;
  - NVIDIA Tegra Control Backbone (CBB) driver;
  - SPI subsystem;
  - Greybus lights staging drivers;
  - Media staging drivers;
  - Realtek RTL8723BS SDIO drivers;
  - SM750 framebuffer staging driver;
  - TCM subsystem;
  - Thermal drivers;
  - Thunderbolt and USB4 drivers;
  - TTY drivers;
  - Userspace I/O drivers;
  - USB Device Class drivers;
  - ULPI bus;
  - DesignWare USB2 driver;
  - USB Gadget drivers;
  - USB Dual Role (OTG-ready) Controller drivers;
  - USB Serial drivers;
  - USB Type-C support driver;
  - USB Type-C Port Controller Manager driver;
  - TI TPS6598x USB Power Delivery controller driver;
  - USB Type-C Connector System Software Interface driver;
  - USB over IP driver;
  - vDPA drivers;
  - VFIO drivers;
  - Framebuffer layer;
  - TSM AMD SEV Guest driver;
  - Xen hypervisor drivers;
  - 9P distributed file system;
  - File systems infrastructure;
  - AFS file system;
  - BTRFS file system;
  - Ceph distributed file system;
  - EROFS file system;
  - Ext4 file system;
  - F2FS file system;
  - FUSE (File system in Userspace);
  - GFS2 file system;
  - HFS+ file system;
  - HugeTLB file system;
  - Journaling layer for block devices (JBD2);
  - Network file systems library;
  - Network file system (NFS) server daemon;
  - NILFS2 file system;
  - File system notification infrastructure;
  - NTFS3 file system;
  - OCFS2 file system;
  - Overlay file system;
  - Diskquota system;
  - SMB network file system;
  - Tracing file system;
  - UDF file system;
  - XFS file system;
  - DRM TTM subsystem;
  - Codetag library;
  - Control group (cgroup);
  - Kernel CPU control infrastructure;
  - Memory management;
  - Tracing infrastructure;
  - QorIQ DPAA2 FSL-MC bus driver;
  - Freescale ENETC Ethernet drivers;
  - Memory Management;
  - KVM subsystem;
  - Linked list library;
  - Netfilter;
  - padata parallel execution mechanism;
  - PPP protocol drivers and compressors;
  - Bluetooth subsystem;
  - Networking core;
  - Network shaper API;
  - Network traffic control;
  - TCP network protocol;
  - XFRM subsystem;
  - User-space API (UAPI);
  - io_uring subsystem;
  - IPC subsystem;
  - Audit subsystem;
  - BPF subsystem;
  - DMA mapping infrastructure;
  - Kernel exit() syscall;
  - Kernel fork() syscall;
  - Kernel futex primitives;
  - IRQ subsystem;
  - Kexec HandOver (KHO);
  - Locking primitives;
  - Padata parallel execution mechanism;
  - Scheduler infrastructure;
  - Timer subsystem;
  - Cryptographic library;
  - Scatterlist API;
  - Heterogeneous memory management;
  - KProbes tracing;
  - KASAN memory debugging framework;
  - 802.1Q VLAN protocol;
  - B.A.T.M.A.N. meshing protocol;
  - Ethernet bridge;
  - CAIF protocol;
  - CAN network layer;
  - Ceph Core library;
  - Distributed Switch Architecture;
  - Ethtool driver;
  - Handshake API;
  - HSR network protocol;
  - IPv4 networking;
  - IPv6 networking;
  - IUCV driver;
  - L2TP protocol;
  - MAC80211 subsystem;
  - Multipath TCP;
  - NFC subsystem;
  - Open vSwitch;
  - Packet sockets;
  - Phonet protocol;
  - Qualcomm IPC Router (QRTR);
  - RDS protocol;
  - RxRPC session sockets;
  - SCTP protocol;
  - SMC sockets;
  - Stream parser;
  - TIPC protocol;
  - TLS protocol;
  - Unix domain sockets;
  - VMware vSockets driver;
  - Wireless networking;
  - Integrity Measurement Architecture(IMA) framework;
  - Key management;
  - Landlock security;
  - Linux Security Modules (LSM) Framework;
  - SELinux security module;
  - ALSA framework;
  - Generic PCM loopback sound driver;
  - FireWire sound drivers;
  - HD-audio driver;
  - AudioScience HPI driver;
  - Creative Sound Blaster X-Fi driver;
  - FourSemi audio codecs;
  - Texas InstrumentS Audio (ASoC/HDA) drivers;
  - QCOM ASoC drivers;
  - Renesas ASoC drivers;
  - SOF drivers;
  - STI ASoC drivers;
  - USB sound devices;
  - Objtool;
(CVE-2026-31532, CVE-2026-31574, CVE-2026-31575, CVE-2026-31576,
CVE-2026-31577, CVE-2026-31578, CVE-2026-31579, CVE-2026-31580,
CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584,
CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588,
CVE-2026-31589, CVE-2026-31590, CVE-2026-31591, CVE-2026-31592,
CVE-2026-31593, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596,
CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31600,
CVE-2026-31601, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604,
CVE-2026-31605, CVE-2026-31606, CVE-2026-31607, CVE-2026-31608,
CVE-2026-31609, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612,
CVE-2026-31613, CVE-2026-31614, CVE-2026-31615, CVE-2026-31616,
CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31620,
CVE-2026-31621, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624,
CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628,
CVE-2026-31629, CVE-2026-31686, CVE-2026-31694, CVE-2026-31696,
CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700,
CVE-2026-31701, CVE-2026-31702, CVE-2026-31703, CVE-2026-31704,
CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708,
CVE-2026-31709, CVE-2026-31710, CVE-2026-31711, CVE-2026-31712,
CVE-2026-31713, CVE-2026-31714, CVE-2026-31715, CVE-2026-31716,
CVE-2026-31717, CVE-2026-31718, CVE-2026-31719, CVE-2026-43058,
CVE-2026-43071, CVE-2026-43072, CVE-2026-43073, CVE-2026-43348,
CVE-2026-43349, CVE-2026-43350, CVE-2026-43490, CVE-2026-43491,
CVE-2026-43492, CVE-2026-43493, CVE-2026-43495, CVE-2026-43496,
CVE-2026-43497, CVE-2026-43498, CVE-2026-43499, CVE-2026-43501,
CVE-2026-43502, CVE-2026-45834, CVE-2026-45835, CVE-2026-45836,
CVE-2026-45837, CVE-2026-45838, CVE-2026-45839, CVE-2026-45840,
CVE-2026-45841, CVE-2026-45842, CVE-2026-45843, CVE-2026-45844,
CVE-2026-45845, CVE-2026-45846, CVE-2026-45986, CVE-2026-45987,
CVE-2026-45988, CVE-2026-45989, CVE-2026-45990, CVE-2026-45991,
CVE-2026-45994, CVE-2026-45995, CVE-2026-45996, CVE-2026-45997,
CVE-2026-45999, CVE-2026-46001, CVE-2026-46002, CVE-2026-46003,
CVE-2026-46004, CVE-2026-46005, CVE-2026-46006, CVE-2026-46007,
CVE-2026-46008, CVE-2026-46009, CVE-2026-46010, CVE-2026-46011,
CVE-2026-46012, CVE-2026-46013, CVE-2026-46014, CVE-2026-46015,
CVE-2026-46016, CVE-2026-46018, CVE-2026-46019, CVE-2026-46020,
CVE-2026-46021, CVE-2026-46022, CVE-2026-46023, CVE-2026-46024,
CVE-2026-46025, CVE-2026-46026, CVE-2026-46027, CVE-2026-46028,
CVE-2026-46029, CVE-2026-46030, CVE-2026-46031, CVE-2026-46032,
CVE-2026-46033, CVE-2026-46034, CVE-2026-46035, CVE-2026-46036,
CVE-2026-46037, CVE-2026-46038, CVE-2026-46039, CVE-2026-46040,
CVE-2026-46041, CVE-2026-46042, CVE-2026-46043, CVE-2026-46044,
CVE-2026-46045, CVE-2026-46046, CVE-2026-46047, CVE-2026-46049,
CVE-2026-46050, CVE-2026-46051, CVE-2026-46052, CVE-2026-46053,
CVE-2026-46054, CVE-2026-46056, CVE-2026-46057, CVE-2026-46058,
CVE-2026-46059, CVE-2026-46060, CVE-2026-46061, CVE-2026-46062,
CVE-2026-46063, CVE-2026-46064, CVE-2026-46065, CVE-2026-46066,
CVE-2026-46067, CVE-2026-46068, CVE-2026-46069, CVE-2026-46070,
CVE-2026-46071, CVE-2026-46072, CVE-2026-46073, CVE-2026-46074,
CVE-2026-46075, CVE-2026-46076, CVE-2026-46077, CVE-2026-46078,
CVE-2026-46079, CVE-2026-46080, CVE-2026-46081, CVE-2026-46082,
CVE-2026-46083, CVE-2026-46084, CVE-2026-46085, CVE-2026-46086,
CVE-2026-46087, CVE-2026-46088, CVE-2026-46089, CVE-2026-46090,
CVE-2026-46091, CVE-2026-46092, CVE-2026-46093, CVE-2026-46094,
CVE-2026-46095, CVE-2026-46096, CVE-2026-46097, CVE-2026-46098,
CVE-2026-46099, CVE-2026-46100, CVE-2026-46101, CVE-2026-46102,
CVE-2026-46103, CVE-2026-46104, CVE-2026-46105, CVE-2026-46106,
CVE-2026-46107, CVE-2026-46108, CVE-2026-46109, CVE-2026-46110,
CVE-2026-46111, CVE-2026-46112, CVE-2026-46113, CVE-2026-46114,
CVE-2026-46115, CVE-2026-46116, CVE-2026-46117, CVE-2026-46118,
CVE-2026-46119, CVE-2026-46120, CVE-2026-46121, CVE-2026-46122,
CVE-2026-46123, CVE-2026-46124, CVE-2026-46125, CVE-2026-46126,
CVE-2026-46127, CVE-2026-46128, CVE-2026-46129, CVE-2026-46130,
CVE-2026-46131, CVE-2026-46132, CVE-2026-46133, CVE-2026-46134,
CVE-2026-46135, CVE-2026-46136, CVE-2026-46137, CVE-2026-46138,
CVE-2026-46139, CVE-2026-46140, CVE-2026-46141, CVE-2026-46142,
CVE-2026-46143, CVE-2026-46144, CVE-2026-46145, CVE-2026-46146,
CVE-2026-46147, CVE-2026-46148, CVE-2026-46149, CVE-2026-46150,
CVE-2026-46151, CVE-2026-46152, CVE-2026-46153, CVE-2026-46154,
CVE-2026-46155, CVE-2026-46156, CVE-2026-46157, CVE-2026-46158,
CVE-2026-46159, CVE-2026-46160, CVE-2026-46161, CVE-2026-46162,
CVE-2026-46163, CVE-2026-46164, CVE-2026-46165, CVE-2026-46166,
CVE-2026-46167, CVE-2026-46168, CVE-2026-46169, CVE-2026-46170,
CVE-2026-46171, CVE-2026-46172, CVE-2026-46173, CVE-2026-46174,
CVE-2026-46175, CVE-2026-46176, CVE-2026-46177, CVE-2026-46178,
CVE-2026-46179, CVE-2026-46180, CVE-2026-46181, CVE-2026-46182,
CVE-2026-46183, CVE-2026-46184, CVE-2026-46185, CVE-2026-46186,
CVE-2026-46187, CVE-2026-46188, CVE-2026-46189, CVE-2026-46190,
CVE-2026-46191, CVE-2026-46192, CVE-2026-46193, CVE-2026-46194,
CVE-2026-46195, CVE-2026-46196, CVE-2026-46197, CVE-2026-46198,
CVE-2026-46199, CVE-2026-46200, CVE-2026-46201, CVE-2026-46202,
CVE-2026-46203, CVE-2026-46204, CVE-2026-46205, CVE-2026-46206,
CVE-2026-46207, CVE-2026-46208, CVE-2026-46209, CVE-2026-46210,
CVE-2026-46211, CVE-2026-46212, CVE-2026-46213, CVE-2026-46214,
CVE-2026-46215, CVE-2026-46216, CVE-2026-46218, CVE-2026-46219,
CVE-2026-46220, CVE-2026-46221, CVE-2026-46222, CVE-2026-46223,
CVE-2026-46224, CVE-2026-46225, CVE-2026-46226, CVE-2026-46227,
CVE-2026-46228, CVE-2026-46229, CVE-2026-46230, CVE-2026-46231,
CVE-2026-46232, CVE-2026-46233, CVE-2026-46234, CVE-2026-46235,
CVE-2026-46236, CVE-2026-46238, CVE-2026-46239, CVE-2026-46240,
CVE-2026-46241, CVE-2026-46242, CVE-2026-46243, CVE-2026-46244,
CVE-2026-46273, CVE-2026-46274, CVE-2026-46275, CVE-2026-46276,
CVE-2026-46277, CVE-2026-46278, CVE-2026-46279, CVE-2026-46280,
CVE-2026-46281, CVE-2026-46282, CVE-2026-46283, CVE-2026-46284,
CVE-2026-46285, CVE-2026-46286, CVE-2026-46287, CVE-2026-46288,
CVE-2026-46289, CVE-2026-46290, CVE-2026-46291, CVE-2026-46292,
CVE-2026-46293, CVE-2026-46294, CVE-2026-46295, CVE-2026-46296,
CVE-2026-46297, CVE-2026-46298, CVE-2026-46299, CVE-2026-46301,
CVE-2026-46302, CVE-2026-46303, CVE-2026-46304, CVE-2026-46305,
CVE-2026-46306, CVE-2026-46307, CVE-2026-46308, CVE-2026-46309,
CVE-2026-46310, CVE-2026-46311, CVE-2026-46312, CVE-2026-46313,
CVE-2026-46314, CVE-2026-46315, CVE-2026-46316, CVE-2026-46317,
CVE-2026-46318, CVE-2026-46319, CVE-2026-46320, CVE-2026-46321,
CVE-2026-46322, CVE-2026-46324, CVE-2026-46332, CVE-2026-52904,
CVE-2026-52905, CVE-2026-52906, CVE-2026-52907, CVE-2026-52911,
CVE-2026-52912, CVE-2026-52913, CVE-2026-52914, CVE-2026-52915,
CVE-2026-52916, CVE-2026-52918, CVE-2026-52919, CVE-2026-52920,
CVE-2026-52921, CVE-2026-52922, CVE-2026-52923, CVE-2026-52925,
CVE-2026-52926, CVE-2026-52927, CVE-2026-52928, CVE-2026-52931,
CVE-2026-52932, CVE-2026-52933, CVE-2026-52934, CVE-2026-52936,
CVE-2026-52937, CVE-2026-52941, CVE-2026-52943, CVE-2026-52944,
CVE-2026-52949, CVE-2026-52950, CVE-2026-52951, CVE-2026-52952,
CVE-2026-52953, CVE-2026-52954, CVE-2026-52955, CVE-2026-52956,
CVE-2026-52957, CVE-2026-52958, CVE-2026-52959, CVE-2026-52960,
CVE-2026-52961, CVE-2026-52962, CVE-2026-52963, CVE-2026-52964,
CVE-2026-52965, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969,
CVE-2026-52970, CVE-2026-52971, CVE-2026-52973, CVE-2026-52974,
CVE-2026-52975, CVE-2026-52976, CVE-2026-52977, CVE-2026-52978,
CVE-2026-52979, CVE-2026-52980, CVE-2026-52981, CVE-2026-52982,
CVE-2026-52983, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986,
CVE-2026-52987, CVE-2026-52988, CVE-2026-52989, CVE-2026-52990,
CVE-2026-52991, CVE-2026-52992, CVE-2026-52993, CVE-2026-52994,
CVE-2026-52995, CVE-2026-52996, CVE-2026-52997, CVE-2026-52998,
CVE-2026-52999, CVE-2026-53000, CVE-2026-53001, CVE-2026-53002,
CVE-2026-53003, CVE-2026-53004, CVE-2026-53005, CVE-2026-53006,
CVE-2026-53007, CVE-2026-53008, CVE-2026-53009, CVE-2026-53010,
CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53014,
CVE-2026-53015, CVE-2026-53016, CVE-2026-53017, CVE-2026-53018,
CVE-2026-53019, CVE-2026-53020, CVE-2026-53021, CVE-2026-53022,
CVE-2026-53023, CVE-2026-53024, CVE-2026-53025, CVE-2026-53026,
CVE-2026-53027, CVE-2026-53028, CVE-2026-53029, CVE-2026-53030,
CVE-2026-53031, CVE-2026-53032, CVE-2026-53033, CVE-2026-53034,
CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53038,
CVE-2026-53039, CVE-2026-53040, CVE-2026-53041, CVE-2026-53042,
CVE-2026-53043, CVE-2026-53044, CVE-2026-53045, CVE-2026-53046,
CVE-2026-53047, CVE-2026-53048, CVE-2026-53049, CVE-2026-53050,
CVE-2026-53051, CVE-2026-53052, CVE-2026-53053, CVE-2026-53054,
CVE-2026-53055, CVE-2026-53056, CVE-2026-53057, CVE-2026-53058,
CVE-2026-53059, CVE-2026-53060, CVE-2026-53061, CVE-2026-53062,
CVE-2026-53063, CVE-2026-53064, CVE-2026-53065, CVE-2026-53066,
CVE-2026-53067, CVE-2026-53068, CVE-2026-53069, CVE-2026-53070,
CVE-2026-53071, CVE-2026-53072, CVE-2026-53073, CVE-2026-53074,
CVE-2026-53075, CVE-2026-53076, CVE-2026-53077, CVE-2026-53078,
CVE-2026-53079, CVE-2026-53080, CVE-2026-53081, CVE-2026-53082,
CVE-2026-53083, CVE-2026-53084, CVE-2026-53085, CVE-2026-53086,
CVE-2026-53087, CVE-2026-53088, CVE-2026-53089, CVE-2026-53090,
CVE-2026-53091, CVE-2026-53092, CVE-2026-53093, CVE-2026-53094,
CVE-2026-53095, CVE-2026-53096, CVE-2026-53097, CVE-2026-53098,
CVE-2026-53099, CVE-2026-53100, CVE-2026-53101, CVE-2026-53102,
CVE-2026-53103, CVE-2026-53104, CVE-2026-53105, CVE-2026-53106,
CVE-2026-53107, CVE-2026-53108, CVE-2026-53109, CVE-2026-53110,
CVE-2026-53111, CVE-2026-53112, CVE-2026-53113, CVE-2026-53114,
CVE-2026-53115, CVE-2026-53116, CVE-2026-53117, CVE-2026-53118,
CVE-2026-53119, CVE-2026-53120, CVE-2026-53121, CVE-2026-53122,
CVE-2026-53123, CVE-2026-53124, CVE-2026-53125, CVE-2026-53126,
CVE-2026-53127, CVE-2026-53128, CVE-2026-53129, CVE-2026-53130,
CVE-2026-53174, CVE-2026-53277, CVE-2026-53278, CVE-2026-53279,
CVE-2026-53280, CVE-2026-53281, CVE-2026-53282, CVE-2026-53283,
CVE-2026-53284, CVE-2026-53285, CVE-2026-53286, CVE-2026-53287,
CVE-2026-53288, CVE-2026-53289, CVE-2026-53290, CVE-2026-53291,
CVE-2026-53292, CVE-2026-53293, CVE-2026-53294, CVE-2026-53295,
CVE-2026-53296, CVE-2026-53297, CVE-2026-53298, CVE-2026-53299,
CVE-2026-53300, CVE-2026-53301, CVE-2026-53302, CVE-2026-53303,
CVE-2026-53304, CVE-2026-53305, CVE-2026-53306, CVE-2026-53307,
CVE-2026-53308, CVE-2026-53309, CVE-2026-53310, CVE-2026-53311,
CVE-2026-53312, CVE-2026-53313, CVE-2026-53314, CVE-2026-53315,
CVE-2026-53316, CVE-2026-53317, CVE-2026-53318, CVE-2026-53319,
CVE-2026-53320, CVE-2026-53321, CVE-2026-53322, CVE-2026-53323,
CVE-2026-53324, CVE-2026-53357, CVE-2026-53358, CVE-2026-53360,
CVE-2026-53364, CVE-2026-53365, CVE-2026-53367, CVE-2026-53368,
CVE-2026-53369, CVE-2026-53370, CVE-2026-53371, CVE-2026-53372,
CVE-2026-53373, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376,
CVE-2026-53377, CVE-2026-53378, CVE-2026-53379, CVE-2026-53380,
CVE-2026-63837, CVE-2026-63838, CVE-2026-63839, CVE-2026-63840,
CVE-2026-63841, CVE-2026-63842, CVE-2026-63843, CVE-2026-63844,
CVE-2026-63845, CVE-2026-63846, CVE-2026-63847, CVE-2026-63848,
CVE-2026-63849, CVE-2026-63850, CVE-2026-63851, CVE-2026-63852,
CVE-2026-63853, CVE-2026-63854, CVE-2026-63855, CVE-2026-63856,
CVE-2026-63857, CVE-2026-63858, CVE-2026-63859, CVE-2026-63860,
CVE-2026-63861, CVE-2026-63862, CVE-2026-63863, CVE-2026-63864,
CVE-2026-63865, CVE-2026-63866, CVE-2026-63875, CVE-2026-63876,
CVE-2026-63877, CVE-2026-63878, CVE-2026-63879, CVE-2026-63880,
CVE-2026-63881, CVE-2026-63882, CVE-2026-63883, CVE-2026-63884,
CVE-2026-63886, CVE-2026-63887, CVE-2026-63888, CVE-2026-63889,
CVE-2026-63890, CVE-2026-63891, CVE-2026-63892, CVE-2026-63893,
CVE-2026-63894, CVE-2026-63895, CVE-2026-63896, CVE-2026-63897,
CVE-2026-63898, CVE-2026-63899, CVE-2026-63900, CVE-2026-63901,
CVE-2026-63902, CVE-2026-63903, CVE-2026-63904, CVE-2026-63905,
CVE-2026-63906, CVE-2026-63907, CVE-2026-63908, CVE-2026-63910,
CVE-2026-63911, CVE-2026-63912, CVE-2026-63913, CVE-2026-63914,
CVE-2026-63915, CVE-2026-63916, CVE-2026-63917, CVE-2026-63918,
CVE-2026-63919, CVE-2026-63920, CVE-2026-63921, CVE-2026-63922,
CVE-2026-63923, CVE-2026-63924, CVE-2026-63925, CVE-2026-63926,
CVE-2026-63927, CVE-2026-63928, CVE-2026-63929, CVE-2026-63930,
CVE-2026-63931, CVE-2026-63932, CVE-2026-63933, CVE-2026-63934,
CVE-2026-63935, CVE-2026-63936, CVE-2026-63937, CVE-2026-63938,
CVE-2026-63939, CVE-2026-63940, CVE-2026-63941, CVE-2026-63942,
CVE-2026-63943, CVE-2026-63944, CVE-2026-63945, CVE-2026-63946,
CVE-2026-63947, CVE-2026-63948, CVE-2026-63949, CVE-2026-63950,
CVE-2026-63951, CVE-2026-63952, CVE-2026-63953, CVE-2026-63954,
CVE-2026-63955, CVE-2026-63956, CVE-2026-63957, CVE-2026-63958,
CVE-2026-63959, CVE-2026-63960, CVE-2026-63961, CVE-2026-63962,
CVE-2026-63963, CVE-2026-63964, CVE-2026-63965, CVE-2026-63966,
CVE-2026-63967, CVE-2026-63968, CVE-2026-63969, CVE-2026-63970,
CVE-2026-63971, CVE-2026-63972, CVE-2026-63973, CVE-2026-63974,
CVE-2026-63975, CVE-2026-63976, CVE-2026-63977, CVE-2026-63978,
CVE-2026-63979, CVE-2026-63980, CVE-2026-63981, CVE-2026-63982,
CVE-2026-63983, CVE-2026-63984, CVE-2026-63985, CVE-2026-63986,
CVE-2026-63987, CVE-2026-63988, CVE-2026-63989, CVE-2026-63990,
CVE-2026-63991, CVE-2026-63992, CVE-2026-63993, CVE-2026-63994,
CVE-2026-63995, CVE-2026-63996, CVE-2026-63997, CVE-2026-63998,
CVE-2026-63999, CVE-2026-64000, CVE-2026-64001, CVE-2026-64002,
CVE-2026-64003, CVE-2026-64004, CVE-2026-64005, CVE-2026-64006,
CVE-2026-64007, CVE-2026-64008, CVE-2026-64009, CVE-2026-64010,
CVE-2026-64011, CVE-2026-64012, CVE-2026-64013, CVE-2026-64014,
CVE-2026-64015, CVE-2026-64017, CVE-2026-64018, CVE-2026-64019,
CVE-2026-64020, CVE-2026-64021, CVE-2026-64022, CVE-2026-64023,
CVE-2026-64024, CVE-2026-64025, CVE-2026-64026, CVE-2026-64027,
CVE-2026-64029, CVE-2026-64030, CVE-2026-64031, CVE-2026-64032,
CVE-2026-64033, CVE-2026-64034, CVE-2026-64035, CVE-2026-64036,
CVE-2026-64037, CVE-2026-64038, CVE-2026-64039, CVE-2026-64040,
CVE-2026-64041, CVE-2026-64042, CVE-2026-64043, CVE-2026-64044,
CVE-2026-64045, CVE-2026-64046, CVE-2026-64047, CVE-2026-64048,
CVE-2026-64049, CVE-2026-64050, CVE-2026-64051, CVE-2026-64052,
CVE-2026-64053, CVE-2026-64054, CVE-2026-64055, CVE-2026-64056,
CVE-2026-64057, CVE-2026-64058, CVE-2026-64059, CVE-2026-64060,
CVE-2026-64061, CVE-2026-64062, CVE-2026-64063, CVE-2026-64064,
CVE-2026-64065, CVE-2026-64066, CVE-2026-64067, CVE-2026-64068,
CVE-2026-64069, CVE-2026-64070, CVE-2026-64071, CVE-2026-64072,
CVE-2026-64073, CVE-2026-64074, CVE-2026-64075, CVE-2026-64076,
CVE-2026-64077, CVE-2026-64078, CVE-2026-64079, CVE-2026-64080,
CVE-2026-64081, CVE-2026-64082, CVE-2026-64083, CVE-2026-64084,
CVE-2026-64085, CVE-2026-64086, CVE-2026-64087, CVE-2026-64088,
CVE-2026-64089, CVE-2026-64090, CVE-2026-64091, CVE-2026-64093,
CVE-2026-64094, CVE-2026-64095, CVE-2026-64096, CVE-2026-64097,
CVE-2026-64098, CVE-2026-64099, CVE-2026-64100, CVE-2026-64101,
CVE-2026-64102, CVE-2026-64103, CVE-2026-64104, CVE-2026-64105,
CVE-2026-64106, CVE-2026-64107, CVE-2026-64108, CVE-2026-64109,
CVE-2026-64110, CVE-2026-64111, CVE-2026-64112, CVE-2026-64113,
CVE-2026-64114, CVE-2026-64115, CVE-2026-64116, CVE-2026-64117,
CVE-2026-64118, CVE-2026-64119, CVE-2026-64120, CVE-2026-64121,
CVE-2026-64122, CVE-2026-64123, CVE-2026-64124, CVE-2026-64125,
CVE-2026-64126, CVE-2026-64127, CVE-2026-64128, CVE-2026-64129,
CVE-2026-64130, CVE-2026-64131, CVE-2026-64132, CVE-2026-64133,
CVE-2026-64134, CVE-2026-64135, CVE-2026-64136, CVE-2026-64137,
CVE-2026-64138, CVE-2026-64140, CVE-2026-64141, CVE-2026-64142,
CVE-2026-64143, CVE-2026-64144, CVE-2026-64145, CVE-2026-64146,
CVE-2026-64147, CVE-2026-64148, CVE-2026-64149, CVE-2026-64150,
CVE-2026-64151, CVE-2026-64152, CVE-2026-64153, CVE-2026-64154,
CVE-2026-64155, CVE-2026-64156, CVE-2026-64157, CVE-2026-64158,
CVE-2026-64159, CVE-2026-64160, CVE-2026-64161, CVE-2026-64162,
CVE-2026-64163, CVE-2026-64164, CVE-2026-64165, CVE-2026-64166,
CVE-2026-64167, CVE-2026-64168, CVE-2026-64169, CVE-2026-64170,
CVE-2026-64171, CVE-2026-64172, CVE-2026-64173, CVE-2026-64174,
CVE-2026-64175, CVE-2026-64176, CVE-2026-64177, CVE-2026-64178,
CVE-2026-64179, CVE-2026-64180, CVE-2026-64181, CVE-2026-64182,
CVE-2026-64183, CVE-2026-64184, CVE-2026-64185, CVE-2026-64186)]]></content:encoded>
</item>
<item>
<title><![CDATA[Cl0p ransomware launches new large-scale data theft campaign]]></title>
<description><![CDATA[Hackers believed to be Cl0p ransomware operatives are exploiting a critical flaw in PTC Windchill and FlexPLM to deploy web shells and steal sensitive enterprise data. While the threat actor has not been identified with absolute certainty, the observed tactics closely match those used in previous...]]></description>
<link>https://tsecurity.de/de/3691313/it-security-nachrichten/cl0p-ransomware-launches-new-large-scale-data-theft-campaign/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691313/it-security-nachrichten/cl0p-ransomware-launches-new-large-scale-data-theft-campaign/</guid>
<pubDate>Fri, 24 Jul 2026 12:56:00 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Hackers believed to be Cl0p ransomware operatives are exploiting a critical flaw in PTC Windchill and FlexPLM to deploy web shells and steal sensitive enterprise data. While the threat actor has not been identified with absolute certainty, the observed tactics closely match those used in previous data theft campaigns attributed to the Cl0p ransomware gang. …</p>
<p>The post <a href="https://cyberinsider.com/cl0p-ransomware-launches-new-large-scale-data-theft-campaign/">Cl0p ransomware launches new large-scale data theft campaign</a> appeared first on <a href="https://cyberinsider.com/">CyberInsider</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Golden Chickens Launches Four Modular Malware Families to Steal Chrome Credentials and Hijack Browser Sessions]]></title>
<description><![CDATA[Golden Chickens, tracked as TAG-195 and also known as Venom Spider, has launched four new modular malware families designed to enhance credential theft, browser session hijacking, and post-exploitation flexibility. The newly identified families TinyEgg, ChonkyChicken, a modularized ChonkyChicken ...]]></description>
<link>https://tsecurity.de/de/3691311/it-security-nachrichten/golden-chickens-launches-four-modular-malware-families-to-steal-chrome-credentials-and-hijack-browser-sessions/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691311/it-security-nachrichten/golden-chickens-launches-four-modular-malware-families-to-steal-chrome-credentials-and-hijack-browser-sessions/</guid>
<pubDate>Fri, 24 Jul 2026 12:55:56 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Golden Chickens, tracked as TAG-195 and also known as Venom Spider, has launched four new modular malware families designed to enhance credential theft, browser session hijacking, and post-exploitation flexibility. The newly identified families TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator mark a clear architectural evolution in the group’s malware-as-a-service (MaaS) ecosystem, signaling a shift […]</p>
<p>The post <a href="https://gbhackers.com/four-modular-malware-families/">Golden Chickens Launches Four Modular Malware Families to Steal Chrome Credentials and Hijack Browser Sessions</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Auto-Software: Ford setzt auf natives Apple Maps bei neuer UEV-Plattform]]></title>
<description><![CDATA[Apple und Ford bauen ihre Zusammenarbeit im Auto deutlich aus. Künftige Elektro­fahrzeuge auf Fords neuer Universal Electric Vehicle Platform (UEV) erhalten Apple Maps als fest integrierte Navigationslösung. Darüber hinaus sollen Kartendaten von Apple auch Fords nächste Generation des Assistenzsy...]]></description>
<link>https://tsecurity.de/de/3691301/it-nachrichten/auto-software-ford-setzt-auf-natives-apple-maps-bei-neuer-uev-plattform/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691301/it-nachrichten/auto-software-ford-setzt-auf-natives-apple-maps-bei-neuer-uev-plattform/</guid>
<pubDate>Fri, 24 Jul 2026 12:49:26 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<img src="https://pics.computerbase.de/1/2/3/9/5/7-b08cfafbecc5db10/article-640x360.c9d6c93b.jpg"><p>Apple und Ford bauen ihre Zusammenarbeit im Auto deutlich aus. Künftige Elektro­fahrzeuge auf Fords neuer Universal Electric Vehicle Platform (UEV) erhalten Apple Maps als fest integrierte Navigationslösung. Darüber hinaus sollen Kartendaten von Apple auch Fords nächste Generation des Assistenzsystems BlueCruise unterstützen.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[NodeBB Patches Eight High-Severity Flaws Enabling XSS, Admin Bypass, and Data Theft]]></title>
<description><![CDATA[A newly disclosed eight high-severity vulnerabilities in NodeBB, a popular Node.js-based forum platform, all discovered during a six-hour AI-driven whitebox penetration test. The flaws affected default NodeBB instances prior to version 4.14.0 and included cross-site scripting (XSS), authenticatio...]]></description>
<link>https://tsecurity.de/de/3691285/it-security-nachrichten/nodebb-patches-eight-high-severity-flaws-enabling-xss-admin-bypass-and-data-theft/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691285/it-security-nachrichten/nodebb-patches-eight-high-severity-flaws-enabling-xss-admin-bypass-and-data-theft/</guid>
<pubDate>Fri, 24 Jul 2026 12:39:05 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A newly disclosed eight high-severity vulnerabilities in NodeBB, a popular Node.js-based forum platform, all discovered during a six-hour AI-driven whitebox penetration test. The flaws affected default NodeBB instances prior to version 4.14.0 and included cross-site scripting (XSS), authentication bypasses, and unauthorized data exposure. NodeBB’s maintainers responded quickly, rolling out fixes in early July 2026. NodeBB […]</p>
<p>The post <a href="https://cyberpress.org/nodebb-patches-eight-high-severity-flaws/">NodeBB Patches Eight High-Severity Flaws Enabling XSS, Admin Bypass, and Data Theft</a> appeared first on <a href="https://cyberpress.org/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[New GENE 01 Bionic Humanoid Robot Teases AMD AI Game Changer (KIMI K3 VS FLASH 3.6)]]></title>
<description><![CDATA[Author: AI News - Bewertung: 7x - Views:48 Earn $100s/hr discussing your expertise with AI as referred by AI News: https://t.mercor.com/x1Eve or https://tinyurl.com/AINewsOfficial

Generative Bionics just teased the Gene 01 humanoid robot to challenge Tesla and Boston Dynamics. In this video, we ...]]></description>
<link>https://tsecurity.de/de/3691284/it-security-video/new-gene-01-bionic-humanoid-robot-teases-amd-ai-game-changer-kimi-k3-vs-flash-36/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691284/it-security-video/new-gene-01-bionic-humanoid-robot-teases-amd-ai-game-changer-kimi-k3-vs-flash-36/</guid>
<pubDate>Fri, 24 Jul 2026 12:34:40 +0200</pubDate>
<category>🎥 IT Security Video</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Author: AI News - Bewertung: 7x - Views:48 <br/></p><p><iframe id="ytplayer" loading="lazy" type="text/html" width="100%" height="auto" src="https://www.youtube.com/embed/3p3UfAmd4Zo?autoplay=1&origin=http://tsecurity.de" frameborder="0"></iframe></p><p>Earn $100s/hr discussing your expertise with AI as referred by AI News: https://t.mercor.com/x1Eve or https://tinyurl.com/AINewsOfficial<br />
<br />
Generative Bionics just teased the Gene 01 humanoid robot to challenge Tesla and Boston Dynamics. In this video, we break down its groundbreaking multimodal tactile skin, 24 DoF hands, and open-source platform. We also see the new M1 hand from Mimic that can interchange with different robot models. AI News also compare the newly released Moonshot AI Kimmy K3 open-source 2.8T model against Google DeepMind’s closed-source Gemini 3.6 Flash API to see which reigns supreme in speed, cost, and coding performance.<br />
<br />
Discover the AI agent economy: https://8004agents.ai<br />
<br />
AI news<br />
0:00 GENE 01<br />
3:21 M1<br />
4:56 Kimi K3<br />
6:26 Gemini Flash 3.6<br />
<br />
#ai #news #technology<br/></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Email threats changed after the Tycoon2FA take-down]]></title>
<description><![CDATA[Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.



“Phishing volume linked to the platform fell 92% from pre-disruption aver...]]></description>
<link>https://tsecurity.de/de/3691276/it-nachrichten/email-threats-changed-after-the-tycoon2fa-take-down/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691276/it-nachrichten/email-threats-changed-after-the-tycoon2fa-take-down/</guid>
<pubDate>Fri, 24 Jul 2026 12:33:29 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Traditional phishing techniques are in decline as a result of the <a href="https://www.csoonline.com/article/4140890/microsoft-leads-takedown-of-tycoon2fa-phishing-service-infrastructure.html">disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform</a>, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.</p>



<p class="wp-block-paragraph">“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in <a href="https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/">the report</a>.</p>



<p class="wp-block-paragraph">The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.</p>



<p class="wp-block-paragraph">Riding this shift in were a few notable phishing campaigns, including an automated <a href="https://www.csoonline.com/article/575559/business-email-compromise-scams-take-new-dimension-with-multi-stage-attacks.html">business email compromise</a> (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.</p>



<p class="wp-block-paragraph">To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to <a href="https://www.csoonline.com/article/4176814/security-experts-caution-mfa-alone-can-no-longer-stop-threat-actors.html">MFA</a> for accounts that still require passwords.</p>



<h2 class="wp-block-heading">Tycoon2FA disruption sent attackers exploring</h2>



<p class="wp-block-paragraph">The take-down of <a href="https://www.csoonline.com/article/4100393/hybrid-2fa-phishing-kits-are-making-attacks-harder-to-detect.html">Tycoon2FA</a> forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.</p>



<p class="wp-block-paragraph">“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.</p>



<p class="wp-block-paragraph">The decline extended to QR Code <a href="https://www.csoonline.com/article/3557585/attackers-are-using-qr-codes-sneakily-crafted-in-ascii-and-blob-urls-in-phishing-emails.html">lures</a> and fake CAPTCHA <a href="https://www.csoonline.com/article/3829416/fake-captcha-attacks-are-increasing-say-experts.html">pages</a>, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.</p>



<p class="wp-block-paragraph">But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.</p>



<p class="wp-block-paragraph">The adaptation came in the form of using Microsoft <a href="https://www.csoonline.com/article/4160858/attackers-abuse-microsoft-teams-to-impersonate-the-it-helpdesk-in-a-new-enterprise-intrusion-playbook.html">Teams as a social engineering channel</a>. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.</p>



<p class="wp-block-paragraph">Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.</p>



<h2 class="wp-block-heading">Phishing changes but the defense doesn’t</h2>



<p class="wp-block-paragraph">While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.</p>



<p class="wp-block-paragraph">QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.</p>



<p class="wp-block-paragraph">BEC attacks hit 9 million in March, falling to 3.9 million in June.</p>



<p class="wp-block-paragraph">But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant <a href="https://www.csoonline.com/article/3535222/mfa-adoption-is-catching-up-but-is-not-quite-there.html">MFA</a> to reduce the effectiveness of credential theft campaigns.</p>



<p class="wp-block-paragraph">The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, <a href="https://www.csoonline.com/article/4040128/fido-undermined.html">FIDO </a>keys, and Microsoft Authenticator.</p>



<p class="wp-block-paragraph">Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.</p>



<p class="wp-block-paragraph"><em>This article first appeared on <a href="https://www.csoonline.com/article/4201146/tycoon2fa-takedown-reshapes-the-phishing-landscape.html">CSO</a>.</em></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[SourTrade Browser-Assembled Malware Defeats Hash-Based Detection by Design]]></title>
<description><![CDATA[SourTrade turns the browser itself into a malware build system, deliberately sidestepping the industry’s reliance on hash-based file fingerprints and traditional network-centric detection. SourTrade has been active since late 2024, abusing programmatic ads to reach retail traders and crypto inves...]]></description>
<link>https://tsecurity.de/de/3691260/it-security-nachrichten/sourtrade-browser-assembled-malware-defeats-hash-based-detection-by-design/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691260/it-security-nachrichten/sourtrade-browser-assembled-malware-defeats-hash-based-detection-by-design/</guid>
<pubDate>Fri, 24 Jul 2026 12:27:53 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>SourTrade turns the browser itself into a malware build system, deliberately sidestepping the industry’s reliance on hash-based file fingerprints and traditional network-centric detection. SourTrade has been active since late 2024, abusing programmatic ads to reach retail traders and crypto investors in 12 geographies across APAC, LATAM, Africa, and Western markets, including Japan, Thailand, South Korea, […]</p>
<p>The post <a href="https://gbhackers.com/sourtrade-browser-assembled/">SourTrade Browser-Assembled Malware Defeats Hash-Based Detection by Design</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[New HTTP/2 Vulnerability Lets Hackers Crash Servers With Memory Exhaustion Attacks]]></title>
<description><![CDATA[A newly disclosed HTTP/2 denial-of-service vulnerability is raising concerns across the cybersecurity community after researchers confirmed that unauthenticated attackers can crash vulnerable servers by triggering memory exhaustion conditions. The issue affects multiple HTTP/2 implementations tha...]]></description>
<link>https://tsecurity.de/de/3691259/it-security-nachrichten/new-http2-vulnerability-lets-hackers-crash-servers-with-memory-exhaustion-attacks/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691259/it-security-nachrichten/new-http2-vulnerability-lets-hackers-crash-servers-with-memory-exhaustion-attacks/</guid>
<pubDate>Fri, 24 Jul 2026 12:27:34 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A newly disclosed HTTP/2 denial-of-service vulnerability is raising concerns across the cybersecurity community after researchers confirmed that unauthenticated attackers can crash vulnerable servers by triggering memory exhaustion conditions. The issue affects multiple HTTP/2 implementations that fail to manage resource consumption properly when handling stalled data flows, enabling attackers to degrade or completely disrupt services. HTTP/2, […]</p>
<p>The post <a href="https://cybersecuritynews.com/http-2-flaw-crash-servers/">New HTTP/2 Vulnerability Lets Hackers Crash Servers With Memory Exhaustion Attacks</a> appeared first on <a href="https://cybersecuritynews.com/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Tycoon2FA takedown reshapes the phishing landscape]]></title>
<description><![CDATA[Traditional phishing techniques are in decline as a result of the disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.



“Phishing volume linked to the platform fell 92% from pre-disruption aver...]]></description>
<link>https://tsecurity.de/de/3691257/it-security-nachrichten/tycoon2fa-takedown-reshapes-the-phishing-landscape/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691257/it-security-nachrichten/tycoon2fa-takedown-reshapes-the-phishing-landscape/</guid>
<pubDate>Fri, 24 Jul 2026 12:26:57 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Traditional phishing techniques are in decline as a result of the <a href="https://www.csoonline.com/article/4140890/microsoft-leads-takedown-of-tycoon2fa-phishing-service-infrastructure.html">disruption of the Tycoon2FA phishing-as-a-service (PHaaS) platform</a>, Microsoft said in a new report, “Email threat landscape: Q2 2026 trends and insights”.</p>



<p class="wp-block-paragraph">“Phishing volume linked to the platform fell 92% from pre-disruption averages, including QR code phishing and CAPTCHA-gated phishing both declining from their March highs,” the company wrote in <a href="https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/">the report</a>.</p>



<p class="wp-block-paragraph">The takedown reduced activity across multiple phishing categories, forcing attackers to shift to newer delivery methods.</p>



<p class="wp-block-paragraph">Riding this shift in were a few notable phishing campaigns, including an automated <a href="https://www.csoonline.com/article/575559/business-email-compromise-scams-take-new-dimension-with-multi-stage-attacks.html">business email compromise</a> (BEC) campaign that reached 42,000 organizations in under three hours, and a multi-stage phishing campaign that used nested email (EML) files, calendar invitations, and a Microsoft authentication redirect to deliver malware.</p>



<p class="wp-block-paragraph">To counter phishing attacks, Microsoft recommends blocking emails containing known bad URLs/ subject fields, enabling password-less authentication methods, or moving to <a href="https://www.csoonline.com/article/4176814/security-experts-caution-mfa-alone-can-no-longer-stop-threat-actors.html">MFA</a> for accounts that still require passwords.</p>



<h2 class="wp-block-heading">Tycoon2FA disruption sent attackers exploring</h2>



<p class="wp-block-paragraph">The take-down of <a href="https://www.csoonline.com/article/4100393/hybrid-2fa-phishing-kits-are-making-attacks-harder-to-detect.html">Tycoon2FA</a> forced its operators to abandon portions of their infrastructure and rework hosting, domain registrations, and delivery mechanisms.</p>



<p class="wp-block-paragraph">“After falling 15% in March and another 22% in April, Tycoon2FA-linked phishing volume dropped 74% in May to just 1.5 million messages, then fell another 20% in June to 1.2 million, by far the lowest monthly volumes observed in at least a year,” Microsoft said.</p>



<p class="wp-block-paragraph">The decline extended to QR Code <a href="https://www.csoonline.com/article/3557585/attackers-are-using-qr-codes-sneakily-crafted-in-ascii-and-blob-urls-in-phishing-emails.html">lures</a> and fake CAPTCHA <a href="https://www.csoonline.com/article/3829416/fake-captcha-attacks-are-increasing-say-experts.html">pages</a>, two phishing techniques in which Tycoon2FA accounted for 12% and 14% of industry activity in June, respectively. This indicated that the platform’s customer base had not been able to migrate to a replacement infrastructure.</p>



<p class="wp-block-paragraph">But cutting off one head of the hacker hydra only gave rise to new tactics elsewhere.</p>



<p class="wp-block-paragraph">The adaptation came in the form of using Microsoft <a href="https://www.csoonline.com/article/4160858/attackers-abuse-microsoft-teams-to-impersonate-the-it-helpdesk-in-a-new-enterprise-intrusion-playbook.html">Teams as a social engineering channel</a>. Attackers established conversations to build trust before attempting credential theft or delivering malicious payloads. “Teams-based phishing volume climbed steadily throughout Q2, with the average number of detected attacks rising 19% from March to April, holding roughly flat into May (+1%), then increasing another 10% into June,” Microsoft said.</p>



<p class="wp-block-paragraph">Microsoft also observed a highly automated BEC campaign that reached over 67,000 users using scripted emails, Amazon Simple Email Service (SES), and engagement tracking, alongside a separate phishing campaign targeting 107,000 users that abused Microsoft’s authentication flow and trusted cloud services, including Teams archive recording and ICS calendar invite, to disguise malware delivery behind legitimate infrastructure.</p>



<h2 class="wp-block-heading">Phishing changes but the defense doesn’t</h2>



<p class="wp-block-paragraph">While QR Code and Captcha-based phishing attacks dropped significantly in the second quarter, business email compromise (BEC) charted jumped 121% between March and April, before dropping down again in May.</p>



<p class="wp-block-paragraph">QR Code phishing represented 8.3 million attacks in June 2026, down from a peak of 18.7 million in March. Similarly, Captcha-gated phishing fell from 12 million attacks in March to 2.2 million in June.</p>



<p class="wp-block-paragraph">BEC attacks hit 9 million in March, falling to 3.9 million in June.</p>



<p class="wp-block-paragraph">But even as these phishing classics lost momentum and newer techniques emerged, Microsoft’s defensive advice remained rooted in the basics. It noted organizations should complement email filtering with phishing-resistant authentication such as passkeys and phishing-resistant <a href="https://www.csoonline.com/article/3535222/mfa-adoption-is-catching-up-but-is-not-quite-there.html">MFA</a> to reduce the effectiveness of credential theft campaigns.</p>



<p class="wp-block-paragraph">The company also recommended strengthening Exchange Online Protection and Microsoft Defender for Office 365 with capabilities such as Safe links and Zero-hour Auto Purge (ZAP), in which malicious emails already delivered to mailboxes are removed before they are read, alongside enforcing password-less authentication methods like Windows Hello, <a href="https://www.csoonline.com/article/4040128/fido-undermined.html">FIDO </a>keys, and Microsoft Authenticator.</p>



<p class="wp-block-paragraph">Microsoft concluded its report with a list of indicators of compromise (IoCs) from the threats observed in the quarter to support detection efforts.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Microsoft tightens Windows enterprise activation security]]></title>
<description><![CDATA[Microsoft is making Trusted Platform Module (TPM)-backed attestation a requirement for Windows Key Management Service (KMS), the on-premises service used for Windows volume activation, replacing the software-only trust model with hardware-backed verification to strengthen enterprise activation se...]]></description>
<link>https://tsecurity.de/de/3691232/it-security-nachrichten/microsoft-tightens-windows-enterprise-activation-security/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691232/it-security-nachrichten/microsoft-tightens-windows-enterprise-activation-security/</guid>
<pubDate>Fri, 24 Jul 2026 12:09:09 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Microsoft is making Trusted Platform Module (TPM)-backed attestation a requirement for Windows Key Management Service (KMS), the on-premises service used for Windows volume activation, replacing the software-only trust model with hardware-backed verification to strengthen enterprise activation security. Attestation will become mandatory with the next Windows Server Long-Term Servicing Channel (LTSC) release. How TPM-backed KMS attestation works The KMS server uses its TPM to generate an attestation report proving its identity and integrity before activation is … <a href="https://www.helpnetsecurity.com/2026/07/24/microsoft-kms-tpm-security-update/" rel="nofollow">More <span class="meta-nav">→</span></a></p>
<p>The post <a href="https://www.helpnetsecurity.com/2026/07/24/microsoft-kms-tpm-security-update/">Microsoft tightens Windows enterprise activation security</a> appeared first on <a href="https://www.helpnetsecurity.com/">Help Net Security</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[3 cybersecurity issues that should keep every CEO awake at night]]></title>
<description><![CDATA[For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.



Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organization...]]></description>
<link>https://tsecurity.de/de/3691226/it-security-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691226/it-security-nachrichten/3-cybersecurity-issues-that-should-keep-every-ceo-awake-at-night/</guid>
<pubDate>Fri, 24 Jul 2026 12:09:02 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">For years, I have been saying that cybersecurity is no longer a technology problem. It has become a business leadership challenge.</p>



<p class="wp-block-paragraph">Yet, despite record levels of spending, ever-growing security teams, increasingly sophisticated technologies and a constant stream of new regulations, organizations continue to suffer major cyber incidents with alarming regularity. Every week seems to bring news of another ransomware attack, supply chain compromise or data breach affecting organizations that many would have assumed were well protected.</p>



<p class="wp-block-paragraph">The obvious conclusion is that we are asking the wrong questions.</p>



<p class="wp-block-paragraph">Too many executive teams remain preoccupied with the latest threat actor, the newest security product the CISO wants to buy or the latest vulnerability making headlines. Those issues matter, but they are not what should be keeping CEOs awake at night.</p>



<p class="wp-block-paragraph">In my view, there are three far more fundamental issues that deserve the attention of every chief executive.</p>



<h2 class="wp-block-heading">1. Corporate complexity, and the widening gap between business leadership and cybersecurity reality</h2>



<p class="wp-block-paragraph">Perhaps the biggest cybersecurity risk facing large organizations today is not technical at all.</p>



<p class="wp-block-paragraph">It is the growing disconnect between executive perception and operational reality.</p>



<p class="wp-block-paragraph">Many boards genuinely believe their organizations are reasonably well protected. They receive regular dashboards showing improving maturity scores, increasing compliance levels, falling vulnerability counts and reassuring traffic-light reports.</p>



<p class="wp-block-paragraph">Unfortunately, cyber attackers do not read dashboards.</p>



<p class="wp-block-paragraph">Behind those executive reports often lies an increasingly complex technology landscape, thousands of unmanaged digital assets, ageing infrastructure, rampant shadow IT, fragmented ownership, inconsistent governance and security teams struggling to keep pace with relentless business change.</p>



<p class="wp-block-paragraph">The problem is rarely a lack of effort.</p>



<p class="wp-block-paragraph">It is that corporate complexity has reached a level where traditional governance mechanisms are no longer capable of providing an accurate picture of organizational resilience.</p>



<p class="wp-block-paragraph">Executives believe they understand the level of cyber risk they face because they receive regular reports. Those reports often measure activity rather than resilience.</p>



<p class="wp-block-paragraph">Governance committees end up debating around another percentage point of phishing awareness or vulnerability remediation, while fundamental issues remain unaddressed in the background.</p>



<h2 class="wp-block-heading">2. Organizational inertia, and the need for executive structure to evolve faster</h2>



<p class="wp-block-paragraph">Cyber criminals continue to evolve rapidly. Large organizations generally do not.</p>



<p class="wp-block-paragraph">This is the second issue that should concern every CEO.</p>



<p class="wp-block-paragraph">Throughout my career, I have observed organizations repeatedly responding to new cyber threats by adding another technology platform, another monitoring capability, another compliance framework or another governance committee.</p>



<p class="wp-block-paragraph">Very rarely do they stop to redesign how cybersecurity operates.</p>



<p class="wp-block-paragraph">The result is what I described several years ago as the “<a href="https://www.amazon.com/Cybersecurity-Spiral-Failure-How-Break/dp/1637353057/">Cybersecurity Spiral of Failure</a>”.</p>



<ul class="wp-block-list">
<li>As complexity and regulation increase, organizations invest in more security products.</li>



<li>More products create more complexity.</li>



<li>More products and greater complexity generate more alerts.</li>



<li>More alerts require more analysts.</li>



<li>More analysts produce more reports.</li>



<li>More reports continue to build up executive confidence.</li>



<li>Meanwhile, the underlying structural weaknesses remain largely unchanged, technical debt piles up and costs escalate.</li>
</ul>



<p class="wp-block-paragraph">And when the inevitable breach eventually happens, reality reveals itself, but distrust also sets in between senior executives and security teams.</p>



<p class="wp-block-paragraph">This is not a funding problem. Nor is it a skills problem. It is fundamentally an operating model problem.</p>



<p class="wp-block-paragraph">Many organizations continue trying to solve twenty-first century challenges using governance, accountability, organizational and reporting structures designed twenty-five years ago.</p>



<p class="wp-block-paragraph">The cybersecurity function itself has evolved dramatically. Many executive structures have not.</p>



<p class="wp-block-paragraph">This organizational inertia extends beyond technology: It affects budgeting cycles, <a href="https://www.cio.com/article/4193990/reallocating-cybersecurity-capital-in-the-mythos-era.html">investment priorities</a>, procurement processes, accountability models and decision-making speed.</p>



<p class="wp-block-paragraph">Cyber attackers innovate every day. Organizational change often takes years.</p>



<p class="wp-block-paragraph">That imbalance should worry every CEO.</p>



<h2 class="wp-block-heading">3. Accelerating technological disruption, and how it challenges organizations in areas where they are intrinsically weak</h2>



<p class="wp-block-paragraph">The third issue is potentially the most significant over the coming decade.</p>



<ul class="wp-block-list">
<li>Artificial intelligence, autonomous agents and machine identities</li>



<li>Software supply chain complexity.</li>



<li>Quantum computing, and post-quantum cryptography</li>
</ul>



<p class="wp-block-paragraph">Each of these developments represents far more than another technical trend.</p>



<p class="wp-block-paragraph">Together, they fundamentally change the dynamics of cybersecurity.</p>



<p class="wp-block-paragraph">Artificial intelligence is transforming countless business processes. At the same time, it is also increasing both the speed and sophistication of cyber-attacks while simultaneously transforming defensive capabilities.</p>



<p class="wp-block-paragraph">Organizations have become increasingly dependent on software ecosystems that extend far beyond their own direct control. Engaging with the supply chain in ways that lead to a genuine appreciation of the risks involved has become a key challenge for most cybersecurity practices.</p>



<p class="wp-block-paragraph">Quantum computing may eventually invalidate much of today’s cryptographic algorithms, forcing organizations into one of the largest technology efforts since Y2K — but without the benefit of a fixed deadline and faced by a problem that is considerably more complex and hyperconnected IT estates that have little to do with those of the late 90s.</p>



<p class="wp-block-paragraph">None of these challenges can be solved overnight: They require clear governance, sustained investment over a few years and cross-functional organizational coordination.</p>



<p class="wp-block-paragraph">Most large organizations are weak on those three fronts: This is precisely why CEOs should be focusing on them now.</p>



<p class="wp-block-paragraph">Waiting until some of those risks become obvious will almost certainly be too late.</p>



<p class="wp-block-paragraph">Businesses naturally prioritise immediate commercial pressures. Cybersecurity often involves preparing for risks whose timing remains uncertain.</p>



<p class="wp-block-paragraph">But one of the greatest leadership failures I keep seeing remains the inability of organizations to act decisively on known unknowns.</p>



<p class="wp-block-paragraph">That tension explains why many organizations delay action until external events force them to respond. Unfortunately, cybersecurity rarely rewards late action.</p>



<h2 class="wp-block-heading">Leadership will determine who succeeds</h2>



<p class="wp-block-paragraph">Cybersecurity discussions still frequently focus on technology. I believe they should focus far more on leadership.</p>



<p class="wp-block-paragraph">Technology will continue evolving. Threat actors will continue adapting. Regulations will continue expanding. Those developments are inevitable.</p>



<p class="wp-block-paragraph">What remains within the control of every CEO is how their organization responds.</p>



<p class="wp-block-paragraph">Does cybersecurity remain an IT issue? Or is it recognised as an integral part of business resilience?</p>



<p class="wp-block-paragraph">How is cybersecurity accountability assigned at executive level? Or does it still rest largely with a CISO hidden in the organization?</p>



<p class="wp-block-paragraph">Does the board spend sufficient time discussing resilience? Or does cybersecurity appear only when approving budgets or reviewing incidents?</p>



<p class="wp-block-paragraph">These questions will increasingly determine organizational success.</p>



<p class="wp-block-paragraph">The companies that navigate the next decade successfully will not necessarily be those spending the most on cybersecurity. Nor will they be those deploying the latest security technologies first.</p>



<p class="wp-block-paragraph">They will be the organizations whose leadership recognises that cybersecurity has become a permanent business capability — embedded into governance, strategy, operational decision-making and organizational culture.</p>



<p class="wp-block-paragraph">That transformation cannot be delegated. It begins with the CEO.</p>



<p class="wp-block-paragraph">And perhaps that is the single biggest issue that should keep every chief executive awake at night: Not when the next cyber-attack will happen, but whether their organization is evolving quickly enough on those matters to meet a threat landscape that is changing much faster than the business itself.</p>



<p class="wp-block-paragraph"><strong>This article is published as part of the Foundry Expert Contributor Network.</strong><br><a href="https://www.cio.com/expert-contributor-network/"><strong>Want to join?</strong></a></p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[CIOs beware: DNS KSK rollover could kick off wave of mysterious outages]]></title>
<description><![CDATA[Predicting an outage is tricky business, but CIOs might want to circle Oct. 11, 2026, through Jan. 11, 2027, for likely trouble of a potentially widespread and puzzling nature.



That’s because a relatively trivial update to DNSSEC on Oct. 11, one that will take full effect by Jan. 11, is likely...]]></description>
<link>https://tsecurity.de/de/3691225/it-security-nachrichten/cios-beware-dns-ksk-rollover-could-kick-off-wave-of-mysterious-outages/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691225/it-security-nachrichten/cios-beware-dns-ksk-rollover-could-kick-off-wave-of-mysterious-outages/</guid>
<pubDate>Fri, 24 Jul 2026 12:09:00 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Predicting an outage is tricky business, but CIOs might want to circle Oct. 11, 2026, through Jan. 11, 2027, for likely trouble of a potentially widespread and puzzling nature.</p>



<p class="wp-block-paragraph">That’s because a relatively trivial update to DNSSEC on Oct. 11, one that will take full effect by Jan. 11, is likely to deliver a series of seemingly unrelated system outages. This will come from oceans of dependencies from third-party, shadow, agentic, gen AI, SaaS, homegrown, and legacy apps — among many other quiet executable hiding spots, including virtual environments and containers.</p>



<p class="wp-block-paragraph"><a href="https://www.linkedin.com/in/joshithak/">Sai Joshitha Kathari</a>, senior site reliability engineer at payment card giant Visa, says most enterprises have far more DNS-related exposure than they realize because of these many dependencies.</p>



<p class="wp-block-paragraph">“This has the potential to create real downstream destruction when unresolved failures sit underneath important business functions,” Kathari says. </p>



<p class="wp-block-paragraph">The danger is that so many of these issues are either unknown to IT or handled by a third-party vendor and no one in IT has had reason to ask those vendors about DNS updates. </p>



<p class="wp-block-paragraph">“The risky areas are usually not the obvious managed DNS services. They are the older internal applications, hardcoded resolvers, containerized workloads, sidecar configurations, custom scripts, partner integrations, VM images, stale base images, and service-to-service dependencies that nobody has touched in a long time,” Kathari explains. “These systems can keep working quietly for years, then fail during a DNS or certificate-related change because they bypassed the normal platform standards.”</p>



<p class="wp-block-paragraph">Independent technology analyst <a href="https://www.linkedin.com/in/carmi/">Carmi Levy</a> says that CIOs need to take this event very seriously. </p>



<p class="wp-block-paragraph">“The two-pronged deadline — October 11, 2026, when the new Key Signing Key (KSK) begins signing the root zone, and January 11, 2027, when the old key is retired — should be marked in red on everyone’s calendar, just as December 31, 1999, once was,” Levy says. “Failure to comply could result in websites, critical business applications, and related resources dropping off the face of the Earth once the transition is complete.”</p>



<p class="wp-block-paragraph">Levy adds: “Custom-built code that lives outside conventional support mechanisms may or may not function when the DNS changes go into effect.”</p>



<p class="wp-block-paragraph">The <a href="https://www.icann.org/resources/press-material/release-2026-05-20-en">DNSSEC update itself</a> is straightforward, but it is also the first significant DNSSEC change — specifically a change in the trust anchor — since 2018. </p>



<p class="wp-block-paragraph">The rollout statement noted that “the trust anchor is formally known as the Domain Name System Security Extensions (DNSSEC) root zone Key Signing Key (KSK). The KSK is the cryptographic key at the core of the DNSSEC trust anchor and is used to verify that DNS responses are legitimate and have not been modified in transit.”</p>



<h2 class="wp-block-heading">Expect nearly every enterprise to be impacted</h2>



<p class="wp-block-paragraph"><a href="https://www.linkedin.com/in/kimdavies/">Kim Davies</a>, vice president of IANA Services and president of public technical identifiers at ICANN, says the extent of the impact on enterprises is unknowable, given the nature of shadow IT and other edge cases. </p>



<p class="wp-block-paragraph">But based on the massive number of dependencies both known and unknown in the typical global enterprise, Davies guesses that just about every enterprise will be impacted, to varying degrees. </p>



<p class="wp-block-paragraph">“In highly complex organizations, it is very likely there will be some impact in the corners, in the margins, of the organization,” Davies tells CIO. “DNS is such a core technology that underpins everything.”</p>



<p class="wp-block-paragraph">As the updates propagate, hiccups will materialize, Davies notes. “When the system cannot validate the [DNS] information, it will treat it as suspect and DNS lookups will fail.”</p>



<p class="wp-block-paragraph">Visa’s Kathari says, “Enterprises should expect some secondary DNS-related glitches when major DNSSEC-related changes happen, not necessarily because the core infrastructure teams will ignore the update, but because large environments have many hidden dependency paths.”</p>



<p class="wp-block-paragraph">Making this problem far worse, Kathari notes, is that the glitches will likely initially look like anything other thana DNS glitch. That will force IT staff to waste a vast number of hours chasing causes that ultimately prove to be unrelated to the incidents. </p>



<p class="wp-block-paragraph">“The impact for CIOs is that DNS failures rarely announce themselves as DNS failures. They look like application timeouts, broken logins, failed API calls, queue lag, payment failures, partner connectivity issues, or random regional instability,” Kathari explains. “That makes troubleshooting slower because teams may spend hours looking at the application, database, network, or cloud provider before realizing name resolution is part of the failure path.”</p>



<p class="wp-block-paragraph"><a href="https://greyhoundresearch.com/svg/">Sanchit Vir Gogia</a>, chief analyst at Greyhound Research, agrees that IT will likely spin its wheels chasing the wrong ghosts.</p>



<p class="wp-block-paragraph">“A validation failure rarely stays in its lane. It surfaces as an application error, an API timeout, or a reachability problem, which turns a resolver fault into a coordination failure,” Gogia says. “The application team blames the network, the network team blames the cloud, and the user simply watches work stop.”</p>



<p class="wp-block-paragraph">“Images and templates are the frontier most teams miss,” Gogia adds. “A resolver fixed in summer can be broken again in October the instant a stale golden image is redeployed, because automation no longer lets configuration drift slowly. It restores yesterday’s assumptions at machine speed.”</p>



<p class="wp-block-paragraph">It is widely expected that enterprises will not have any problems executing the change or, more likely, relying on their hyperscalers to properly handle the change. That is the concern. </p>



<p class="wp-block-paragraph">“CIOs are being distracted so much with AI and this is such a deep in the weeds infrastructure issue that this can and willcatch people off-guard,” <a href="https://acceligence.com/talent/profiles/justin-greis/">Justin Greis</a>, CEO of consulting firm Acceligence, tells CIO. “I think we’ll see a meaningful number of enterprise disruptions associated with the DNSSEC trust anchor rollover. Not because the update itself is especially difficult, but because it will expose weaknesses that already exist inside many organizations.”</p>



<p class="wp-block-paragraph">Most enterprise IT operations have had no reason to compile a comprehensive list of all DNS dependencies, but many will be instantly discovered in January. </p>



<h2 class="wp-block-heading">Potentially widespread fallout</h2>



<p class="wp-block-paragraph">A major retailer, for example, might suddenly be unable to connect with FedEx to arrange for deliveries or a hospital may find that test results are no longer being shared with patient portals. It might manifest as an assembly line that halts because an IIoT component can no longer share files with its vendor system or a truck fleet that stops being tracked. </p>



<p class="wp-block-paragraph">“There will almost certainly be systems that fall through the cracks. Some will be legacy applications that rely on outdated DNS configurations that have not been updated in years,” Greis says. “Others will be business-unit-developed tools, contractor-built solutions, embedded systems, manufacturing and industrial systems, or highly customized workloads that operate outside normal IT oversight. These are the types of systems that often surface during infrastructure events like this.”</p>



<p class="wp-block-paragraph">Greis adds that many enterprises will discover in January problems created by their own automation.</p>



<p class="wp-block-paragraph">“Over time, enterprises build layers of processes, templates, and deployment mechanisms that are reused across teams and environments,” Greis notes. “Even after DNS infrastructure is updated correctly, older settings can inadvertently be reintroduced through routine updates and system changes, creating intermittent and difficult-to-diagnose failures.”</p>



<p class="wp-block-paragraph">The good news from this situation is that enterprises are not going to likely lose all DNS access if any of these glitches occur. But that may be of no comfort because even if the disruptions are only with small edge cases, that can still cause massive operational disruptions.</p>



<p class="wp-block-paragraph"><a href="https://www.linkedin.com/in/cricketliu/">Cricket Liu</a>, EVP and chief evangelist at Infoblox, gives the example of a DNS server that responds to factory-floor system queries.</p>



<p class="wp-block-paragraph">“Or let’s say this disrupts [an enterprise’s key] SaaS application. All name resolution may stop and it will show a server failure. It will not deliver a response whenever I look anything up. That’s not subtle at all,” Liu says. “It’s highly likely that companies are going to see some effects.”</p>



<p class="wp-block-paragraph">Back in 2017, the switchover was relatively uneventful, giving some CIOs hope that January 2027 will also be a non-event. But given the technology advancements in the last 10 years and the resulting tidal wave of new enterprise tech dependencies, few are realistically expecting no problems this go around. </p>



<h2 class="wp-block-heading">Impossible to predict what will happen</h2>



<p class="wp-block-paragraph">One of the top network experts on DNS effects in enterprises is <a href="https://blog.apnic.net/author/geoff-huston/">Geoff Huston</a>, chief scientist at the Asia Pacific Network Information Centre (APNIC), the regional Internet Registry administering IP addresses for the Asia Pacific region.</p>



<p class="wp-block-paragraph">Huston says it is difficult to project what will happen in January until it happens.</p>



<p class="wp-block-paragraph">“Just like the last time, we are flying blind with this key roll. Because nothing really terrible happened last time, there is some confidence that nothing terrible will happen this time, but we just can’t tell in advance as there are no good measurement approaches that allow us to peek inside the trust state of recursive resolvers,” he says.</p>



<p class="wp-block-paragraph">As for potential edge-case glitches, Huston says it is possible, but if third-party vendors do not properly handle the update, there will be other issues as well, as the KSK cryptographic key used within DNSSEC signs and validates the keys that protect DNS records. </p>



<p class="wp-block-paragraph">“If it is not standards-compliant, then you have more problems than just the KSK roll,” Huston says, “as it raises the obvious question of ‘What else is not correctly implemented in the DNS resolver that I’m running?’”</p>



<p class="wp-block-paragraph">As a silver lining, Acceligence’s Greis says any hiccups that result from the DNS KSK update may be a gift in disguise for CIOs. </p>



<p class="wp-block-paragraph">“The irony is that some of the most business-critical components in the technology stack are often the least visible because they work in the background,” Greis says. January “may reveal how much modern business resilience depends on infrastructure that many organizations rarely examine until something breaks. For CIOs, that’s the real lesson. This is not fundamentally a story about a DNS update. It is a story about operational visibility, resilience, and governance. Organizations that treat the rollover as a routine infrastructure task will likely complete the update and move on. Organizations that use it as an opportunity to understand and strengthen the foundations of their technology environment may gain far more value than simply avoiding an outage.”</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Microsoft tightens Windows enterprise activation security]]></title>
<description><![CDATA[Microsoft is making Trusted Platform Module (TPM)-backed attestation a requirement for Windows Key Management Service (KMS), the on-premises service used for Windows volume activation, replacing the software-only trust model with hardware-backed verification to strengthen enterprise activation se...]]></description>
<link>https://tsecurity.de/de/3691224/it-security-nachrichten/microsoft-tightens-windows-enterprise-activation-security/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691224/it-security-nachrichten/microsoft-tightens-windows-enterprise-activation-security/</guid>
<pubDate>Fri, 24 Jul 2026 12:08:57 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Microsoft is making Trusted Platform Module (TPM)-backed attestation a requirement for Windows Key Management Service (KMS), the on-premises service used for Windows volume activation, replacing the software-only trust model with hardware-backed verification to strengthen enterprise activation security. Attestation will become…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/microsoft-tightens-windows-enterprise-activation-security/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/microsoft-tightens-windows-enterprise-activation-security/">Microsoft tightens Windows enterprise activation security</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Irish IT and consulting platform Tekenable to create 30 new jobs]]></title>
<description><![CDATA[The additional roles will bring the company's number of employees to 230 by mid-2027. 
Read more: Irish IT and consulting platform Tekenable to create 30 new jobs]]></description>
<link>https://tsecurity.de/de/3691219/it-nachrichten/irish-it-and-consulting-platform-tekenable-to-create-30-new-jobs/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691219/it-nachrichten/irish-it-and-consulting-platform-tekenable-to-create-30-new-jobs/</guid>
<pubDate>Fri, 24 Jul 2026 12:03:29 +0200</pubDate>
<category>📰 IT Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>The additional roles will bring the company's number of employees to 230 by mid-2027. </p>
<p>Read more: <a rel="nofollow" href="https://www.siliconrepublic.com/jobs-news/irish-it-consulting-platform-tekenable-create-30-new-jobs">Irish IT and consulting platform Tekenable to create 30 new jobs</a></p>]]></content:encoded>
</item>
<item>
<title><![CDATA[CVE-2025-10911 | Red Hat Enterprise Linux/OpenShift Container Platform libxslt expired pointer dereference (Nessus ID 266126 / WID-SEC-2026-1287)]]></title>
<description><![CDATA[A vulnerability described as problematic has been identified in Red Hat Enterprise Linux and OpenShift Container Platform. Affected by this issue is some unknown functionality of the component libxslt. Executing a manipulation can lead to expired pointer dereference.

This vulnerability is handle...]]></description>
<link>https://tsecurity.de/de/3691133/sicherheitsluecken/cve-2025-10911-red-hat-enterprise-linuxopenshift-container-platform-libxslt-expired-pointer-dereference-nessus-id-266126-wid-sec-2026-1287/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691133/sicherheitsluecken/cve-2025-10911-red-hat-enterprise-linuxopenshift-container-platform-libxslt-expired-pointer-dereference-nessus-id-266126-wid-sec-2026-1287/</guid>
<pubDate>Fri, 24 Jul 2026 11:35:05 +0200</pubDate>
<category>🕵️ Sicherheitslücken</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[A vulnerability described as <a href="https://vuldb.com/kb/risk">problematic</a> has been identified in <a href="https://vuldb.com/product/red_hat:enterprise_linux">Red Hat Enterprise Linux and OpenShift Container Platform</a>. Affected by this issue is some unknown functionality of the component <em>libxslt</em>. Executing a manipulation can lead to expired pointer dereference.

This vulnerability is handled as <a href="https://vuldb.com/cve/CVE-2025-10911">CVE-2025-10911</a>. The attack can be executed remotely. There is not any exploit available.]]></content:encoded>
</item>
<item>
<title><![CDATA[JetBrains Patches Multiple Vulnerabilities Affecting IntelliJ IDEA and TeamCity]]></title>
<description><![CDATA[JetBrains has addressed a series of security vulnerabilities affecting IntelliJ IDEA and TeamCity, including several critical flaws that could allow code execution or unauthorized actions in development and continuous integration environments. The updates fix weaknesses in Remote Development sess...]]></description>
<link>https://tsecurity.de/de/3691119/it-security-nachrichten/jetbrains-patches-multiple-vulnerabilities-affecting-intellij-idea-and-teamcity/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691119/it-security-nachrichten/jetbrains-patches-multiple-vulnerabilities-affecting-intellij-idea-and-teamcity/</guid>
<pubDate>Fri, 24 Jul 2026 11:32:00 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>JetBrains has addressed a series of security vulnerabilities affecting IntelliJ IDEA and TeamCity, including several critical flaws that could allow code execution or unauthorized actions in development and continuous integration environments. The updates fix weaknesses in Remote Development sessions, Git and Perforce VCS integrations, workspace handling, agent registration, and permission validation. JetBrains Patches Multiple Vulnerabilities […]</p>
<p>The post <a href="https://gbhackers.com/jetbrains-patches-multiple-vulnerabilities/">JetBrains Patches Multiple Vulnerabilities Affecting IntelliJ IDEA and TeamCity</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Australian Energy Giant Origin Confirms Data Breach Exposes Customer Data]]></title>
<description><![CDATA[Origin Energy Limited has confirmed a cybersecurity incident involving unauthorized access to and disclosure of customer data, representing a significant data security event for one of Australia’s largest energy providers. The company identified the breach on July 22, 2026, and it is currently un...]]></description>
<link>https://tsecurity.de/de/3691091/it-security-nachrichten/australian-energy-giant-origin-confirms-data-breach-exposes-customer-data/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691091/it-security-nachrichten/australian-energy-giant-origin-confirms-data-breach-exposes-customer-data/</guid>
<pubDate>Fri, 24 Jul 2026 11:09:27 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Origin Energy Limited has confirmed a cybersecurity incident involving unauthorized access to and disclosure of customer data, representing a significant data security event for one of Australia’s largest energy providers. The company identified the breach on July 22, 2026, and it is currently under active investigation to determine the full extent and impact on affected […]</p>
<p>The post <a href="https://gbhackers.com/australian-energy-giant-origin-confirms-data-breach/">Australian Energy Giant Origin Confirms Data Breach Exposes Customer Data</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Apache Syncope Flaws Let Users Gain Admin Roles and Execute Remote Code]]></title>
<description><![CDATA[Apache Syncope has released versions 4.1.24.1, 4.1.24.1.2, and 4.0.74.0.7 to address six security vulnerabilities affecting the 4.1, 4.0, and 3.0 release branches. These vulnerabilities include a self-service privilege escalation bug, multiple post-authentication remote code execution (RCE) pathw...]]></description>
<link>https://tsecurity.de/de/3691054/it-security-nachrichten/apache-syncope-flaws-let-users-gain-admin-roles-and-execute-remote-code/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691054/it-security-nachrichten/apache-syncope-flaws-let-users-gain-admin-roles-and-execute-remote-code/</guid>
<pubDate>Fri, 24 Jul 2026 10:58:20 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Apache Syncope has released versions 4.1.24.1, 4.1.24.1.2, and 4.0.74.0.7 to address six security vulnerabilities affecting the 4.1, 4.0, and 3.0 release branches. These vulnerabilities include a self-service privilege escalation bug, multiple post-authentication remote code execution (RCE) pathways, authenticated server-side request forgery (SSRF), and SQL injection issues. Apache Syncope Flaws CVE-2026-62183 affects deployments that utilize the […]</p>
<p>The post <a href="https://gbhackers.com/apache-syncope-flaws/">Apache Syncope Flaws Let Users Gain Admin Roles and Execute Remote Code</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Phishing-Fallen: KI-Mails, QR-Codes, falsche Warnungen – so schützen Sie sich]]></title>
<description><![CDATA[Zwei große Änderungen hat es in den vergangenen Jahren bei Phishing-Angriffen gegeben: Die Kriminellen erstellen mithilfe von generativer KI sprachlich fast perfekte Mails, die in Stil, Struktur und Tonalität kaum noch von legitimen Nachrichten zu unterscheiden sind. Wo früher holpriges Deutsch s...]]></description>
<link>https://tsecurity.de/de/3691032/windows-tipps/phishing-fallen-ki-mails-qr-codes-falsche-warnungen-so-schuetzen-sie-sich/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3691032/windows-tipps/phishing-fallen-ki-mails-qr-codes-falsche-warnungen-so-schuetzen-sie-sich/</guid>
<pubDate>Fri, 24 Jul 2026 10:47:37 +0200</pubDate>
<category>🪟 Windows Tipps</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p>Zwei große Änderungen hat es in den vergangenen Jahren bei Phishing-Angriffen gegeben: Die Kriminellen erstellen mithilfe von generativer KI sprachlich fast perfekte Mails, die in Stil, Struktur und Tonalität kaum noch von legitimen Nachrichten zu unterscheiden sind. Wo früher holpriges Deutsch sofort Misstrauen geweckt hat, liest sich heute eine Phishing-Mail wie eine echte Mitteilung von Microsoft, einer Bank oder einem Paketdienst.</p>



<p>Auch das Design wirkt meist höchst professionell. Zum anderen sind auch die technischen Tricks beim Datendiebstahl heute höher entwickelt. Einige Maschen umgehen sogar eine Zwei-Faktor-Authentifizierung. Das Ziel der Angreifer bleiben vor allem Zugangsdaten, Session-Tokens und persönliche Infos.</p>



<h2 class="wp-block-heading">1. Microsoft-365-Log-in-Falle trickst Zwei-Faktor-Anmeldung aus</h2>



<p>Eine neue Angriffsmethode verwendet den originalen Microsoft-Anmeldedialog und kommt entsprechend fast ohne gefälschte Webseiten aus. Die Kriminellen nutzen dafür den Oauth-Device-Code-Flow. Das ist ein Anmeldeverfahren für Geräte oder Programme, die keinen brauchbaren Browser oder keine komfortable Texteingabe bieten, etwa Smart-TVs, IoT-Geräte, Drucker oder CLI-Tools. </p>



<p>Offiziell heißt er „OAuth 2.0 Device Authorization Grant“. Mit der Methode lassen sich auch Konten übernehmen, die mit einer Zwei-Faktor-Authentifizierung geschützt sind.</p>



<p>Die Kriminellen schicken an ihre Opfer eine Phishing-Nachricht und geben vor, das Gerät der Opfer müsste für den Log-in ins Microsoft-365-Konto neu autorisiert werden. Die Nachrichten beginnen meist harmlos, etwa mit „Ihre Sitzung ist abgelaufen“, und bieten einen Link zur Neuanmeldung. Wenn das Opfer dem Link in der Nachricht folgt, landet es zunächst auf einer gefälschten Website, schließlich aber beim offiziellen Microsoft-Authentifizierungsverfahren für Geräte und Anwendungen (Oauth-Device-Code-Flow).</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a63269712915"}' data-wp-interactive="core/image" class="wp-block-image size-full wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/Phishing-Fallen-M365-Phishing-Quelle-Proofpoint.jpg?quality=50&amp;strip=all" alt="Phishing Fallen M365 Phishing Quelle Proofpoint" class="wp-image-3187589" width="1140" height="1082" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button><figcaption class="wp-element-caption"><p>Bei diesem Trick übernehmen die Angreifer auch Konten, die mit einem zweiten Faktor geschützt sind. Dafür kombinieren sie die echten Authentifizierungsseiten von Microsoft und Phishing-Webseiten.</p></figcaption></figure><p class="imageCredit">Proofpoint</p></div>



<p>Es handelt sich um echte Microsoft-Meldungen und Webseiten. Allerdings autorisiert das Opfer nicht den Zugang zu seinem eigenen PC oder Smartphone, sondern eine Anwendung der Kriminellen. Diese bekommen nach der Freigabe durch das getäuschte Opfer einen Access-Token. Damit kann die feindliche Anwendung per API auf das Microsoft-Konto zugreifen, ohne dass noch einmal ein Passwort eingegeben werden muss.</p>



<p>Übrigens: Die meisten dieser Angriffe verstecken den Link zur gefälschten Website in einem QR-Code. Dieser entgeht den Spam-Filtern eher als ein üblicher Link, und es lässt die meisten Opfer vom PC auf das Smartphone wechseln. </p>



<p>Auf diesem ist es wegen des kleineren Bildschirms und oft fehlender Sicherheits-Software noch wahrscheinlicher, dass das Opfer die Täuschung nicht bemerkt. <a href="https://tinyurl.com/2xhd6n6d" target="_blank" rel="noreferrer noopener">Eine ausführliche Analyse der Angriffe auf Microsoft-365-Konten haben die Sicherheitsexperten von Proofpoint veröffentlicht</a>.</p>



<h2 class="wp-block-heading">2. Support-Masche: Ihr Computer ist gesperrt &amp; Co.</h2>



<p>Die Support-Masche ist zwar nicht neu, funktioniert aber nach wie vor: Noch immer fallen zahlreiche Menschen auf die perfide Betrugsstrategie herein. Zu den prominenten Opfern zählt Bundestagspräsidentin Julia Klöckner. </p>



<p>Mutmaßlich staatlich organisierte Angreifer kontaktierten sie über den Messenger-Dienst Signal und gaben sich als vermeintliche Signal-Support-Mitarbeiter aus. Unter einem Vorwand forderten sie Klöckner und weitere Politiker auf, ihre PIN einzugeben. Dadurch erlangten die Angreifer Zugriff auf die Signal-Konten der Betroffenen – und damit auf private Chats und Kontakte.</p>



<p>Das Bundesamt für Verfassungsschutz und das Bundesamt für Sicherheit in der Informationstechnik (BSI) haben gemeinsam einen <a href="https://tinyurl.com/yc89cfjd" target="_blank" rel="noreferrer noopener">Leitfaden veröffentlicht</a>, der potenziellen Opfern hilft zu prüfen, ob ihr Signal-Konto übernommen wurde.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a632697134c5"}' data-wp-interactive="core/image" class="wp-block-image size-full wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/Phishing-Fallen-MS-Support-Quelle-Bundesnetzagentur.png" alt="Phishing Fallen MS Support Quelle Bundesnetzagentur" class="wp-image-3187588" width="938" height="640" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button><figcaption class="wp-element-caption"><p>Phishing mit der Support-Masche. Durch eine vorgetäuschte Windows- oder Defender-Warnung werden Sie zu einem Telefongespräch mit den Angreifern gedrängt.</p></figcaption></figure><p class="imageCredit">Bundesnetzagentur</p></div>



<p>Ebenfalls weiterhin verbreitet sind Angriffe durch angebliche Microsoft-Support-Mitarbeiter. Die Betrüger kontaktieren ihre Opfer per Telefon, E-Mail oder über gefälschte Pop-up-Warnungen im Browser. </p>



<p>Dabei behaupten sie, der Windows-PC habe ein Sicherheitsproblem – etwa sei der Computer gesperrt oder mit Schadsoftware infiziert. Anschließend versuchen sie, die Betroffenen zur Installation einer Fernwartungssoftware oder eines vermeintlichen Sicherheitstools zu bewegen. Tatsächlich erhalten die Angreifer dadurch oft vollständigen Zugriff auf den Rechner.</p>



<h2 class="wp-block-heading">3. Gefälschter Microsoft Defender warnt</h2>



<p>Der Microsoft Defender ist ein Windows-Bordmittel und schützt PCs gegen alle bekannten PC-Viren. Entsprechend alarmierend ist für viele Nutzer eine Warnung dieses Antiviren-Tools. Eine gefälschte Form dieser Warnung erscheint mal per E-Mail, mal als Pop-up im Browser. In diesen Nachrichten wird behauptet, der Schutz des Defenders müsse kostenpflichtig erneuert werden. In der Folge werden die Nutzer auf gefälschte Shop-Webseiten geleitet, die eine Zahlung für einen Virenschutz verlangen.</p>



<p>Grundsätzlich gilt: Der Microsoft Defender ist auf Privat-PCs ein Bordmittel und kostenlos in Windows enthalten. Eine Zahlung ist nicht nötig. Sollte die Warnung per Mail bei Ihnen landen, löschen Sie diese einfach. Schlägt sie als Pop-up im Browser auf, schließen Sie einfach das Browser-Fenster, notfalls mit der Tastenkombination „Alt+F4”. </p>



<p><a href="https://tinyurl.com/yaz82hf3" target="_blank" rel="noreferrer noopener">Der Antivirenspezialist Norton hat eine Anleitung veröffentlicht</a>, die erklärt, wie sich solche Pop-up-Warnungen im Browser beseitigen lassen, falls sie sich im System festgesetzt haben.</p>



<h2 class="wp-block-heading">4. Microsoft-Onedrive: Cloud-Phishing über Freigaben</h2>



<p>Cloud-Dienste wie Onedrive von Microsoft nutzen viele Windows-Nutzer mehrmals täglich. Genau deshalb sind sie ein attraktives Ziel für Phishing. Statt klassischer E-Mails mit Dateianhängen erhalten die Nutzer Freigabe-Benachrichtigungen mit einem Betreff wie „Dokument wurde mit Ihnen geteilt“. Der Inhalt wirkt meist harmlos und oft beruflich relevant: Rechnungen, Projektpläne, Gehaltslisten oder interne Dokumente.</p>



<p>Besonders tückisch ist die Kombination aus echten und gefälschten Elementen. Manche Angriffe nutzen tatsächlich legitime Cloud-Plattformen, bieten dort aber manipulierte Dokumente an. Das Ziel dieser Angriffe sind mehrheitlich die Log-in-Daten der Opfer zu Ihren Cloud- und Mail-Konten. Diese werden dann von den Angreifern übernommen und etwa für neue Phishing-Attacken genutzt.</p>



<h2 class="wp-block-heading">5. Lieferdienste, Lieferdienste und noch mal Lieferdienste</h2>



<p>Phishing im Namen von Paketdiensten gehört zu den stabilsten Angriffsmustern überhaupt und wird gleichzeitig immer ausgefeilter. Der Grund ist die hohe Alltagstauglichkeit: Fast jeder erwartet regelmäßig Lieferungen und ist deshalb kaum misstrauisch, wenn eine Mail, SMS oder Whatsapp zum Thema Paketversand eintrudelt. Moderne Varianten enthalten nicht nur einfache Textlinks, sondern vollständige Tracking-Systeme.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a632697140c0"}' data-wp-interactive="core/image" class="wp-block-image size-large wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/Phishing-Fallen-Paket-Phishing.png?w=1200" alt="Phishing Fallen Paket Phishing" class="wp-image-3187584" width="1200" height="539" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button><figcaption class="wp-element-caption"><p>Hier sehen Sie vier Schritte eines vorgeblichen Lieferdienstes, der Ihnen ein Paket zustellen möchte. In weiteren Schritten sollen Sie Ihr Kundenkonto mit persönlichen Daten vervollständigen und eine Expresslieferung bezahlen.</p></figcaption></figure><p class="imageCredit">Arne Arnold</p></div>



<p>Diese Seiten sind dynamisch aufgebaut und simulieren echte Logistikprozesse. Beim Sendungsverlauf heißt es dann etwa: „Zustellung fehlgeschlagen – bitte Adresse bestätigen“ oder „Letzte Möglichkeit zur Terminänderung“. Besonders kritisch ist die Kombination aus Zeitdruck und Kontext. Wer Opfer eines solchen Angriffs wird, gibt meist seine Log-in-Daten für Shopping- oder Zahlungsdienste preis. Oder er überweist den Angreifern direkt Geld, da angeblich Steuern, Bearbeitungsgebühren oder ein Expresszuschlag fällig sind.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a632697149f8"}' data-wp-interactive="core/image" class="wp-block-image size-large wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/Phishing-Fallen-Paket-Phishing-Bezahlung.png?w=1200" alt="Phishing Fallen Paket Phishing Bezahlung" class="wp-image-3187585" width="1200" height="645" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button><figcaption class="wp-element-caption"><p>Eine Phishing-Webseite eines vorgeblichen Lieferdienstes, die hier eine Nachzahlung abrechnen möchte, bevor das Paket zugestellt werden kann.</p></figcaption></figure><p class="imageCredit">Arne Arnold</p></div>



<p>Übrigens: Ab dem 1. Juli 2026 gibt es zusätzliche Abgaben auf Sendungen aus Nicht-EU-Ländern. Für Waren unter 150 Euro sind dann pauschal 3 Euro Zollgebühr und eine Einfuhrumsatzsteuer fällig. Einige Kurierdienste verlangen zusätzlich eine Servicepauschale für diese Zollanmeldung. Über die genauen Kosten informiert <a href="https://tinyurl.com/sztfupt4" target="_blank" rel="noreferrer noopener">eine Seite der Verbraucherzentrale NRW</a>. Es lohnt sich, die tatsächlichen Kosten zu kennen, denn es ist wahrscheinlich, dass zu diesem Termin vermehrt Phishing-Mails zu diesem Thema versendet werden.</p>



<h2 class="wp-block-heading">6. Phishing zu Online-Banking gibt es immer</h2>



<p>Phishing zum Online-Banking gibt es fast schon so lange wie das Online-Banking selbst. Die Bedrohungslage ist aber so angespannt wie nie, denn die Angriffe sind nun wirklich zahlreich. <a href="https://tinyurl.com/y58m5smy" target="_blank" rel="noreferrer noopener">Über die neuesten Phishing-Fallen informieren unter anderem die Verbraucherzentralen</a>.</p>



<p>Beispiele aus dem Mai 2026 lauten etwa so: „Bestätigung Ihrer Mobilfunknummer erforderlich“. Absender ist vorgeblich die Easybank. Eine Fälschung von Commerzbank-Mails warnt vor einem fälligen „Photo-TAN Update“, bei dem ein „einmaliger Abgleich der Zugangsdaten“ nötig ist. </p>



<p>Andere Phishing-Mails geben vor, von der Deutschen Bank zu sein, und fordern eine Reaktivierung des „photoTAN-Sicherheitszertifikats“. Auch Kunden der DKB erhielten im Mai Phishing-Mails.</p>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a632697157e7"}' data-wp-interactive="core/image" class="wp-block-image size-full wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/Phishing-Fallen-commerzbank2-Quelle-Verbraucherzentrale.png" alt="Phishing Fallen commerzbank2 Quelle Verbraucherzentrale" class="wp-image-3187583" width="460" height="665" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button><figcaption class="wp-element-caption"><p>Eine aktuelle Phishing-Mail, die auf Kunden der Commerzbank abzielt. Im Text wird ordentlich Druck aufgebaut. Wer nicht reagiert, verliert angeblich „am nächsten Werktag“ den Zugriff auf sein Bankkonto.</p></figcaption></figure><p class="imageCredit">Verbraucherzentrale</p></div>



<p>Sollten Sie eine Mail von Ihrer Bank bekommen, klicken Sie auf keinen Fall auf einen der Links in dieser Mail. Wenn Sie sich unsicher sind, ob Sie reagieren sollen, rufen Sie die Website Ihrer Bank über Ihren Browser auf. </p>



<p>Sollte es tatsächlich ein Anliegen der Bank geben, wird es Ihnen nach dem Einloggen in Ihr Online-Konto angezeigt. Oder Sie rufen Ihre Bank einfach per Telefon an und fragen, ob Informationen von Ihnen benötigt werden.</p>



<h2 class="wp-block-heading">7. Phishing per Post: Kreditbetrug per Postident-Verfahren</h2>



<p>Diese Phishing-Angriffe erreichen Sie per Post in Ihrem echten Briefkasten. Die Briefe geben vor, von Ihrer Bank zu stammen, und fordern Sie auf, Ihre Daten erneut per Postident zu bestätigen. Postident ist ein Verfahren der Post, mit dem Sie Ihre Identität gegenüber anderen, etwa einer neuen Bank oder einem Kreditinstitut, bestätigen können. Wer das beigefügte Schreiben nutzt, legitimiert in der Regel einen hohen Kredit bei einer anderen Bank.</p>



<p>Schäden von 15.000 bis 25.000 Euro sind hier keine Seltenheit. Vorangegangen ist meist ein Diebstahl Ihrer genauen Daten (Postadresse, Hausbank, Arbeitgeber, Verdienst), den die Angreifer dann nutzen. An die Daten kommen die Kriminellen etwa über gefälschte Wohnungsinserate bei Immoscout24 oder ähnlichen Portalen. Wer sich auf eine Wohnung oder ein Haus mit Gehaltszetteln und weiteren Angaben bewirbt, hat bereits alle wichtigen Daten für den Postident-Betrug verraten. Seien Sie beim Postident-Verfahren stets besonders vorsichtig. Konkrete Tipps lesen Sie <a href="https://tinyurl.com/bdbnmxhn" target="_blank" rel="noreferrer noopener">hier</a>.</p>



<h2 class="wp-block-heading">Sicherheitstipps: Phishing erkennen und blockieren</h2>



<p><strong>An diesen Merkmalen erkennen Sie betrügerische Nachrichten:</strong></p>



<ul class="wp-block-list">
<li><strong>Unverlangter Kontakt:</strong> Sie erhalten eine E-Mail, Whatsapp oder SMS über eine Gutschrift, eine Lastschrift oder andere finanzielle Ansprüche, obwohl Sie aktuell keine Buchung storniert oder reklamiert haben.</li>



<li><strong>Zeitdruck:</strong> Die Nachricht suggeriert dringenden Handlungsbedarf und fordert zur schnellen Reaktion auf.</li>



<li><strong>Verdächtige Links:</strong> Die Links in der Nachricht sind hinter einem QR-Code maskiert, führen zu unpassenden Domains oder sind ungewöhnlich lang.</li>



<li><strong>Aufforderung zur Dateneingabe:</strong> Seriöse Unternehmen fordern in Nachrichten oder Mails nur äußerst selten zur Eingabe sensibler Daten auf.</li>



<li><strong>Unpersönliche Anrede:</strong> Oft fehlt die namentliche Ansprache oder es werden generische Formulierungen verwendet.</li>
</ul>



<p><strong>Diese Maßnahmen schützen vor Phishing-Fallen:</strong></p>



<ul class="wp-block-list">
<li><strong>E-Mail, SMS und Whatsapp &amp; Co. sind keine geschlossenen Nachrichtenkanäle:</strong> Sie müssen damit rechnen, auch betrügerische Nachrichten zu erhalten.</li>



<li><strong>Misstrauen Sie Links in Nachrichten:</strong> Klicken Sie keine Links an und scannen Sie keine QR-Codes, wenn Log-in-, Zahlungs- oder Sicherheitsaufforderungen in der Mail stehen. Öffnen Sie den jeweiligen Dienst im Browser über die manuelle Eingabe der Adresse.</li>



<li><strong>Nutzen Sie Browser und Passwortmanager als Frühwarnsystem: </strong>Wenn Ihr <a href="https://www.pcwelt.de/article/1204833/test-die-besten-passwort-manager.html" target="_blank" rel="noreferrer noopener">Passwortmanager</a> Ihre Log-in-Daten auf einer Webseite nicht einfügen möchte, dann ist die Domain vermutlich gefälscht. Achten Sie zudem auf die Warnungen Ihres Browsers.</li>



<li><strong>MFA aktivieren: </strong>Nutzen Sie immer eine Zwei- oder Multifaktor-Authentifizierung, wenn diese angeboten wird. Vor allem <a href="http://www.pcwelt.de/2107907" target="_blank" rel="noreferrer noopener">Passkeys</a> erhöhen die Sicherheit.</li>



<li><strong>Remote-Support misstrauen: </strong>Installieren Sie keine Fernwartungs-Tools, nachdem Sie unaufgefordert kontaktiert wurden.</li>



<li><strong>Freigaben hinterfragen: </strong>Wenn Sie Freigaben für Dateien in Cloud-Speichern erhalten, kontaktieren Sie zunächst den Absender, idealerweise telefonisch.</li>
</ul>



<p>Infos zu aktuellen Angriffen: Informieren Sie sich über Phishing-Kampagnen etwa bei der <a href="https://tinyurl.com/y58m5smy" target="_blank" rel="noreferrer noopener">Verbraucherzentrale NRW</a>.</p>



<p><strong>Als letzte Verteidigungslinie lassen sich Antivirenprogramme, Browserschutz und Spezial-Tools einsetzen:</strong></p>



<ul class="wp-block-list">
<li><strong>Antivirus:</strong> Große Sicherheits-Suiten wie <a href="https://www.awin1.com/cread.php?awinmid=14693&amp;awinaffid=486277&amp;clickref=rss&amp;platform=dl&amp;ued=http://www.gdata.de" target="_blank" rel="noreferrer noopener">G Data Internet Security</a> filtern Phishing-Mails heraus, bevor sie diese Nachrichten öffnen.</li>



<li><strong>Browser-Schutz: </strong>Browser von Sicherheitsanbietern blockieren viele aktuelle Phishing-Seiten, etwa der <a href="https://neobrowser.ai/" target="_blank" rel="noreferrer noopener">KI-Browser Norton Neo</a>.</li>



<li><strong>Spezial-Tools:</strong> KI-Chatbots wie <a href="https://www.awin1.com/cread.php?awinaffid=486277&amp;awinmid=11660&amp;clickref=rss&amp;ued=http://www.bitdefender.com/de-de/consumer/scamio" target="_blank" rel="noreferrer noopener">Scamio von Bitdefender</a> begutachten verdächtige Nachrichten und warnen vor gefährlichen Inhalten.</li>
</ul>


<div class="extendedBlock-wrapper block-coreImage undefined"><figure data-wp-context='{"imageId":"6a63269717055"}' data-wp-interactive="core/image" class="wp-block-image size-large wp-lightbox-container"><img decoding="async" data-wp-class--hide="state.isContentHidden" data-wp-class--show="state.isContentVisible" data-wp-init="callbacks.setButtonStyles" data-wp-on-async--click="actions.showLightbox" data-wp-on-async--load="callbacks.setButtonStyles" data-wp-on-async-window--resize="callbacks.setButtonStyles" src="https://b2c-contenthub.com/wp-content/uploads/2026/07/Phishing-Fallen-Verdaechtige-Website-blockiert-Neo.png?w=1200" alt="Phishing Fallen Verdaechtige Website blockiert Neo" class="wp-image-3187587" width="1200" height="645" loading="lazy"><button class="lightbox-trigger" type="button" aria-haspopup="dialog" aria-label="Enlarge" data-wp-init="callbacks.initTriggerButton" data-wp-on-async--click="actions.showLightbox" data-wp-style--right="state.imageButtonRight" data-wp-style--top="state.imageButtonTop">
				<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" fill="none" viewbox="0 0 12 12">
					<path fill="#fff" d="M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z"></path>
				</svg>
			</button><figcaption class="wp-element-caption"><p>Einen guten Phishing-Schutz erhalten Sie beispielsweise über Browser von Sicherheitsanbietern wie hier dem Browser Norton Neo.</p></figcaption></figure><p class="imageCredit">Arne Arnold</p></div>

</div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Why enterprises should care about Nokia’s AI-RAN platform]]></title>
<description><![CDATA[Earlier this month, Nokia provided an AI-RAN platform update that brings an AI-native and programmable compute which is projected to double spectral efficiency by 2028. This increases speed, but more importantly, it can allow mobile operators to create some actual monetization beyond connectivity...]]></description>
<link>https://tsecurity.de/de/3690985/it-security-nachrichten/why-enterprises-should-care-about-nokias-ai-ran-platform/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690985/it-security-nachrichten/why-enterprises-should-care-about-nokias-ai-ran-platform/</guid>
<pubDate>Fri, 24 Jul 2026 10:13:45 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Earlier this month, Nokia provided an AI-RAN platform update that brings an AI-native and programmable compute which is projected to double spectral efficiency by 2028. This increases speed, but more importantly, it can allow mobile operators to create some actual monetization beyond connectivity.</p>



<p class="wp-block-paragraph">With this release, Nokia is introducing what it calls the industry’s first commercial AI-RAN platform, built on its AI‑native anyRAN software and Nvidia’s Aerial AI-RAN stack running on merchant GPU-based accelerated computing. The company is already seeing more than 20% gains in spectral efficiency from AI-driven radio algorithms, with a roadmap to reach 50% by 2027 and more than 100% by 2028, effectively doubling capacity on existing spectrum in dense cells.</p>



<p class="wp-block-paragraph">Legacy RAN infrastructure enables connectivity but not much beyond that. The AI-RAN makes the network intelligent and extends AI into the physical world, enabling telcos to get more from their infrastructure investments, including <a href="https://www.networkworld.com/article/4128115/is-private-5g-6g-important-after-all.html">providing a path to 6G</a>. The partnership with Nvidia brings CUDA and AI into mobile environments.</p>



<p class="wp-block-paragraph">For <em>Network World</em> readers, the headline isn’t just that Nokia got to market first with AI‑RAN—it’s that the company is using AI and GPUs to break the historical coupling between radio performance and custom silicon refresh cycles, and to turn the RAN into an application platform.</p>



<h2 class="wp-block-heading">What AI-RAN actually is</h2>



<p class="wp-block-paragraph">At a technical level, Nokia’s AI‑RAN is a software‑defined baseband architecture that runs Layer 1/Layer 2 RAN functions and AI models on accelerated compute, primarily GPUs, instead of being locked into fixed‑function ASICs. <a href="https://www.linkedin.com/in/cheers/">Udayan Mukherjee</a>, Nokia’s CTO for RAN and core, summarized the vision in the <a href="https://www.networkworld.com/article/4200815/AI-RAN-analyst-briefing-20260714_095948-Meeting-Recording-2-_1_otter_ai_transcript.txt">analyst briefing</a>: “AI‑RAN is essentially a platform that turns the radio network into a true AI‑native programmable platform… one software detached from the hardware, defining flexible hardware deployment configurations, including part of the AI grid.”</p>



<p class="wp-block-paragraph">Several pillars stand out:</p>



<ul class="wp-block-list">
<li>AI‑native design: Algorithms move from traditional linear models to increasingly nonlinear techniques (e.g., advanced channel estimation, deep receivers/transmitters, RKHS-based methods), which demand tensor-heavy compute best delivered by GPUs.</li>



<li>Software-defined RAN: The same anyRAN software stack runs across different hardware configurations—plug‑in cards, standalone AI‑RAN nodes, and COTS/cloud RAN—so innovation comes via software releases rather than baseband card swaps.</li>



<li>Programmable “D‑apps” layer: Nokia is pushing a new real‑time E3 interface from Layer 1/2 into an application layer for distributed apps (D‑apps) that can tap IQ samples, channel estimation and scheduling data for use cases such as sensing and location services.</li>



<li>Crucially, this isn’t meant to replace all custom silicon overnight. Mukherjee was explicit: “We are not dropping the purpose‑built product… but we want to also get to merchant silicon, because that’s the future as we want to develop bigger models and AI elements and value‑added services on top of it.” The result is a hybrid era where AI‑accelerated platforms coexist with existing basebands but begin to shoulder the most compute‑intensive workloads.</li>
</ul>



<h2 class="wp-block-heading">Why AI-RAN matters for operators</h2>



<p class="wp-block-paragraph">Nokia and its early operator partners are trying to solve three perennial problems: finite spectrum, changing traffic patterns, and the drag of hardware refresh cycles.</p>



<p class="wp-block-paragraph">First, spectrum constraints. <a href="https://www.linkedin.com/in/aji-ed/">Aji Ed</a>, Nokia’s head of AI‑RAN and cloud RAN, called spectrum “the first constraint everybody has,” noting that operators have paid “huge amount of money” for bands and now need to “get up to the 2x spectrum” in terms of usable capacity. By running more complex AI models for multi‑user MIMO pairing, channel estimation, carrier aggregation and deep receiver/transmitter functions on GPUs, Nokia believes it can unlock those gains where traditional platforms simply run out of compute headroom.</p>



<p class="wp-block-paragraph">Second, traffic is shifting. Generative AI and distributed inference workloads are driving more uplink-heavy, latency‑sensitive patterns that current RANs weren’t designed for. AI‑RAN’s ability to adapt scheduling, beamforming and resource allocation dynamically via AI models deployed at the baseband is meant to keep up with this shift.</p>



<p class="wp-block-paragraph">Third, innovation cadence. In Ed’s words, “hardware upgrades can’t keep up with the innovation… we can’t really have a silicon refresh cycle linked with every three‑year cycle.” Nokia’s subscription‑based software model is designed to deliver new AI algorithms, spectral‑efficiency improvements and network optimization features continuously, without requiring “forklift” hardware replacements.</p>



<p class="wp-block-paragraph">For operators, the message is attractive: comparable TCO and power to existing basebands, “no hardware premium” for GPU adoption, but higher capacity and a path to new services. Nokia told analysts it has reached performance, price and energy efficiency parity between its custom GridShark silicon and GPU-based systems, while moving the baseband roadmap to merchant silicon.</p>



<h2 class="wp-block-heading">Nokia’s differentiation strategy</h2>



<p class="wp-block-paragraph">Every major RAN vendor is talking about AI‑enhanced radio, but Nokia is drawing a line between incremental gains and what it claims is a platform shift. When asked why its 2x spectral efficiency ambition is so much higher than the ~20% numbers competitors discuss, Ed pointed to the underlying architecture: “We are able to bring much more complex algorithms into this compute infrastructure… all of these require much higher compute, which is exactly what is coming from the accelerated computing.”</p>



<p class="wp-block-paragraph">Several differentiators emerge:</p>



<ul class="wp-block-list">
<li>Aggressive spectral roadmap: Nokia is targeting 1.5x by 2027 and 2x by 2028, across TDD massive MIMO and FDD scenarios, with a feature roadmap built jointly with Nvidia and other partners.</li>



<li>Single code base, three deployment paths: The same anyRAN software stack runs on (1) a GPU‑powered AirScale capacity plug‑in card, (2) a high‑capacity standalone AI‑RAN node, and (3) GPU‑based COTS/cloud RAN servers. This lets operators modernize “at their own pace” and mix brownfield evolution with greenfield AI-native deployments.</li>



<li>Open ecosystem with D‑apps: Nokia is leaning into ORAN compliance (front‑haul, O1/O2) and actively championing the E3 interface and D‑apps concept within ORAN and AI‑RAN alliances, with Bell Labs and at least two external partners already building sensing and location applications on the platform.</li>



<li>Software subscription tied to value: The commercial model builds on existing software subscriptions but ties pricing more explicitly to delivered value, such as spectral efficiency improvements and new AI services, rather than pure license metrics.</li>
</ul>



<p class="wp-block-paragraph">Mukherjee emphasized the openness angle in the briefing: “We see a lot of third‑party applications, whether it’s improving spectral efficiency or location service or sensing, can be developed on this platform… any AI‑powered services from us in Nokia or from ecosystems can be actually developed on top of it.” For operators burned by closed optimization stacks, that’s a notable pivot.</p>



<h2 class="wp-block-heading">How AI-RAN unlocks new revenue</h2>



<p class="wp-block-paragraph">Most operators will sign off on AI‑RAN if the capacity and TCO story holds, but the more strategic question is monetization beyond connectivity. Nokia’s spokespeople spent considerable time on this in the analyst call, pointing to several classes of services that are difficult or impossible to deliver without AI running in the RAN itself.</p>



<p class="wp-block-paragraph">Examples include:</p>



<ul class="wp-block-list">
<li>Integrated sensing: Turning the RAN into a distributed sensor grid that can support applications such as 3D mapping, gesture recognition and environmental monitoring, using the same RF infrastructure. Mukherjee noted, “We have at least two to three partners developing sensing applications on top of it… as well as two other companies developing location services.”</li>



<li>Physical AI and location services: For factories, logistics hubs and smart cities, AI‑RAN can provide high‑precision positioning and real‑time telemetry for robots, drones and autonomous systems by fusing radio data and AI models at the edge.</li>



<li>Distributed AI infrastructure: Operators exploring “AI‑native cities” can use AI‑RAN nodes and COTS GPU servers as a distributed inference fabric for applications that need tight latency to endpoints—think AR/VR offload, real‑time video analytics or interactive generative AI experiences.</li>



<li>Premium connectivity tiers: With fine‑grained, AI‑driven control over uplink/downlink scheduling and QoS, operators can create differentiated SLAs for enterprise slices, mission‑critical IoT and AI workloads, charging for guaranteed performance rather than best‑effort connectivity.</li>
</ul>



<p class="wp-block-paragraph">Ed framed the opportunity as a continuum: Superior connectivity from 2x spectral efficiency creates “space for new AI workloads and other use cases,” while the D‑apps ecosystem and subscription model provide a mechanism to package and sell those capabilities. In practice, that could look like:</p>



<ul class="wp-block-list">
<li>Industrial sensing-as-a-service, where Nokia and partners supply D‑apps for integrated sensing and positioning, and operators monetize them per site or per device.</li>



<li>Network‑exposed APIs for inference, location and RF sensing, integrated into operators’ broader network API portfolios as they pursue “network-as-a-platform” strategies.</li>



<li>Sector‑specific AI‑native services, such as stadium analytics, transportation corridor monitoring, or drone traffic management, built by ISVs on top of Nokia’s exposed E3 data.</li>
</ul>



<p class="wp-block-paragraph">For operators that already use Nokia’s MantaRay and SMO stacks for cross‑network optimization, AI‑RAN essentially becomes the local real‑time execution environment, while R‑apps/X‑apps continue to orchestrate macro-level behaviors. Mukherjee described this layered architecture as “DU and CU on the platform running D‑apps using E3, interfacing to X‑apps and R‑apps through E2SM and connecting to the overall management system/SMO for lifecycle management.”</p>



<h2 class="wp-block-heading">Adoption path and reality check</h2>



<p class="wp-block-paragraph">Nokia is not promising instant transformation. AI‑RAN pilots are slated for late 2026, with commercial availability on card‑based systems in 2027 and AirScale-based systems around 2028, all driven from a single software stack that supports 4G, 5G and is upgradable to 6G. The company already has trials and collaborations underway with T‑Mobile US, SoftBank, Indosat Ooredoo Hutchison, BT, Elisa, Vodafone, Orange, NTT Docomo, Deutsche Telekom and others.</p>



<p class="wp-block-paragraph">There are still open questions around 3GPP vs ORAN standardization of E3, the maturity of the D‑apps ecosystem, and how operators will digest yet another subscription layer tied to radio software. But Nokia’s move puts a stake in the ground: in the AI era, the RAN is not just a throughput engine; it’s a programmable AI computer that can be monetized.</p>



<p class="wp-block-paragraph">For <em>Network World</em> readers evaluating vendor roadmaps, this launch suggests a clear directional change. If Nokia hits its targets, AI‑RAN could mark the point where baseband becomes less about hardware SKUs and more about an AI platform strategy—one where spectral efficiency and new services are rolled out at “software speed,” as Ed described it, rather than at the pace of the next card generation.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Apache Syncope Flaws Let Users Gain Admin Roles and Execute Remote Code]]></title>
<description><![CDATA[Apache Syncope, the widely deployed open-source identity management platform, has patched a batch of critical vulnerabilities that could let low-privilege users escalate to administrator status and execute arbitrary code on the server. The Apache Software Foundation disclosed six new CVEs affecti...]]></description>
<link>https://tsecurity.de/de/3690977/it-security-nachrichten/apache-syncope-flaws-let-users-gain-admin-roles-and-execute-remote-code/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690977/it-security-nachrichten/apache-syncope-flaws-let-users-gain-admin-roles-and-execute-remote-code/</guid>
<pubDate>Fri, 24 Jul 2026 10:11:44 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Apache Syncope, the widely deployed open-source identity management platform, has patched a batch of critical vulnerabilities that could let low-privilege users escalate to administrator status and execute arbitrary code on the server. The Apache Software Foundation disclosed six new CVEs affecting versions 3.0.x, 4.0.x, and 4.1.x, with fixes rolled out in versions 4.1.2 and 4.0.7. […]</p>
<p>The post <a href="https://cyberpress.org/apache-syncope-flaws/">Apache Syncope Flaws Let Users Gain Admin Roles and Execute Remote Code</a> appeared first on <a href="https://cyberpress.org/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[2.2 Million Vehicles Exposed to KARR Bluetooth Security Flaw]]></title>
<description><![CDATA[Millions of drivers with a dealer-installed KARR Security System are being urged to update their KARR alarm using an iPhone or Android device after researchers uncovered a Bluetooth vulnerability that could allow nearby attackers to unlock or immobilize affected vehicles.  

The flaw impacts mo...]]></description>
<link>https://tsecurity.de/de/3690937/it-security-nachrichten/22-million-vehicles-exposed-to-karr-bluetooth-security-flaw/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690937/it-security-nachrichten/22-million-vehicles-exposed-to-karr-bluetooth-security-flaw/</guid>
<pubDate>Fri, 24 Jul 2026 09:54:05 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="826" height="496" src="https://thecyberexpress.com/wp-content/uploads/KARR-Security-System.webp" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="KARR Security System" decoding="async" srcset="https://thecyberexpress.com/wp-content/uploads/KARR-Security-System.webp 826w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-300x180.webp 300w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-768x461.webp 768w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-600x360.webp 600w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-150x90.webp 150w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-750x450.webp 750w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System.webp 826w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-300x180.webp 300w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-768x461.webp 768w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-600x360.webp 600w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-150x90.webp 150w, https://thecyberexpress.com/wp-content/uploads/KARR-Security-System-750x450.webp 750w" sizes="(max-width: 826px) 100vw, 826px" title="2.2 Million Vehicles Exposed to KARR Bluetooth Security Flaw 1"></p><span data-contrast="auto">Millions of drivers with a dealer-installed KARR Security System are being urged to update their KARR alarm using an iPhone or Android device after researchers uncovered a Bluetooth vulnerability that could allow nearby attackers to unlock or immobilize affected vehicles. </span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">The flaw impacts more than 2.2 million vehicles equipped with the aftermarket security system, but it does not affect factory-installed vehicle software, Apple CarPlay or Apple's iPhone platform.</span><span data-ccp-props="{}"> </span>
<h3 aria-level="2"><b><span data-contrast="none">KARR Security System Vulnerability Affects Dealer-installed Hardware</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">The KARR <a class="wpil_keyword_link" href="https://thecyberexpress.com/" title="Security" data-wpil-keyword-link="linked" data-wpil-monitor-id="29119">Security</a> System is installed by dealerships to secure vehicles on their lots. In many cases, the hardware remains connected even after buyers decline the paid KARR alarm service. Because it is third-party equipment, automakers cannot deliver fixes through their standard software update process.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">Researchers from the <a href="https://appleinsider.com/articles/26/07/22/if-youve-got-this-dealer-installed-car-alarm-patch-it-today-with-your-iphone" target="_blank" rel="nofollow noopener">University of California</a>, San Diego found that attackers within Bluetooth range could lock or unlock vehicles, disable alarms, activate horns, flash lights, or prevent parked vehicles from starting. However, they confirmed the flaw cannot remotely start a vehicle or control it while driving.</span><span data-ccp-props="{}"> </span>
<h3 aria-level="2"><b><span data-contrast="none">iPhone App Update Fixes KARR Alarm Flaw</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">Acrisure Protection Group, which sells the KARR Security System, released a firmware update on July 20 after researchers privately disclosed the issue in January 2025. Owners using the KARR Security app on an <a href="https://thecyberexpress.com/iphone-bootrom-vulnerability/" target="_blank" rel="noopener">iPhone</a> should receive an update notification. Others must download the app, connect it to the KARR alarm, then navigate to "Customer Service" and "Firmware Update."</span>

<span data-contrast="auto">The patch was released before presentations scheduled for DEF CON on August 9 in Las Vegas and the USENIX Security Symposium on August 12 in Baltimore.</span>
<h3 aria-level="2"><b><span data-contrast="none">Hidden KARR Security System Complicates Updates</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">Researchers estimate at least half of affected owners never requested the KARR Security System. Dealerships often left deactivated hardware installed, yet researchers found these units continued broadcasting <a href="https://thecyberexpress.com/apple-airpods-firmware-update/" target="_blank" rel="noopener">Bluetooth</a> signals while vehicles were running and for up to 10 minutes after being switched off.</span>

<span data-contrast="auto">Owners can identify the system by checking for a KARR or "SWDS" sticker on the driver's window or a blinking button beneath the dashboard. Most affected vehicles were purchased from Honda, Toyota, Mazda, Ford and Jeep dealerships in Southern California between 2017 and July 21, although impacted vehicles were also identified elsewhere.</span>
<h3 aria-level="2"><b><span data-contrast="none">Shared Bluetooth Key Exposes KARR Alarm Devices</span></b></h3>
<span data-contrast="auto">Researchers discovered a universal authentication key embedded in the official smartphone app while reverse engineering Bluetooth communications. Using a proof-of-concept Android app, they unlocked vehicles, disabled KARR alarm functions, and triggered horns and lights.</span>

<span data-contrast="auto">Although the flaw alone cannot steal a vehicle, researchers said it could provide quiet access before a commercially available locksmith tool creates a working key. Acrisure described the attack as "highly complex" and said the real-world <a class="wpil_keyword_link" href="https://thecyberexpress.com/what-are-risks-in-cybersecurity/" title="risk" data-wpil-keyword-link="linked" data-wpil-monitor-id="29118">risk</a> is low. Neither UC San Diego nor Wired found evidence of <a href="https://thecyberexpress.com/nation-state-hackers-weaponize-winrar-flaw/" target="_blank" rel="noopener">criminals</a> exploiting the vulnerability.</span>
<h3 aria-level="2"><b><span data-contrast="none">Privacy Concerns and Recommended Action</span></b></h3>
<span data-contrast="auto">Researchers also warned that Bluetooth signals from the KARR Security System could reveal vehicle locations. Using the WiGLE wireless database, they estimated at least 2.2 million Bluetooth-enabled systems had been deployed and detected 97 KARR-equipped vehicles during a 20-minute drive near the UC San Diego campus.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">Drivers should confirm whether their vehicle contains a KARR Security System, install the latest firmware using the iPhone or Android app, and contact their dealership or KARR support if they cannot complete the update.</span><span data-ccp-props="{}"> </span>]]></content:encoded>
</item>
<item>
<title><![CDATA[Hotel Wi-Fi DNS Poisoning Attacks Hijack Microsoft 365 Accounts Without Phishing]]></title>
<description><![CDATA[Adversaries are silently hijacking Microsoft 365 accounts by compromising hotel and conference-center Wi-Fi gateways and poisoning DNS no phishing emails, malicious attachments, or endpoint malware required. ReliaQuest assesses that the tradecraft closely mirrors prior APT28-linked router campaig...]]></description>
<link>https://tsecurity.de/de/3690936/it-security-nachrichten/hotel-wi-fi-dns-poisoning-attacks-hijack-microsoft-365-accounts-without-phishing/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690936/it-security-nachrichten/hotel-wi-fi-dns-poisoning-attacks-hijack-microsoft-365-accounts-without-phishing/</guid>
<pubDate>Fri, 24 Jul 2026 09:53:52 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Adversaries are silently hijacking Microsoft 365 accounts by compromising hotel and conference-center Wi-Fi gateways and poisoning DNS no phishing emails, malicious attachments, or endpoint malware required. ReliaQuest assesses that the tradecraft closely mirrors prior APT28-linked router campaigns, extending them into captive-portal infrastructure used by traveling corporate staff. Since at least June 2026, threat actors have […]</p>
<p>The post <a href="https://gbhackers.com/hotel-wi-fi-dns-poisoning-attacks/">Hotel Wi-Fi DNS Poisoning Attacks Hijack Microsoft 365 Accounts Without Phishing</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Anthropic Upgrades Claude Voice Mode With Opus and Sonnet Support]]></title>
<description><![CDATA[Claude voice mode now supports Anthropic’s Opus and Sonnet models, giving users access to stronger reasoning and more capable responses during spoken conversations. Until now, voice mode only worked with the faster Haiku model, which focused more on speed than deeper analysis.







The upgrade ...]]></description>
<link>https://tsecurity.de/de/3690931/ios-mac-os/anthropic-upgrades-claude-voice-mode-with-opus-and-sonnet-support/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690931/ios-mac-os/anthropic-upgrades-claude-voice-mode-with-opus-and-sonnet-support/</guid>
<pubDate>Fri, 24 Jul 2026 09:40:42 +0200</pubDate>
<category>🍏 iOS / Mac OS</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[Claude voice mode now supports Anthropic’s Opus and Sonnet models, giving users access to stronger reasoning and more capable responses during spoken conversations. Until now, voice mode only worked with the faster Haiku model, which focused more on speed than deeper analysis.







The upgrade brings Claude’s voice experience closer to the intelligence already available through text chats. Paid users can now use the more advanced models while speaking, which should make voice conversations more useful for research, planning, writing, and detailed questions.




https://www.youtube.com/watch?v=GWnNMfFivnk




Claude voice mode gets model switching and connectors



Anthropic also lets users switch between models while using voice mode, so they can choose a faster or more capable option based on the task. Voice mode now works with connectors as well, allowing Claude to interact with supported tools and services during a conversation.



The updated voice mode supports 11 languages:




English



French



German



Hindi



Indonesian



Italian



Japanese



Korean



Portuguese in Brazil



Spanish in Latin America



Spanish in Spain




Users can also switch between supported languages during the same voice session. Claude voice mode is available through Anthropic’s mobile, desktop, and web apps, making the upgraded experience accessible across major platforms.]]></content:encoded>
</item>
<item>
<title><![CDATA[Google Chrome 150 Update Fixes Four High-Severity Security Vulnerabilities]]></title>
<description><![CDATA[Google Chrome version 150.0.7871.186 has addressed four high-severity vulnerabilities that affect core browser components, including Codecs, WebMCP, Blink, and Input. While Google has not reported any evidence indicating that these vulnerabilities are actively being exploited, the company has res...]]></description>
<link>https://tsecurity.de/de/3690925/it-security-nachrichten/google-chrome-150-update-fixes-four-high-severity-security-vulnerabilities/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690925/it-security-nachrichten/google-chrome-150-update-fixes-four-high-severity-security-vulnerabilities/</guid>
<pubDate>Fri, 24 Jul 2026 09:38:44 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Google Chrome version 150.0.7871.186 has addressed four high-severity vulnerabilities that affect core browser components, including Codecs, WebMCP, Blink, and Input. While Google has not reported any evidence indicating that these vulnerabilities are actively being exploited, the company has restricted access to technical bug reports and related information until a majority of Chrome users receive the […]</p>
<p>The post <a href="https://gbhackers.com/google-chrome-150-update/">Google Chrome 150 Update Fixes Four High-Severity Security Vulnerabilities</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Claude Cowork Sandbox Escape Flaw Lets AI Agent Read SSH Keys and Cloud Credentials From Host]]></title>
<description><![CDATA[A serious security flaw has been discovered in Claude Cowork’s local sandbox, allowing a malicious AI agent to escape its Linux virtual machine (VM) and access the host Mac’s filesystem. This breach can enable the agent to read sensitive information, including SSH private keys and cloud credentia...]]></description>
<link>https://tsecurity.de/de/3690923/it-security-nachrichten/claude-cowork-sandbox-escape-flaw-lets-ai-agent-read-ssh-keys-and-cloud-credentials-from-host/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690923/it-security-nachrichten/claude-cowork-sandbox-escape-flaw-lets-ai-agent-read-ssh-keys-and-cloud-credentials-from-host/</guid>
<pubDate>Fri, 24 Jul 2026 09:38:41 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A serious security flaw has been discovered in Claude Cowork’s local sandbox, allowing a malicious AI agent to escape its Linux virtual machine (VM) and access the host Mac’s filesystem. This breach can enable the agent to read sensitive information, including SSH private keys and cloud credentials, without any user prompts. The root of this […]</p>
<p>The post <a href="https://cybersecuritynews.com/claude-cowork-sandbox-escape-flaw/">Claude Cowork Sandbox Escape Flaw Lets AI Agent Read SSH Keys and Cloud Credentials From Host</a> appeared first on <a href="https://cybersecuritynews.com/">Cyber Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Thailand SEC Files Criminal Complaint Against Bitkub Over 2021 Cyberattack]]></title>
<description><![CDATA[Thailand's cryptocurrency exchange Bitkub has rejected allegations of fraud after the Thailand SEC filed a criminal complaint related to the company's disclosures following the Bitkub cyberattack in 2021. The case focuses on how the exchange reported the impact of the cyberattack on Bitkub to reg...]]></description>
<link>https://tsecurity.de/de/3690896/it-security-nachrichten/thailand-sec-files-criminal-complaint-against-bitkub-over-2021-cyberattack/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690896/it-security-nachrichten/thailand-sec-files-criminal-complaint-against-bitkub-over-2021-cyberattack/</guid>
<pubDate>Fri, 24 Jul 2026 09:10:24 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p><img width="832" height="515" src="https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack.webp" class="attachment-post-thumbnail size-post-thumbnail wp-post-image" alt="Bitkub cyberattack" decoding="async" srcset="https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack.webp 832w, https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack-300x186.webp 300w, https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack-768x475.webp 768w, https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack-600x371.webp 600w, https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack-150x93.webp 150w, https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack-750x464.webp 750w, https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack.webp 832w, https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack-300x186.webp 300w, https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack-768x475.webp 768w, https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack-600x371.webp 600w, https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack-150x93.webp 150w, https://thecyberexpress.com/wp-content/uploads/Bitkub-cyberattack-750x464.webp 750w" sizes="(max-width: 832px) 100vw, 832px" title="Thailand SEC Files Criminal Complaint Against Bitkub Over 2021 Cyberattack 1"></p><span data-contrast="auto">Thailand's cryptocurrency exchange Bitkub has rejected allegations of fraud after the Thailand SEC filed a criminal complaint related to the company's disclosures following the Bitkub cyberattack in 2021. The case focuses on how the exchange reported the impact of the cyberattack on Bitkub to regulators, rather than on the safety of customer funds.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">In response to the complaint, Bitkub stated that all customer assets currently held on its platform remain safe, fully accounted for, and protected in accordance with applicable regulations. The company argued that the allegations stem from decisions made during the aftermath of the 2021 <a class="wpil_keyword_link" href="https://thecyberexpress.com/" title="security" data-wpil-keyword-link="linked" data-wpil-monitor-id="29116">security</a> breach and do not reflect fraudulent conduct.</span><span data-ccp-props="{}"> </span>
<h3><strong>Thailand SEC Files Complaint Over the 2021 Bitkub Cyberattack </strong></h3>
<span data-contrast="auto">On 23 July 2026, the<a href="https://www.sec.or.th/EN/Pages/News_Detail.aspx?SECID=13139" target="_blank" rel="nofollow noopener"> Thailand SEC filed a criminal complaint</a> against Bitkub Online Co., Ltd. and its former directors, Sakolkorn Sakavee and Thaweesap Rawan. The regulator alleged that the company's daily net capital reports submitted between 10 May and 30 October 2021 failed to accurately reflect the material reduction in its digital asset holdings caused by the Bitkub <a class="wpil_keyword_link" href="https://thecyberexpress.com/cyber-news/" title="cyberattack" data-wpil-keyword-link="linked" data-wpil-monitor-id="29115">cyberattack</a>.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">According to the regulator, the reports did not disclose the impact of the theft on the company's asset balance. The Thailand SEC also accused the two former directors of making false entries in company documents that gave the impression that customer assets were still being held normally and that the company had not suffered any damage.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">The complaint has been referred to Thailand's Economic Crime Suppression Division for further investigation. Following that process, the matter may be forwarded to prosecutors and the courts. The Thailand SEC noted that filing a <a href="https://thecyberexpress.com/fake-emails-scam-indians-heres-what-to-know/" target="_blank" rel="noopener">criminal complaint</a> does not represent a final determination of guilt.</span><span data-ccp-props="{}"> </span>
<h3><strong>Bitkub Says Disclosure Decision was Intended to Prevent Customer Losses</strong></h3>
<span data-contrast="auto">Following media reports about the complaint, <a href="https://www.linkedin.com/posts/on-23-july-2026-news-reports-emerged-regarding-share-7486045546315694081-abKc/?utm_source=share&amp;utm_medium=member_android&amp;rcm=ACoAAAfAnJwBMfzai0rLzfzxnZE_NCnVt2ZLE_o" target="_blank" rel="nofollow noopener">Bitkub published a statement on LinkedIn</a> explaining its position on the cyberattack and the subsequent reporting decisions.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">The company said the allegations relate to an incident in early May 2021, when one of its digital asset wallets was compromised by cybercriminals. Bitkub acknowledged that the breach was not disclosed at the time.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">According to the company, the individual responsible for disclosure obligations deliberately withheld information about the wallet compromise. Bitkub said the decision was made to avoid triggering a "bank run," or mass withdrawals of digital assets by customers, while the company worked to replace the stolen assets.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">The exchange stated:</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">"The decision of such individual not to disclose the incident was made with the intention to prevent a bank run—that is, a mass withdrawal of digital assets by customers upon learning of the theft—which could have rendered the Company unable to procure sufficient replacement digital assets for the customers while the recovery process was still ongoing."</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">Bitkub added that such a scenario could have resulted in significant customer losses and broader damage to Thailand's digital asset industry.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">The company also stressed that, at the time of the Bitkub <a class="wpil_keyword_link" href="https://thecyberexpress.com/what-is-a-cyber-attack/" title="cyberattack" data-wpil-keyword-link="linked" data-wpil-monitor-id="29117">cyberattack</a>, all of its digital asset wallet security systems complied with standards prescribed by the relevant authorities and had been audited.</span><span data-ccp-props="{}"> </span>
<h3 aria-level="2"><b><span data-contrast="none">Co-founders Replaced Stolen Assets After Cyberattack on Bitkub</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">Although the digital assets stolen during the cyberattack on Bitkub were never recovered, the company said its co-founders voluntarily absorbed the <a href="https://thecyberexpress.com/keytronic-reveals-million-loss-cyberattack/" target="_blank" rel="noopener">financial loss</a>.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">According to Bitkub, the co-founders purchased digital assets matching the same types and quantities as those stolen and transferred them to the company. As a result, the exchange said neither its customers nor the business ultimately suffered any financial loss from the incident.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">In its statement, Bitkub said:</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">"As no bank run occurred, even though the stolen digital assets could not be recovered, the Co-Founders of the Bitkub Group voluntarily absorbed the loss by purchasing equivalent digital assets (in the same type and quantity as those stolen) and providing them to the Company. Consequently, neither the Company nor its customers suffered any financial loss from the theft."</span><span data-ccp-props="{}"> </span>
<h3 aria-level="2"><b><span data-contrast="none">Thailand SEC Previously Confirmed Customer Assets Were Intact</span></b><span data-ccp-props='{"134245418":true,"134245529":true,"335559738":160,"335559739":80}'> </span></h3>
<span data-contrast="auto">Bitkub also pointed to the findings of an earlier inspection conducted by the Thailand SEC after reports of the Bitkub cyberattack surfaced online.</span><span data-ccp-props="{}"> </span><span data-contrast="auto">According to the company, the regulator verified that, as of 8 September 2025, all customer assets held by the exchange were safe and fully accounted for.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">The company reiterated this point in its latest statement, saying:</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">"At the outset, for the sake of clarity and mutual understanding, the Company wishes to affirm that all customers' assets currently held by the Company are safe and fully accounted for. The Company reiterates its strict compliance with all applicable laws and regulations in safeguarding and maintaining customer assets."</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">Bitkub maintained that the criminal complaint relates to historical reporting practices between May and October 2021, more than five years ago, rather than to the current condition of customer assets or any ongoing security concerns.</span><span data-ccp-props="{}"> </span>

<span data-contrast="auto">As the investigation proceeds, the case will determine whether the company's reporting following the Bitkub cyberattack complied with regulatory requirements. For now, the complaint remains an allegation, and the legal process involving the Thailand SEC, investigators, prosecutors, and the courts has yet to reach a final conclusion.</span><span data-ccp-props="{}"> </span>]]></content:encoded>
</item>
<item>
<title><![CDATA[Ransomware groups are hammering your vulnerable VPNs]]></title>
<description><![CDATA[Cybercriminals are actively exploiting a recently discovered vulnerability in Palo Alto Networks firewall and VPN appliances to deploy the Qilin ransomware strain.



A critical authentication bypass flaw (CVE-2026-0257) in Palo Alto GlobalProtect portal and gateway was the common link in a serie...]]></description>
<link>https://tsecurity.de/de/3690892/it-security-nachrichten/ransomware-groups-are-hammering-your-vulnerable-vpns/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690892/it-security-nachrichten/ransomware-groups-are-hammering-your-vulnerable-vpns/</guid>
<pubDate>Fri, 24 Jul 2026 09:10:09 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<div>
		<div class="grid grid--cols-10@md grid--cols-8@lg article-column">
					  <div class="col-12 col-10@md col-6@lg col-start-3@lg">
						<div class="article-column__content">
<section class="wp-block-bigbite-multi-title"><div class="container"></div></section>



<p class="wp-block-paragraph">Cybercriminals are actively exploiting a recently discovered vulnerability in Palo Alto Networks firewall and VPN appliances to deploy the Qilin <a href="https://www.csoonline.com/article/563507/what-is-ransomware-how-it-works-and-how-to-remove-it.html">ransomware</a> strain.</p>



<p class="wp-block-paragraph">A critical authentication bypass flaw (<a href="https://nvd.nist.gov/vuln/detail/cve-2026-0257">CVE-2026-0257</a>) in Palo Alto GlobalProtect portal and gateway was the common link in a series of intrusions in June, Arctic Wolf Labs warns. Exploitation of the vulnerability <a href="https://www.csoonline.com/article/4179847/attackers-exploit-palo-alto-globalprotect-flaw-days-after-disclosure.html">came within days of disclosure</a>.</p>



<p class="wp-block-paragraph">“Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella,” Arctic Wolf’s researchers <a href="https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/">wrote in a post on the threat</a>.</p>



<p class="wp-block-paragraph">The campaign against Palo Alto’s VPN client is part of a rising trend that sees ransomware groups increasingly targeting vulnerabilities in network edge tools and devices.</p>



<h2 class="wp-block-heading">Ransomware takes aim at the edge</h2>



<p class="wp-block-paragraph">Beyond GlobalProtect, <a href="https://www.csoonline.com/article/4079316/cross-platform-ransomware-qilin-weaponizes-linux-binaries-against-windows-hosts.html">Qilin</a> — the most active threat group in Q2 2026, responsible for 14% of attacks, according to <a href="https://www.nccgroup.com/resource-hub/cyber-threat-intelligence-reports/">NCC Group’s latest Quarterly Cyber Threat Intelligence Report</a> —  has also targeted flaws in Fortinet’s FortiGate, Citrix NetScaler, and Check Point Remote Access VPN.</p>



<p class="wp-block-paragraph">Check Point warned in June of <a href="https://www.csoonline.com/article/4182898/check-point-warns-of-ransomware-linked-attacks-exploiting-outdated-vpn-protocol.html">ransomware attacks against VPNs</a> that still use the deprecated Internet Key Exchange version 1 (IKEv1) protocol. Citrix issued patches in early July for a <a href="https://www.csoonline.com/article/4192741/new-citrixbleed-like-netscaler-flaw-sees-exploit-attempts-in-the-wild.html">CitrixBleed-like flaw</a> in its NetScalar devices that had come under attack.</p>



<p class="wp-block-paragraph">Meanwhile, Fortibleed, a massive credential-compromise campaign, <a href="https://www.csoonline.com/article/4186790/fortibleed-campaign-exposes-75000-fortinet-firewalls-worldwide.html">exposed 75,000 FortiGate firewalls in June</a>.  </p>



<p class="wp-block-paragraph">Qilin is by no means alone in increasing its operations against VPNs and other network security tools.</p>



<p class="wp-block-paragraph"><a href="https://www.csoonline.com/article/4178580/the-gentlemen-are-coming-for-your-files-and-then-your-network.html">The Gentlemen</a>, No. 2 on NCC Group’s list with 238 victims in Q2 2026, is noted for breaking into organizations through firewalls, VPNs, and other internet-exposed systems — FortiGate and Cisco products in particular.</p>



<p class="wp-block-paragraph">Akira, No. 4 on NCC Group’s list (127 victims), is also known for exploiting VPN vulnerabilities and abusing legitimate credentials, primarily versus <a href="https://www.twinstrata.com/news/akira-ransomware/">products from Ivanti, Cisco, and Fortinet</a>.</p>



<h2 class="wp-block-heading">In the line of fire</h2>



<p class="wp-block-paragraph">Network edge security devices are becoming security liabilities for enterprise security professionals, with an alarming rise in zero-day exploits arising from what experts describe as <a href="https://www.csoonline.com/article/4074945/network-security-devices-endanger-orgs-with-90s-era-flaws.html">basic and readily preventable vulnerabilities</a>.</p>



<p class="wp-block-paragraph">A range of attackers spanning opportunistic hackers to ransomware-as-a-service operators and nation-state sponsored APT (advanced persistent threat) groups are actively exploiting software vulnerabilities in edge devices to hack into corporate networks.</p>



<p class="wp-block-paragraph">“Although there has not been a material rise in ransomware volume in the last quarter, the trajectory of attacks continues upwards, and VPNs remain an increasingly attractive target,” said Matt Hull, VP and head of cyber intelligence and response at NCC Group.</p>



<p class="wp-block-paragraph">Unpatched vulnerabilities in edge devices are far from the only software bugs fueling ransomware attacks. For example, last year the <a href="https://www.csoonline.com/article/4068379/oracle-issues-emergency-patch-for-zero-day-flaw-exploited-by-cl0p-ransomware-gang.html">Clop ransomware gang hacked hundreds of companies</a> by exploiting zero-day vulnerabilities in Oracle’s E-Business Suite software.</p>



<h2 class="wp-block-heading">Edge of darkness</h2>



<p class="wp-block-paragraph">VPNs and other internet-facing edge devices remain prime targets for ransomware operators because they provide a direct route into an organization’s network.</p>



<p class="wp-block-paragraph">“Attackers may exploit an unpatched vulnerability, use stolen credentials, or target weak authentication controls,” said Alexander Leslie, a senior advisor at cyber threat intelligence firm Recorded Future. “In some cases, exploitation begins before organizations have had sufficient time to apply vendor guidance, leaving security teams with a very narrow window to respond.”</p>



<p class="wp-block-paragraph">VPN exploitation sits alongside other initial access methods, such as phishing, compromised credentials, or software supply chain attacks. The preferred attacker infiltration method varies by campaign and sector but locating security in edge devices carry particular advantages from the perspective of attackers.</p>



<p class="wp-block-paragraph">“Vulnerabilities in perimeter devices are particularly valuable to attackers because those systems are continuously exposed to the internet and can provide privileged access while bypassing some endpoint controls,” said Leslie.</p>



<p class="wp-block-paragraph">Dray Agha, senior manager of security operations at managed detection and response firm Huntress, backed up this assessment that exploiting internet-facing VPNs and edge devices remains the “dominant, volume-driven tactic” for ransomware operators because these appliances offer a “direct, publicly accessible gateway straight into the heart of corporate networks.”</p>



<p class="wp-block-paragraph">Rather than exploiting vulnerabilities in edge devices, attackers more commonly use internet-facing gateways as a means to abuse stolen credentials to break into corporate networks, according to Huntress.</p>



<p class="wp-block-paragraph">“What we see at Huntress is that the VPN is the site of initial access some 70% of the time, for advanced threat actors,” said Agha. “Overwhelmingly, however, they are not exploiting for access; rather they are using stolen credentials to authenticate to non-MFA’d [multi-factor authentication] user accounts.”</p>



<h2 class="wp-block-heading">Hardened perimeter</h2>



<p class="wp-block-paragraph">CSOs should treat their network perimeter as hostile territory by enforcing aggressive patch management, applying critical edge device updates within 24 to 48 hours, and mandating strict MFA for all access.</p>



<p class="wp-block-paragraph">Implementing zero-trust network segmentation to trap attackers and prevent lateral movement if the initial gateway is compromised also helps in making enterprise networks more resilient against attacks, Huntress’ Agha advised.</p>



<p class="wp-block-paragraph">Phishing-resistant multi-factor authentication, removal of unsupported systems, and close monitoring for unusual authentication or administrative activity also form key components in attack impact mitigation.</p>



<p class="wp-block-paragraph">Internet-facing assets that are known to be actively exploited should be prioritized as a patching priority.</p>



<p class="wp-block-paragraph">“Threat intelligence and evidence of active exploitation should help determine which vulnerabilities demand immediate action,” Recorded Future’s Leslie said.</p>
</div></div></div></div>]]></content:encoded>
</item>
<item>
<title><![CDATA[Lampion Malware Targets Portuguese Users With Multistage Phishing and 750MB RAT Payload]]></title>
<description><![CDATA[A highly targeted Lampion malware campaign abusing localized phishing lures to compromise users in Portugal. The activity reflects a continued evolution of the Brazilian-origin banking trojan, first documented in 2019, which has consistently focused on Portuguese-speaking victims rather than dome...]]></description>
<link>https://tsecurity.de/de/3690891/it-security-nachrichten/lampion-malware-targets-portuguese-users-with-multistage-phishing-and-750mb-rat-payload/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690891/it-security-nachrichten/lampion-malware-targets-portuguese-users-with-multistage-phishing-and-750mb-rat-payload/</guid>
<pubDate>Fri, 24 Jul 2026 09:10:03 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A highly targeted Lampion malware campaign abusing localized phishing lures to compromise users in Portugal. The activity reflects a continued evolution of the Brazilian-origin banking trojan, first documented in 2019, which has consistently focused on Portuguese-speaking victims rather than domestic Brazilian targets. In the latest campaign, attackers leverage convincing financial-themed phishing emails masquerading as routine […]</p>
<p>The post <a href="https://gbhackers.com/lampion-malware-targets-portuguese/">Lampion Malware Targets Portuguese Users With Multistage Phishing and 750MB RAT Payload</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Claude Cowork Sandbox Escape Flaw Lets Attackers Access SSH Keys and Cloud Credentials]]></title>
<description><![CDATA[A newly revealed sandbox escape vulnerability affecting Anthropic’s Claude Cowork could allow untrusted content processed by the AI agent to access sensitive files on a macOS host. This includes SSH private keys, cloud credentials, and other data that are available…
Read more →
The post Claude Co...]]></description>
<link>https://tsecurity.de/de/3690887/it-security-nachrichten/claude-cowork-sandbox-escape-flaw-lets-attackers-access-ssh-keys-and-cloud-credentials/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690887/it-security-nachrichten/claude-cowork-sandbox-escape-flaw-lets-attackers-access-ssh-keys-and-cloud-credentials/</guid>
<pubDate>Fri, 24 Jul 2026 09:09:48 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A newly revealed sandbox escape vulnerability affecting Anthropic’s Claude Cowork could allow untrusted content processed by the AI agent to access sensitive files on a macOS host. This includes SSH private keys, cloud credentials, and other data that are available…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/claude-cowork-sandbox-escape-flaw-lets-attackers-access-ssh-keys-and-cloud-credentials/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/claude-cowork-sandbox-escape-flaw-lets-attackers-access-ssh-keys-and-cloud-credentials/">Claude Cowork Sandbox Escape Flaw Lets Attackers Access SSH Keys and Cloud Credentials</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[IT Security News Hourly Summary 2026-07-24 09h : 11 posts]]></title>
<description><![CDATA[11 posts were published in the last hour 7:3 : Claude Cowork Sandbox Escape Flaw Lets Attackers Access SSH Keys and Cloud Credentials 7:2 : Lampion Malware Targets Portuguese Users With Multistage Phishing and 750MB RAT Payload 7:2 : The…
Read more →
The post IT Security News Hourly Summary 2026-...]]></description>
<link>https://tsecurity.de/de/3690886/it-security-nachrichten/it-security-news-hourly-summary-2026-07-24-09h-11-posts/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690886/it-security-nachrichten/it-security-news-hourly-summary-2026-07-24-09h-11-posts/</guid>
<pubDate>Fri, 24 Jul 2026 09:09:43 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>11 posts were published in the last hour 7:3 : Claude Cowork Sandbox Escape Flaw Lets Attackers Access SSH Keys and Cloud Credentials 7:2 : Lampion Malware Targets Portuguese Users With Multistage Phishing and 750MB RAT Payload 7:2 : The…</p>
<p class="more-link-p"><a class="more-link" href="https://www.itsecuritynews.info/it-security-news-hourly-summary-2026-07-24-09h-11-posts/">Read more →</a></p>
<p>The post <a href="https://www.itsecuritynews.info/it-security-news-hourly-summary-2026-07-24-09h-11-posts/">IT Security News Hourly Summary 2026-07-24 09h : 11 posts</a> appeared first on <a href="https://www.itsecuritynews.info/">IT Security News</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Claude Cowork Sandbox Escape Flaw Lets Attackers Access SSH Keys and Cloud Credentials]]></title>
<description><![CDATA[A newly revealed sandbox escape vulnerability affecting Anthropic’s Claude Cowork could allow untrusted content processed by the AI agent to access sensitive files on a macOS host. This includes SSH private keys, cloud credentials, and other data that are available to the logged-in user. Security...]]></description>
<link>https://tsecurity.de/de/3690856/it-security-nachrichten/claude-cowork-sandbox-escape-flaw-lets-attackers-access-ssh-keys-and-cloud-credentials/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690856/it-security-nachrichten/claude-cowork-sandbox-escape-flaw-lets-attackers-access-ssh-keys-and-cloud-credentials/</guid>
<pubDate>Fri, 24 Jul 2026 08:58:01 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A newly revealed sandbox escape vulnerability affecting Anthropic’s Claude Cowork could allow untrusted content processed by the AI agent to access sensitive files on a macOS host. This includes SSH private keys, cloud credentials, and other data that are available to the logged-in user. Security researcher Oren Yomtov from Accomplish has named this attack path […]</p>
<p>The post <a href="https://gbhackers.com/claude-cowork-sandbox-escape-flaw/">Claude Cowork Sandbox Escape Flaw Lets Attackers Access SSH Keys and Cloud Credentials</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Attackers Abuse Microsoft Teams to Impersonate IT Support and Steal Corporate Access]]></title>
<description><![CDATA[Attackers are increasingly abusing Microsoft Teams to impersonate internal IT support and trick employees into handing over remote access and corporate credentials, even as traditional email phishing volumes tied to major platforms like Tycoon2FA decline. Microsoft’s recent email threat landscape...]]></description>
<link>https://tsecurity.de/de/3690814/it-security-nachrichten/attackers-abuse-microsoft-teams-to-impersonate-it-support-and-steal-corporate-access/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690814/it-security-nachrichten/attackers-abuse-microsoft-teams-to-impersonate-it-support-and-steal-corporate-access/</guid>
<pubDate>Fri, 24 Jul 2026 08:26:37 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Attackers are increasingly abusing Microsoft Teams to impersonate internal IT support and trick employees into handing over remote access and corporate credentials, even as traditional email phishing volumes tied to major platforms like Tycoon2FA decline. Microsoft’s recent email threat landscape data for Q2 2026 shows a sharp downstream impact from the March disruption of the […]</p>
<p>The post <a href="https://gbhackers.com/microsoft-teams-abused-2/">Attackers Abuse Microsoft Teams to Impersonate IT Support and Steal Corporate Access</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Top 10 Best 24/7 Security Monitoring Companies in 2026]]></title>
<description><![CDATA[A comprehensive and proactive security posture is non-negotiable for organizations in 2026. With a rapidly evolving threat landscape and a global shortage of cybersecurity talent, relying on an internal team alone to provide round-the-clock protection is often unfeasible. 24/7 security monitoring...]]></description>
<link>https://tsecurity.de/de/3690813/it-security-nachrichten/top-10-best-247-security-monitoring-companies-in-2026/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690813/it-security-nachrichten/top-10-best-247-security-monitoring-companies-in-2026/</guid>
<pubDate>Fri, 24 Jul 2026 08:26:23 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>A comprehensive and proactive security posture is non-negotiable for organizations in 2026. With a rapidly evolving threat landscape and a global shortage of cybersecurity talent, relying on an internal team alone to provide round-the-clock protection is often unfeasible. 24/7 security monitoring companies fill this critical gap by serving as an extension of an organization’s security […]</p>
<p>The post <a href="https://gbhackers.com/24-7-security-monitoring-compaines/">Top 10 Best 24/7 Security Monitoring Companies in 2026</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
<item>
<title><![CDATA[Russian LAUNDRY BEAR Hackers Exploit Zimbra Zero-Day to Steal 90 Days of Emails]]></title>
<description><![CDATA[Russian state-supported threat actors, known as LAUNDRY BEAR, have exploited a zero-day vulnerability in the Zimbra Collaboration Suite to steal up to 909,090 days’ worth of emails from targeted organizations across Western countries. A joint cybersecurity advisory, AA26-204A, issued on July 23, ...]]></description>
<link>https://tsecurity.de/de/3690799/it-security-nachrichten/russian-laundry-bear-hackers-exploit-zimbra-zero-day-to-steal-90-days-of-emails/</link>
<guid isPermaLink="true">https://tsecurity.de/de/3690799/it-security-nachrichten/russian-laundry-bear-hackers-exploit-zimbra-zero-day-to-steal-90-days-of-emails/</guid>
<pubDate>Fri, 24 Jul 2026 08:10:18 +0200</pubDate>
<category>📰 IT Security Nachrichten</category>
<source url="https://tsecurity.de">tsecurity.de</source>
<content:encoded><![CDATA[<p>Russian state-supported threat actors, known as LAUNDRY BEAR, have exploited a zero-day vulnerability in the Zimbra Collaboration Suite to steal up to 909,090 days’ worth of emails from targeted organizations across Western countries. A joint cybersecurity advisory, AA26-204A, issued on July 23, 2026, warns that this espionage-focused group has targeted government, defense, energy, technology, education, […]</p>
<p>The post <a href="https://gbhackers.com/russian-laundry-bear-hackers-exploit-zimbra/">Russian LAUNDRY BEAR Hackers Exploit Zimbra Zero-Day to Steal 90 Days of Emails</a> appeared first on <a href="https://gbhackers.com/">GBHackers Security | #1 Globally Trusted Cyber Security News Platform</a>.</p>]]></content:encoded>
</item>
</channel>
</rss>
<!-- Generated in 1,50ms -->